Edit tour

Windows Analysis Report
Superintendent Dr.docx

Overview

General Information

Sample name:	Superintendent Dr.docx
Analysis ID:	1544115
MD5:	a0122150b44563db6bb8ef18e3d1d599
SHA1:	72d449df047fffb9989a9d47ffa5acb118034d96
SHA256:	d6e5f4427bf23f651faa35e61ddab70b7d241ac92c584a1f200ca2e7809c6318
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected landing page (webpage, office document or email)

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Drops files with a non-matching file extension (content does not match file extension)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 5604 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 7872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8084 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2292,i,13749190250805873838,5698468448711482657,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5260 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://resources.finalsite.net/images/v1716560654/lwsdorg/o4vxkncseuoqphvgnvy1/HSDayReport-05-23-2024.pdf" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

WINWORD.EXE (PID: 4708 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

cleanup

Sigma Signatures

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 5604, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://resources.finalsite.net/images/v1716560654/lwsdorg/o4vxkncseuoqphvgnvy1/HSDayReport-05-23-2024.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49952 version: TLS 1.0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49998 version: TLS 1.2

Source: winword.exe

Memory has grown: Private usage: 1MB later: 104MB

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49952 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.74
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=C7TSSAT5eghaF1F&MD=WpvOBMLF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=C7TSSAT5eghaF1F&MD=WpvOBMLF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: resources.finalsite.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: App1730145716325517400_A4FA213B-A550-4ADC-BD66-DA44A9415795.log.0.dr	String found in binary or memory: https://login.windows.net
Source: ~WRS{2C27AA77-AC31-4282-A0A9-072385398593}.tmp.13.dr	String found in binary or memory: https://resources.finalsite.net/images/v1716560654/lwsdorg/o4vxkncseuoqphvgnvy1/HSDayReport-05-23-20
Source: ~WRS{2C27AA77-AC31-4282-A0A9-072385398593}.tmp.13.dr	String found in binary or memory: https://www.issaquahreporter.com/news/lake-washington-schools-balance-budget-without-teacher-layoffs

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443

Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.5:49998 version: TLS 1.2

Source: CatalogCacheMetaData.xml.0.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.0.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.0.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.0.dr	OLE indicator, VBA macros: true
Source: gb.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.0.dr	OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.0.dr	OLE indicator, VBA macros: true
Source: gostname.xsl.0.dr	OLE indicator, VBA macros: true
Source: CatalogCacheMetaData.xml.13.dr	OLE indicator, VBA macros: true

Source: CatalogCacheMetaData.xml.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{4018C136-4109-43F0-AB39-4415EEBB3D33}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: CatalogCacheMetaData.xml.13.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{3D9F596D-742F-47D4-8E4B-E373EBA344FB}.tmp.13.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: sus23.winDOCX@29/304@6/4

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{A4FA213B-A550-4ADC-BD66-DA44A9415795} - OProcSessId.dat

Jump to behavior

Source: Superintendent Dr.docx	OLE indicator, Word Document stream: true
Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, Word Document stream: true

Source: ~WRF{4018C136-4109-43F0-AB39-4415EEBB3D33}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{4018C136-4109-43F0-AB39-4415EEBB3D33}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{4018C136-4109-43F0-AB39-4415EEBB3D33}.tmp.0.dr	OLE document summary: edited time not present or 0
Source: ~WRF{3D9F596D-742F-47D4-8E4B-E373EBA344FB}.tmp.13.dr	OLE document summary: title field not present or empty
Source: ~WRF{3D9F596D-742F-47D4-8E4B-E373EBA344FB}.tmp.13.dr	OLE document summary: author field not present or empty
Source: ~WRF{3D9F596D-742F-47D4-8E4B-E373EBA344FB}.tmp.13.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2292,i,13749190250805873838,5698468448711482657,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://resources.finalsite.net/images/v1716560654/lwsdorg/o4vxkncseuoqphvgnvy1/HSDayReport-05-23-2024.pdf"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2292,i,13749190250805873838,5698468448711482657,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior

Source: Superintendent Dr.LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\Superintendent Dr.docx
Source: Templates.LNK.0.dr	LNK file: ..\..\Templates
Source: Google Drive.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: Superintendent Dr.docx

Static file information: File size 2250547 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: Superintendent Dr.docx

Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior

AI detected landing page (webpage, office document or email)

Source: Office document	LLM: Page contains button: 'Click here to view document' Source: 'Office document'
Source: Office document	LLM: Office document contains prominent button: 'click here to view document'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 300
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 300			Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	12 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://login.windows.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.184.196	true	false		unknown
resources.finalsite.net	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
file:///C:/Users/user/Downloads/downloaded.pdf	false		unknown
https://resources.finalsite.net/images/v1716560654/lwsdorg/o4vxkncseuoqphvgnvy1/HSDayReport-05-23-2024.pdf	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://login.windows.net	App1730145716325517400_A4FA213B-A550-4ADC-BD66-DA44A9415795.log.0.dr	false	URL Reputation: safe	unknown
https://resources.finalsite.net/images/v1716560654/lwsdorg/o4vxkncseuoqphvgnvy1/HSDayReport-05-23-20	~WRS{2C27AA77-AC31-4282-A0A9-072385398593}.tmp.13.dr	false		unknown
https://www.issaquahreporter.com/news/lake-washington-schools-balance-budget-without-teacher-layoffs	~WRS{2C27AA77-AC31-4282-A0A9-072385398593}.tmp.13.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.184.196	www.google.com	United States		15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved		unknown	unknown	false

Private

IP
192.168.2.4
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544115
Start date and time:	2024-10-28 21:01:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Superintendent Dr.docx
Detection:	SUS
Classification:	sus23.winDOCX@29/304@6/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://resources.finalsite.net/images/v1716560654/lwsdorg/o4vxkncseuoqphvgnvy1/HSDayReport-05-23-2024.pdf Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.76.240, 52.113.194.132, 184.28.90.27, 93.184.221.240, 192.229.221.95, 52.111.231.23, 52.111.231.25, 52.111.231.24, 52.111.231.26, 52.182.143.208, 95.101.111.179, 95.101.111.168, 104.124.11.210, 104.124.11.138, 142.250.186.163, 142.250.185.110, 64.233.166.84, 34.104.35.123, 104.102.19.141, 52.109.68.129, 216.58.206.67, 142.250.185.206, 52.109.28.46, 52.109.68.130, 52.111.236.33, 52.111.236.34, 52.111.236.35, 52.111.236.32, 20.189.173.25, 51.132.193.104
Excluded domains from analysis (whitelisted): odc.officeapps.live.com, slscr.update.microsoft.com, onedscolprduks02.uksouth.cloudapp.azure.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, a1847.dscg2.akamai.net, mobile.events.data.microsoft.com, clients2.google.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, update.googleapis.com, frc-azsc-000.roaming.officeapps.live.com, officeclient.microsoft.com, ecs.office.com, fs.microsoft.com, frc-azsc-000.odc.officeapps.live.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, san-ion.cloudinary.com.edgekey.net, nleditor.osi.office.net, edgedl.me.gvt1.com, s-0005.s-msedge.net, osiprod-frc-bronze-azsc-000.francecentral.cloudapp.azure.com, metadata.templates.cdn.office.net, onedscolprdwus20.westus.cloudapp.azure.com, ecs.office.trafficmanager.net, clients.l.google.com, europe.configsvc1.live.com.akadns.net, mobile.events.data.trafficmanager.net, binaries.templates.cdn.office.net.edgesuite.net, europe.odcsm1.li
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Superintendent Dr.docx

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	original.eml	Get hash	malicious	HTMLPhisher	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:91f62fbc-7621-46ca-93fe-fff80a9adcde	Get hash	malicious	Unknown	Browse
	https://inspyrehomedesign.com	Get hash	malicious	NetSupport RAT	Browse
	https://inspyrehomedesign.com/Ray-verify.html	Get hash	malicious	NetSupport RAT	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	https://app.pandadoc.com/document/v2?token=2126fee3194112970cb23c51d0c56249323ace2b	Get hash	malicious	Unknown	Browse
	9xNI7vE1XO.exe	Get hash	malicious	Clipboard Hijacker	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	https://e.trustifi.com/#/fff2a6/655144/3ac50c/e93bb8/594e42/41c163/f1cd98/92ee40/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/848a7a/9632d0/879ea4/bcfc0d/744595/93daa1/f34456/a15015/3ddaed/fad545/1fd970/328bf8/9bb3f0/c514cd/df7a51/88456c/c9366d/790245/fb6752/33794d/6e0d28/60381b/a98a06/87eaef/01f4e4/642891/927008/b3d84b/be88ef/6f56ca/922d7f/c2017a/2b28ce/5f100a/ab5cfe/ca732f/ba9f64/6c13c0/db448e/12afff/ea859a/0054d0/06ab25/ddf455/c36939/fe771f/592f7f/fd9f55/51d733/4f5c46/02cddd/dbef71/7c02e0/b3eaba/7eac45/4a8768/a7dd16/2174e0/de559c/dacc2a/571f0f/f5f216/44ee34/abbbf4/b6cd49/d82da6/795ff3/bc1fdf/8febc7/4b7488/0cb4fb/7ef03b/a191c5/4d2316/483906/0c1e88	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	http://browserupdater.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	ZtefPP1HI7.cmd	Get hash	malicious	Unknown	Browse	23.1.237.91
	35ZnVKToSL.lnk	Get hash	malicious	LonePage	Browse	23.1.237.91
	Bill Payment__8084746.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://ERICADLERCLOTHING.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.google.ca/url?q=nyYhuJkyZc5becm4Aebd&rct=dHYJbECHyHBgmK2d6Hkk&sa=t&esrc=VPIIRnP5TJCWQChPCgwH&source=&cd=TWsylIzvnNqdQKP0bZIw&uact=&url=amp/uniquestarsent.com/ck/bd/BNsT048mrEEHImhtrfrgmcfu/a2Vubml0aC5jYXNlQGFkdmFuY2UtYXV0by5jb20	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://23.245.109.208.host.secureserver.net/E5V7V5K0D7J7U1G8T1M8U3B4G7B4C0&c=E,1,2fln-18Rcg-_y13WFwFZvQn3f1CXlYk0J_eiM8RKZuA6Djx49SsFA5in1hnyQJXLjWW1L6y7WaZ9eFSqcAvQerMcOF3C93rx-F5tfSihNA,,&typo=1	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 172.202.163.200 40.126.32.74 13.107.246.45
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:91f62fbc-7621-46ca-93fe-fff80a9adcde	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 40.126.32.74 13.107.246.45
	https://inspyrehomedesign.com/Ray-verify.html	Get hash	malicious	NetSupport RAT	Browse	20.109.210.53 172.202.163.200 40.126.32.74 13.107.246.45
	setup.exe	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 40.126.32.74 13.107.246.45
	https://app.pandadoc.com/document/v2?token=2126fee3194112970cb23c51d0c56249323ace2b	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 40.126.32.74 13.107.246.45
	setup.exe	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 40.126.32.74 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.109.210.53 172.202.163.200 40.126.32.74 13.107.246.45
	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 40.126.32.74 13.107.246.45
	https://1drv.ms/o/s!BOd5RNxFaxkGg1r5bc30bgQWmkNc?e=J67qxK-KfEurqpMk0dasTw&at=9	Get hash	malicious	Unknown	Browse	20.109.210.53 172.202.163.200 40.126.32.74 13.107.246.45
	https://docs.google.com/drawings/d/1O7L6jnunpKYYRy1ZXX5DN4ENeZ4pxxWF8BG0mcDdFi0/preview?pli=1ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVe	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 172.202.163.200 40.126.32.74 13.107.246.45

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (2300), with no line terminators
Category:	dropped
Size (bytes):	2300
Entropy (8bit):	5.119832059921082
Encrypted:	false
SSDEEP:	48:cGagdypdSyrvnzy7SymJdy+dydASyNdyrwnzyrMdnzyDkSyrXnzydRyK+y1+yO:pEpdbT27bwE+EdAbNEs2Yd2IbT2dQ+pO
MD5:	C6AB21DC9DC3420AD8E087534A5D8C67
SHA1:	DC539D9180BEA52B8989E95D58BE2E5606312088
SHA-256:	AF59FF2C56CD9653E1852B741ED9DE41802851237B8010384E4923281EAF27C3
SHA-512:	D39D0DCC00658ECB702AE935619DEEE570033511F884BC6251B5FFDF385D432C3914C898B9FFE4B1DE871A26CF46734D66C708B775D6F2D061FAFABC75966080
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>15</Count><Resource><Id>Aptos_26215680</Id><LAT>2023-10-04T14:08:57Z</LAT><key>29939506207.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_26215424</Id><LAT>2023-10-04T14:08:57Z</LAT><key>31558910439.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos Display_26215682</Id><LAT>2023-10-04T14:08:57Z</LAT><key>28367963232.ttf</key><folder>Aptos Display</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876224</Id><LAT>2023-10-04T14:08:57Z</LAT><key>24153076628.ttf</key><folder>Aptos Narrow</folder><type>4</type></Resource><Resource><Id>Aptos_26215682</Id><LAT>2023-10-04T14:08:57Z</LAT><key>31169036496.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos_45876480</Id><LAT>2023-10-04T14:08:57Z</LAT><key>27160079615.ttf</key><folder>Aptos</folder><type>4</type></Resource><Resource><Id>Aptos Narrow_45876226<

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:	3072:gdTb5Sb3F2FqSrfZm+CnQsbzxZO7aYb6f5780K2:wb5q3umBnzT
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\DengXian\43258772542.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 22 tables, 1st "GDEF", name offset 0xe97624
Category:	dropped
Size (bytes):	15420644
Entropy (8bit):	6.8603124590485915
Encrypted:	false
SSDEEP:	196608:VMjwed+XDg1FHhkC6XXLqwL7qPz/KTzPAsGb:8+T0FHhx6XXLqIGeHPG
MD5:	2AD2850CE7606E00E2375CA0C3E94CB3
SHA1:	20786946BC9963F70C0CFE4BB76B2560E51CF0AB
SHA-256:	D140455853F80D2EC35D4C0BE5939223E4AD9D305A05BD85690BE36F89484293
SHA-512:	9B907BA1C728E2BD8B8936E447CE93C492314EF3AC5BBB3A0311C3A40115CFF1BB03926A993481245295C87AD056B1A069E3A4E358072EB7FDEF900474303039
Malicious:	false
Preview:	...........`GDEFo.s...\|`....GPOS......\|....,GSUB.Cn...\|.....LTSH..O....0..s.OS/2..@........`cmap. .....\..B.cvt /..\|..Dh....fpgm.I....3$...ygasp......\|T....glyfJ.4v...8..Z.hdmx......C.....head...T...l...6hhea..y........$hmtx.......H....loca...L..M....8maxpv..#....... meta.:<..~,...`name..FC..v$....post...f..\|4... prep.U_...A.....vhea..u...~....$vmtxhJ....~....4......5..,._.<..................U&.....5...................{.%.........5................sg....s..5.1.C......./.....P.y.........,.....................]..................8.\|.........BDFZ... ...{.%...{.........................^...u.......D.B.].....Z.........^...^...w.I.}.....7.n...........].j...Z.].b.].x.z.6.]...]...B.L.].z.].q.......7.}...}...}.....\|.....`.S.....`.}.....M.........}.......-.....\.................}.......}.....+..._.K.u...(.6...B...R...V...V.^.......^.6.}.'.......O.8.y.......^...^.L.^.@.....^...............................^.......^.....9.s.j.................'.......I.^.g.....^.Q.}.....8.......................i....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\DengXian\54497409372.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 22 tables, 1st "GDEF", name offset 0xf7e31c
Category:	dropped
Size (bytes):	16306792
Entropy (8bit):	6.8674937185410325
Encrypted:	false
SSDEEP:	196608:DEf+YYdpfmjx1HcSx28mSINqTfaxFilLRomja4kYR:DEf8pYx1pEpNqTf6oZmmuNYR
MD5:	B87B97F03B19630FDA9000AFFCB8AA99
SHA1:	24379FE17963D9736F3631D3314E6F51873DD545
SHA-256:	56FFA4AC28E406B79D085A660CFF84112D63EC244D0C810AFAD38C252DFB68FC
SHA-512:	E15E1A0F54EF30D4834F9A8C884C570B141060D6F2D297088B3AF15BBCE5A390C749934CC19C14CADD9DBDB4EF0F100140BFFC7BF4C57C118C4F000394D673A7
Malicious:	false
Preview:	...........`GDEFo.s.........GPOS...........,GSUB.Cn....H....LTSH.......0..s.OS/2.P@........`cmap. .....\..B.cvt 63....D.....fpgm.I....3$...ygasp............glyf...........hdmxp..4..C.....head.......l...6hhea..y........$hmtx.......H....loca..Z...ML...8maxpv..Q....... meta.:<.......`name..0.........post...f....... prep..nK..A.....vhea.n.7...(...$vmtx<.0g...L..........5.h.i_.<..................H......6...................{.%.........6................sg....s..d.1.B......./.......y...............................]..................8.\|.........BDFZ.@. ...{.%...{.........................^...u.......3.6.\|.....Y.*.......w...w.....M.......2.q.......2...\|.e. .Z.\|.j.\|.}...6.\|...\|...V.L.\|.q.\|.m.......2.................,...u.:.....].s.....T.........s.....................I.........s.......m.....W...p.>.....>.(...3...<...:...A.w.../...w.7.........,.S.J.o.......b...b.c.b.o.)...b.....................(.........b.......b.....h.w...............&...#.......:.w.f.....w.M.......#.......................P....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Fira Sans\21487488679.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, digitally signed, 18 tables, 1st "DSIG", 28 names, Macintosh, Digitized data copyright 2012-2016, The Mozilla Foundation and Telefonica S.A.Fira SansRegular4.
Category:	dropped
Size (bytes):	456996
Entropy (8bit):	6.130007478273708
Encrypted:	false
SSDEEP:	6144:Mq6HqYrM+41fZmSogUSUXlaotkb5vFt+SsiN62xCoLFA2Onp:M3HHW1xBogUTXl4iKLmnp
MD5:	8A8828468DBB8CA0386EE288E8316257
SHA1:	84F881473FFF39FEE5FEC71F8896A536326C2C77
SHA-256:	C29556A2719BF613EF3D5E070E40D903A8965D9C081BECA1375DC1E6E0F93C23
SHA-512:	2AED12D5A08D0F30940CA2FB39F39A0DA14CAA5789C2C3F2E575F93547E89F2AA81E762FD3EB1E70168DFD2FBACDD9B729E1E69408810DA49DFB25240A1669DE
Malicious:	false
Preview:	........... DSIG............GDEF...m..Uh....GPOSJ%._..V...U.GSUBf........N.OS/2`..A.......`cmap31.P..,X....cvt b.....L8...0fpgmvd....>H....gasp......U`....glyf..S...w...f.head..z@...,...6hhea.......d...$hmtxX.........Nloca..y...Mh..Tmaxp........... name..IG.......post&?Z.......p.prep.a....K`..........3...xZ_.<........... R.....f.#.....P.P...........................Y.P.........................7...^.....8.I.........................X...K...X...^.2.<............`...............CTDB................ .............. .....{.........=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=.....7.=...=...=...=...=...=...0...0...0...`.d.`.d.`.d.`.d.....C.d.l...C.d.0.7.0.7.0.7.0.7.0.7.0.7.0.7.....0.7.0.7...d.u.d.u.d...........d...d.......d...d.......d.C.../.d./.d...d...d...d...d...d...d...d...d.......d...d...Z...d...d...d...d...d...d...d...d...-...6...(...d...d...........-...d...d.....w.7.w.7.*...w.7.w.7.w.7.w.7.w.7.M.7.......7.......d...#...d...d...d.....d.(

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:	12288:Zn84XULLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/cLQ/zhm1kjFKy6Nyjbqq+:N8XPDs5+ivOXgo1kYvyz2
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1298), with no line terminators
Category:	modified
Size (bytes):	1298
Entropy (8bit):	5.043941014726603
Encrypted:	false
SSDEEP:	24:2dtatFtAzBe0X5qsqX5qi0X5q7hX5qYeX5q+YX5qka3X5qpyX5qO:cGE0NiqCYWxwpO
MD5:	5E35718FE7B9A7B1CA98983E3A9EF954
SHA1:	76CF514AEBEB3CCAAFC1B0C601B1B77158B0A5C3
SHA-256:	B7CC3B329C699A3B990B04595D1142F8FBC469387E96D9135894291894732577
SHA-512:	2321CD6FEC0998CD0764E15DE6EC233323518945AFC6ABCC3ECF7A296D80E5674A37AAB76646C0C9EEFDA7F805083692C2433583DE0E2C301119C01715B39DE8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>8</Count><Resource><Id>inkeffectsilver_0</Id><LAT>2024-10-28T20:04:37Z</LAT><key>inkeffectsilver.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkeffectgalaxy_0</Id><LAT>2024-10-28T20:04:37Z</LAT><key>inkeffectgalaxy.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkeffectgold_0</Id><LAT>2024-10-28T20:04:37Z</LAT><key>inkeffectgold.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkeffectrosegold_0</Id><LAT>2024-10-28T20:04:37Z</LAT><key>inkeffectrosegold.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkeffectocean_0</Id><LAT>2024-10-28T20:04:37Z</LAT><key>inkeffectocean.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkeffectlava_0</Id><LAT>2024-10-28T20:04:37Z</LAT><key>inkeffectlava.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkeffe

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectbronze.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	51359
Entropy (8bit):	7.951666710600864
Encrypted:	false
SSDEEP:	1536:R0RcgzFbKPP60jIl5/IwaJczf3CtvRX5/wWi5:bgxbKPid/IwnzqJ5E5
MD5:	C78ADBD2D46B0E9C1D82F07CE097886C
SHA1:	FB1112D34E16E16AEE78EEDD4FC646ED9BE2AF93
SHA-256:	AEBFCC397AEF37AFE927595078B879AB56A3EEA1725B49E5716DEBCE74B8757C
SHA-512:	0EE4D259906BA938FAF8C1A0ED1A77FB4AD16313839B8790955448F7219806B4B70BA318A359F4724031C62300D4A24E0C63CFEE233EF25B3AE907F5F09AB89B
Malicious:	false
Preview:	......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="adobe:docid:photoshop:cf966bc7-2e03-1179-b805-d8edc999fcb6" xmpMM:DocumentID="xmp.did:630AA0AD350711E7A8B5D05185B6C702" xmpMM:InstanceID="xmp.iid:630AA0AC350711E7A8B5D05185B6C702" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:93DCC65027C411E7BFED96D58044CBC1" stRef:documentID="xmp.did:93DCC65127C411E7BFED96D58044CBC1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............!.!4..4B/)/B=3223=FFFFFF

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectgalaxy.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	39125
Entropy (8bit):	7.979802521866709
Encrypted:	false
SSDEEP:	768:WCjr07kqJ96I8cTgooRTYWHj3FkbeP2rcZ7EHA6s5:507kq2SEo+TLjTw+7EHTe
MD5:	239B06776C5028E8696BE5DDE3056F40
SHA1:	5BA5F0F7762296CBC0A066608E611AAA4D386F75
SHA-256:	D8A45BC6BD592ED29DC7F74666B6C22D4ADDCA52261FDF2A929CE7205FC4EFCA
SHA-512:	7B5319E22DC8D422C9974A6DE23B094CCBC89861FFBBA85C5A19137B1A7CE3224E34978F2AF5777BB357571379B998DCBB30951DBEF32BBFE8C73929D2F90B86
Malicious:	false
Preview:	......JFIF..............................)&""&)>,0,0,>^;E;;E;^SeRMReS.vhhv...............................)&""&)>,0,0,>^;E;;E;^SeRMReS.vhhv.........................."..............................................BKB.@..h.Z.Z....ker..Xd!.E........y.e.<...tNoK...:..B..R...,.uAM....H..Rd..h....%Q...'#.......JRcN..pGL{3.1....!C.8..y.R..3....$.%..H.......eoG..\..M.........5..........c.F{....j.....&?J.*.ad..Y3[..2\..5)+..Qh....g.)....biQ$@..uCV..0.&+..#..,.B...JR.\|lp.C...{.V.;N$.m.w.j..;"..:.$....Z.sj...!,m..G5...l...Y.l/.J....:.=.;u,:.G.....u/.u.u.#5..Y.C....DI......t..B.....f..v(t.......0H..M.d.5e.J.l..(...C.K-...S4..HR.uz>....f.q.jU..$..q.....QG....%.=.@....\.t....v....f...r:;[.n..W/.&....._..Q?o9.S.....s.Y....T..yT...;T..c.G.Lk..tf.0 ..x.".#Ptw%n!.P......%.]+yWb`lY.y&k...t..pr1=I.Z.A....i.......I..k.{.!.G8........vi1]./\.6_....Z...:X..1...u ..\.n...<.-}...D.>q..G...F......?Z.V.\..hX.....#.Ec...H..s...m...\..6.[V&.V.Fwv4G6.!%.Yg...3...7.m.

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectgold.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	45967
Entropy (8bit):	7.9705077862907885
Encrypted:	false
SSDEEP:	768:IuC14Fy5SyHdNNbx4IsRctKVqjrk+wiM6SNlM3jDbS+TFhNdc:IuC+RkRSjyxoPNl6DbSqhNdc
MD5:	041305375CE26DE66A1405C06819D3CD
SHA1:	4448296BBA3BD8ACF34D1AF5C4CFEBDFD6B07919
SHA-256:	4BB1E1D1139CAFDD96D4C98F78086B3677A68A90ABCACE31250F1442C9E528B0
SHA-512:	F15A172058470337F9EA00F5757A605A0A069A7C232BA6015B2839CEC27DCEA30E81BEFD811AC15D9B442648FFD9F07B82B1E104F86890C2F2680242EC32958A
Malicious:	false
Preview:	......JFIF..............................+'$$'+A.2.2.Ac=H==H=cWjVPVjW.{mm{................................+'$$'+A.2.2.Ac=H==H=cWjVPVjW.{mm{..........................."..............................................rZ.5E[.lH...Nn..r..chh9.E.`..]9...!xS[.{...G.i.vUG.d!+Pu#. .%sF.GE......W..&...zo..l...og....F.Q..H......=....=.q.....x...R..P.)V..<.....L......>Y."O=.T.."s..Y...gtx..r..A....oAUg>.c....hx.1.gF.u..,.\|.yPT.R......B....$!...,.P..=$t..@...V5I.i..j..s55.+.BBMJ.<4I.F\|.j.>..Tq..$....\|....f\|r.y./e.]:9;/........i.t..6...D.I.......Qs.CU.0.KP,..J...N.A-Y.........qp.+..._6Y.}..-5.5E#.x..J...+.RJ..X....Tc.o.I....1...Fp."...J+..L...8.l.k...{..'.L..X...Vu.t.h..$h..;."=f.c......uj...1...4..:..pb....N...D...zn[.X-v...X.g....C,.].UaX.Q...."..=4.\e.V.~.5.....qI.....T/M.Hl.F.y.S%E]f.G.<....+p...5U.kT\|.Gs..z=.D...n.\|.t~..)..2.:.........B.Jf.S..C.#.........J.Y...-..U..k..A.K...V.@.GEpb...d.....W...D......#.....'X..J....'.i.Kw..+.6.#+..J....,.}B.Tbh.i

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectlava.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	46495
Entropy (8bit):	7.9661137194510605
Encrypted:	false
SSDEEP:	768:VQ++TcRGfH5eNodvzDnMex2FzuOojrl+X4H+91i57BR/SUcKkuMw2D:cTmQHICzA7ijrlZ+9g57BZSUcKk5ww
MD5:	437A5A184681BCFC608FD1E97D708616
SHA1:	7D84FBE6D4DED5A3C98414F458CE071BBC9035BB
SHA-256:	D1F0B68D87F6B09555851C30F0352A07952B5B0885EFB8D3E3FF5CEE4279E87B
SHA-512:	6B2D7542117A4F4DA956CB7EF4C09F69728F793C0DE6BAAC6790F73E923600EABA0FC54D1C7082483244EF1DA0246158C69143CD297FA08131B302AAD04B5003
Malicious:	false
Preview:	......Exif..II*.................Ducky.......2......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9ddd68a3-599c-c447-b762-dfdcc6ed67f0" xmpMM:DocumentID="xmp.did:6DA3B3432F9611E79EC5C8FB588A0A7D" xmpMM:InstanceID="xmp.iid:6DA3B3422F9611E79EC5C8FB588A0A7D" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:171e06c7-6010-1747-9ee0-2032452c22f2" stRef:documentID="adobe:docid:photoshop:647e5738-1e35-11e7-9c56-d2f51c83e137"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectocean.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	51762
Entropy (8bit):	7.969551469107947
Encrypted:	false
SSDEEP:	1536:2RjFVIGWSX55YGjQQq35KuAt85LMn7Tz+dR8jG/t:2RhVIiiWQ9sxnLGR8jG/t
MD5:	B3DB04E08D530D82F33A9B09EA528595
SHA1:	C503E80D02BACAC44C1E53D2C2289F5702B0C829
SHA-256:	35711A8D24732AEB50300EACD3E231BFD5676D6575830240BF7111BFF040B9E5
SHA-512:	C6B66DC04793FFAD8C7CEE1908334C664D122B6D444B8ED534E20E5FA3A7ED22062697C759BD8236910BD5E88D321D11C4BAC7EF40B64E3E69620AA7AEF26B1D
Malicious:	false
Preview:	......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:bbfa45cd-c1f9-7e4b-bdf0-5a08d3643b82" xmpMM:DocumentID="xmp.did:7E9BDF902F9611E79068964DF66B6A5F" xmpMM:InstanceID="xmp.iid:7E9BDF8F2F9611E79068964DF66B6A5F" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:bfdf1a42-cec7-c342-962a-2f28aa7f0712" stRef:documentID="adobe:docid:photoshop:21012dab-1e31-11e7-9c56-d2f51c83e137"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectrainbowglitter.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	77636
Entropy (8bit):	7.98325572479678
Encrypted:	false
SSDEEP:	1536:GQvLaOfOKaf5ZKLzFxDZsDYlV4uCD258Vds+7RWiakyvggK:mOOKahZoZqY+uDCVe+Aizye
MD5:	DEE12646BC7E105B3A97555A5AD46F1F
SHA1:	D3C1F8FAFD06682514F2A88B5DD4B2D0BB1C9D0A
SHA-256:	F47061DFB3F3312AF65E739C09EF51B0F0C2DE21FDCD344C35B5E9C37665CFD2
SHA-512:	3A94C1975B50995BC368376423203F072417C83C4A65312122C0258075EFA6C0686D01A4B9CEF67D30012D0509DBA69D03921E9E6A6171C1F9E52690D5C2CF7B
Malicious:	false
Preview:	......JFIF.............................."...."4%(%(%4N191191NETD?DTE\|bVVb\|.yry..........................."...."4%(%(%4N191191NETD?DTE\|bVVb\|.yry......................"..............................................\.gI.:SI1F....Q..)._.t...9..l..5..++T).R..lQk<..H}.mS.Z.~..d......r~...W+.\.b9.i.A......Q..D.w.\|..#k......3.&V[d...UD3..Gw?G.........T..a....m.Zi..Q4.ltL.].-......j.B.F.+..gN9......ch4.3.D.s..w..Vy..lRm..qh-rP...u.....+....=.2..i.h..dz:...z.,F..;....b..Im..c.5.#.=.......7.....\..G..]l...O3R1?.....r.i.'..~.h...\|.R.j.p0y../F.iR..:......iK.m.X..`".:.4v..........i......9.0..l}><..6..".*..SEc....0u.r.&...Cl...S..f.\|....v...-.v.lA.y....8........F58.>\|.W?..)..X:........]2...3R...s.\.S..".&...g....H..rT......XR4.K..L..=.......#..C'...._>-.S.RRoH.]..B>'...{.9.^K.u./y..Q3Z...g......?.f#X....yoK.%X.`P`K/;:..u-.4..+....."_Q..kU..:...._.@5..&X.t..J....e...t.`.k.."HZ...V.gln....b .....U.0.>.jk.b\t.R...^..C.N.........w..-.AqEk...c.f...[Cw\.XKF...{.......'.9.

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectrosegold.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	42587
Entropy (8bit):	7.956158176110853
Encrypted:	false
SSDEEP:	768:33uVCSrPcSrBbXGFz+dT+YrUjmJ3/Tm14bFXBFfP+EIbeIIoAuYY4so2/EKchzum:33uV74StXhSYrUiJvTsCNjNIbz6pAEKk
MD5:	481D6C397EC9255C7158948ECAEE6585
SHA1:	F6692C7064A6E54991283963DA5190C179753D19
SHA-256:	EDE39E66268900159B6B80106B11EF74539F5077D8206DEEAD9B98E8F3CFD176
SHA-512:	5B4BC810879E55F712E0E860FB4D4ADE54297DC574C1658CD3E61EDC8D0AAD9B0EFED16EAA347B663F1271207BD2B858B8644B333BE98CFB0C6536279A8950BE
Malicious:	false
Preview:	......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="adobe:docid:photoshop:cf966bc7-2e03-1179-b805-d8edc999fcb6" xmpMM:DocumentID="xmp.did:9328F00B350711E7AC20BD1A5FC75C1C" xmpMM:InstanceID="xmp.iid:9328F00A350711E7AC20BD1A5FC75C1C" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5BC0E725279811E7BFED96D58044CBC1" stRef:documentID="xmp.did:5BC0E726279811E7BFED96D58044CBC1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d................$..$-"."-)#""#)8/////

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectsilver.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	38755
Entropy (8bit):	7.969372339631151
Encrypted:	false
SSDEEP:	768:xIw5we0JUmH9lDEt7ABvuRYLZ2CjOkqwP6HtSbIDNEaP2bu4:xIeweU9uABvkYLZ2Cj5PhIefu4
MD5:	D1895189ECEEF4679EAA001B3F779DB3
SHA1:	FC4AAA7A7F84C806F042A80E1F90B8E7236A8559
SHA-256:	3D832CABF1C0DAAA5314F32A8E412E36F5628F6D2A14A021901D667773B382D3
SHA-512:	E44A6E7AA7E2BEE1C1C5635AC255BBCB361D2532A4169F0D1F757EBBAA384B11B1635D932CD44E1748821459F53B81EF79B6642080C77F41BC4D93C8B73F312E
Malicious:	false
Preview:	......JFIF.........................!#.#!0-))-0I48484IoEQEEQEobwaZawb..{{...........................!#.#!0-))-0I48484IoEQEEQEobwaZawb..{{...........................".............................................`:y.C....(.$e.RFmA..QcW..x..I....9..l...u.Rak.J.W....:.F:.Kh`+....CU.QU.g.^..ps.\|..4..1CN^.N.b...[....Lt..S...K.....dFLv......yJ.&...?"u..j.....d.F....r...<.....t.D......'Hv I%..^iKI..p..........A..i...u9(^ZS. .'J."l.M.uFE...T....,:8..w..JfJ.K....w,....EE...x........v)...e..=......v..A.{J...].4f1....Y..s.i2nn....}h9....^}...u..W....z..Vw.bk.bp......,.... .2.fS...U:dB....r:..N..uG..;b..\m.=z,+.^A....JV.+...6..l..!.(.Te.k9..J..s.5...P....IVF.i$...OA 77D.K x....R.0..nr. }...2g .....Xi...b]E.E.shO..i3G].i..v........jt.L.YG;.T..n2n.d..N.mi..Jl.#......yK...\..al...m.]..e.j.D..eA...Q..~~.F....4....0u..<..2.g.......!......].9cF.IX..g3.:n{j.l.......ON.\|f....}....qz.!..Elc.X.,.t.j.j;.....I.m.X..sR..0^........;N..N..U..Z

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\oart.json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	8515
Entropy (8bit):	2.376758026536063
Encrypted:	false
SSDEEP:	192:OGEGGGBGcGSGwGdGKGjWqGjWUGjW3GjWiGjWAGjWUGjWTGjWwG/zhGzPhGjf4:zJbwx3F8f02FU+UJiUsk
MD5:	53D49444EAF92E0CF5D2985CCAEDE42B
SHA1:	DA2D6C55752243AA5E638750F038DADF3C9FE6CC
SHA-256:	722A39658D2F3D5E333874F23485CEA9DA2B79EDA454FA7F5A9FEFBFDB9B2AD8
SHA-512:	B59D16AE8DCB2D9F02BF7CD594A94D140C9CB308DECFEEDF89B9C166657D8B6BD97FA7CFCF97F0D45E184A470B209F28F1ECC420C5CBF8D88D6E0E1C3AB48064
Malicious:	false
Preview:	{.. "MajorVersion": 1,.. "MinorVersion": 5,.. "ResFamily": [.. {.. "Family": "InkEffect",.. "Res": [.. {.. "n": "inkeffectrainbowglitter",.. "sub": [.. {.. "sn": "",.. "sid": 0,.. "ext": "jpg".. }.. ].. },.. {.. "n": "inkeffectgalaxy",.. "sub": [.. {.. "sn": "",.. "sid": 0,.. "ext": "jpg".. }.. ].. },.. {.. "n": "inkeffectgold",.. "sub": [.. {.. "sn": "",.. "sid": 0,.. "ext": "jpg".. }.. ].. },.. {.. "n": "inkeffectsilver",.. "sub": [.. {.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.858013534055821
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxbyxl9Il8uTPh/8Qc8Kh1S2KEF2wXJd1rc:v7WYlPh/g8Kh82KEIwq
MD5:	F6A12C6B35457C70BECF03D318FA6E8C
SHA1:	2684DA89F1CD9123EC34D12832075372A8C0C5A4
SHA-256:	A7F724F5EDDB9C0E942DEB3C63E08B85E698FD0F0839C9DA06FC2483AB97613B
SHA-512:	E76F77235CC4D47ACBC71183F328E82E279FCB82DBE5DAA68617952D7A6434E8B80BBBC3CC03497556FEFA5AA6474475099A9B8487B5157B5C7DF340D9BA455A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.J.S.D.o.X.w.p.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.l.Z.Q.t.R.g.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9003445262751275
Encrypted:	false
SSDEEP:	48:uiTrlKxJxhxl9Il8ug2lNYiJ79ugX90GjpNAqOvud/vc:UYiGrxyC+qOv7
MD5:	1610FAA64AC6D58EBA5B5628C09B4EFE
SHA1:	D35D71047549EED9B5AE4A35A5C5BD1F9DBC0F45
SHA-256:	59FC7BDFB193AEE5CF948D6FAB87D8019D74856ABA5390328FE03BA4332E7FFA
SHA-512:	D8BA2DFB66F400763728E7F16AE4335AEA31EDFA6CB1FC98AEBA177AA66E50F0823462C9AFFE843E75D65D248104B786143A7D0CA77EB70593C6D096881B8D3F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".u.y.z.k.u.E.V.I.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.l.Z.Q.t.R.g.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.993449784827105
Encrypted:	false
SSDEEP:	48:uiTrlKxxxN/yxD9Il8uUJNdeeFHQoAWTnqt2oegrsGILApRaZqYNRpKLMhj5/mYl:2MYiNdNN3TqIG9p6qGRprhsXchrVW+aY
MD5:	9265488083F0F9DB4C9909416CE67B8D
SHA1:	2E7CAA1399EA85D91320B7CC19A1D39F81D6A86E
SHA-256:	1B0F321C0C4950B3632171C79476D1A7981C01907D4ADFDDD3636F0DB7D588AF
SHA-512:	20098096E26E8FFDD49A8CA17BA53F7B811C25402D8CE91FC3FD6C72C3CC64CAD4E5B3CB897C9A457E03DE666B5E1567336B704605D48E089D84DC5D43BE18D8
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".n.f.Z.R.h.3.Q.p.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.l.Z.Q.t.R.g.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1363E464.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 1145 x 617, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	349014
Entropy (8bit):	7.982340809053343
Encrypted:	false
SSDEEP:	6144:HSlDpH1cO7C+AD0lu55wd3EkgqAc8lDqSv2+/jD2DSvA6sUQV7XC:wR1puBD35wMqAc8J3/vvALVW
MD5:	10E3C802FED4D3B5268D11C969C7B322
SHA1:	ECED4C72B5CCB7138DACAF1256EDF43ECB3FD00D
SHA-256:	2DFC54BB959EED557949590D2E7202B707A9BF1F6128F342726B61DCA66D2031
SHA-512:	22995A1E7C581B0F4B9F43F4F3F8163DD62868D0501CA9A8FCC3F7BBC0EE9ABE34EF1EED9E28435C377B81CEC480BB694302169FC9BBE190DE21D5E366061666
Malicious:	false
Preview:	.PNG........IHDR...y...i.....9j.y....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.}..]E...z..M..^IO..........OE.]A...A:H...Jz...f........o.%$..j./....;w.3g.9wf.'O..........................................caaaaaaaaaaaaaaaq..:y,,,,,,,,,,,,,,,,..X'.................A.................8.`.<..................................... .u.XXXXXXXXXXXXXXXX...N.....................caaaaaaaaaaaaaaaq..:y,,,,,,,,,,,,,,,,..X'.................A.................8.`.<..................................... .u.XXXXXXXXXXXXXXXX...N.....................caaaaaaaaaaaaaaaq..:y,,,,,,,,,,,,,,,,..X'.................A.................8.`.<..................................... .'O..->f.....@..G.^.r...O...).y.<nT................2..O.>.CY.r..R^...!.8..=.....88`.<. .x...3. ..!.(..Yx.9.....h...:y,,,,,,,,,,,,,>.........C..E....nA...sN.....F.8(`.<. ......[..........]..?...k9...n................y.9.....Y.^.$.A..K...__vV!........q._.._...@....y...9....#e5..:y,,,,,,,,,,,,,>....ea..qdoz..x..:.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1440037A.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 1331 x 666, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	123738
Entropy (8bit):	7.9797054200527135
Encrypted:	false
SSDEEP:	3072:9/8A6kWS8ScIT5pdwYW6sTXAg90MEJTtE4H81gdQ:9kA6bS8FSpdwY2TXAgSMp4GgO
MD5:	D242D823B6110CEB0AEC1D8FC742C065
SHA1:	DE7665AF07BE240941A3E3BD1158FCE9C285458D
SHA-256:	3BA08D31A5BF47901963CA028BCA02F4D794EB8799EC06F9BD772850B10DA1DD
SHA-512:	1B26756C0051249B8448698B063D29B51BA6A5EAF8DEA54C5CA2A8578C7AE0782737B219C4B5F8332BAC84A49A45F55C7A840A678BFE6EB3861DF0C8FFFB51E1
Malicious:	false
Preview:	.PNG........IHDR...3..........z.g....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...\|......%...-UZ.......llL.m.]`.3......2c.6...-....Q.{....^.ki..R(....g..$..'...+.(...........MN%.............d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q. ....DDDTG.A..EDt..7A.....n....d.L"".:..<........n...;.d&............fNDDT..WB.;..CXgy.Q...a..\|.V.A...../.z..~.....o.../..]&.>.....n....a..'.!.;......d.L"".:..;. .....Q....G..S.-...;......b....cDO..&.".{nnn(.8+.".[^....U.1.IDDDDDDDDD....DDDDDDDDDT/0.IDDDDDDDDD....DDDDDDDDDT/0.IDDDDDDDDD....DDDDDDDDDT/0.IDDDDDDDDD....DDDDDD7......{.....K.k..6.]DDDd.d&......6,.u......7...X\|....#.6....i.;..\|O..\..;.......h.-^...ZX........h....."..FDDDDD....6...X..=...<...*.R.a.\|.......B...AU.5..k\7\|0Q..A..J.C:V+.qJ...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\16D67115.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 956 x 602, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262877
Entropy (8bit):	7.977092554682118
Encrypted:	false
SSDEEP:	6144:MddkYTmP+9xgBGkWS5eIs+UkEz9l4BfFboAn+LDT:UdkYTEUxgEkWMXWibU/
MD5:	05259B6AEA51222591E58B15E24E0EBC
SHA1:	1903C6C63898EB5443ECCC4AAE523D990002DEDE
SHA-256:	733DDEEF0DF0329837BC39D46CB31E921E635BF418F6B1449EBA5F3BA3CF8966
SHA-512:	21A19545043CD6886687B16B84B55D629960648D8622AC6367B8AB522EB5BBEB196072B3CEB2B72A80FCC51A8BB93AA5AA37D984943F736B38DE4027693A7AF3
Malicious:	false
Preview:	.PNG........IHDR.......Z......)K.....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.]..]..=..%...FB.`....-..(.._..PA..(...CB ..I...l<.Y}..?...@...-...}W.\|....{.I...............?2.S...............?................G...zxxxxxxxxxxxx.(..^..............%\|................x=<<<<<<<<<<<<~..................>...............Q................?J................G...zxxxxxxxxxxxx.(.H.......g`....F.I..p.'C.+T#...Y{xxxxxxxxxxxxx.....L...2..$l?.."..C...=.....x...+...O.Of0.8......P]U..@................o...b.".P.:.c..f..F0...G.;O?.R.....7p.{.Q..D2.u!..J2.. ..}!..&E}....M....O.}........i...o.t.7x:..<..../...N..O.}..O'..8.P5..`.1(. .../.....q....U....^..a... ..o ..].....j."~...j\|.m.<.....t.\|_..<....N..O.}.....i...b...o.t.7..t..H.!...H..............OpI.o..^....O.a.0.....#....,P..}..yxxxxxxxxxxxxx\|..3...T..4...:..d9..z....-.....{.w.3.Ef#.%..3.X..w..................7.fx.../.\..d.!...T......O.....5.......X`..U.t.+...._.................;....n.7.a.\._...?...=.{..z.w,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1837C379.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 1063 x 477, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	95229
Entropy (8bit):	7.9836083596131795
Encrypted:	false
SSDEEP:	1536:d6jH/0yFLEX0bgyLYxKjSVWScWfIU0uKy25m0yR7qQMYoMZk+czfJPJcNf:IjsNX0Uy8x9cWfPPJAjtv+QfJPJcNf
MD5:	B306298C45DE231FCE09B4261CC6DC10
SHA1:	A9C454EEE2B707ED8CD74E9C6FCC2D295128535D
SHA-256:	3FD9AFC03BCDC8B2B492A5B877773EC99DE58564ED4329BD64E3833E86BC7FFB
SHA-512:	81AED2A8881D5623F5812659F37CFED2A746424F42166CF0446D47312872457D14C7C263BA65F88CF7BB6BCDE438ED921D178070EE84B2D9DA0A7A31EDCA2561
Malicious:	false
Preview:	.PNG........IHDR...'............\|....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...\|.E......BHH....z.E:.4A...IS......Q...."ETz...Zh..Cz!...,..j .z.\|?.Cv.6<.3...Q.%.. .. .. .. ..... .. .. .. .B... .. .. .. ..J... .. .. .. ..N.. .. .. ..P.D8!.. .. .. .B... .. .. .. ..J... .. .. .. ..N.. .. .. ..P.D8!.. .. .. .B... .. .. .. ..J... .. .. .. ..N.. .. .. ..P.D8!.. .. .. .B... .. .. .. ..J... .. .. .. ..N.. .. .. ..P.D8!.. .. .. .B... .. .. .. ..J... .. .. .. ..N.. .. .. ..P..z... ...B!.%.. .. ..`.L../FN.. .. .. ..P.D8!.. .. .. .B...u.&..c.-..d.)....f.9..E.B....4N-.%o.EA...`c.yK(r.l...P.Z..Nsh/.%.5...Q.().~.:..1d.2.1..v.U.$..`R......B...K.V(0J.et..F.b-..(jB.t$......4.VO......G..%......Z.(.u..aa.f}..}.Z.G+.R.eU.E..HTU......~r.P.<........(..J...jb.Y.!C..5.E<.!...W.r..y.Z.\#.......#...U.eH....I4O.k............E....rq.....,..g....".>#...U[..,..B2?..D..X.;...&J... .. .. .. ..N.. ...........T..A...m...4..fX..MEA...`.+. .. .yG.../..0..L<.S...Axg.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\184B8998.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 984 x 1097, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	135551
Entropy (8bit):	7.9542709799258935
Encrypted:	false
SSDEEP:	3072:7k0IpeD0Hz//z6aTFIzn33WmdpTIDC9SAyvJv9gjsOMSQYMo:7Qro2ITDOvF8Qo
MD5:	A9C85DE5996755FBC737416F7DBB4B34
SHA1:	734978527CB17C7551339586F9DDCCEB77A41C1C
SHA-256:	5D55CB0D9A9322C3DEF316155C9CB613FB7074A5976013A28A8011470055B6A2
SHA-512:	45ADDF6AEE70CE67010CADFEF8C3B3838F963411AA5E115CDCCB9759819E68C94EE6C36D05EB0E6AF0857C5D776086204D0A6C14F1F94AA5DEDB28682971BDDF
Malicious:	false
Preview:	.PNG........IHDR.......I.....2.......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...@.g.............G...Z.Z..Q.........:@A.QQ....D."...$.].."h..\|~m.r.{......n.). """""".l..........Q60.&""""""..&.DDDDDDD:.........H..`..........l""""""".`.MDDDDDD..L........t..6........0.&""""""..&.DDDDDDD:.........H..`........B............Q.Pl...J..CDD9-..C...l""""""".`.MDDDDDD..L........t..`.@F...\."".P....."".%....l""""""".`.MDDDDDD..L........t..6........0.&""""""..&.DDDDDDD:.........H..`..........l""""""".`.MDDDDDD..L........t..6........0.&""""""..&.DDDDDDD:.........H..`..........l""""""".`.MDDDDDD..L........t..6........0.&""""""..&.DDDDDDD:.........H..`..........l""""""".`.MDDDDDD..L........t..6........0.&""""""..&.DDDDDDD:.........H.....0} ..&..R)..W..J...9.7..(..y..../..G.8.t..>l..k.*..B....)<.....V.{C..s..L.L=B$A.z.0......Bq...N=..=j.....1.S.,.....EB...?...^C...i.ZE../.<.46o.F.\=..}X7.F....[.....R.....=..[..Q..!.PZ_=^w..}.."+.......>.m...?..'8s..>!...k..-+"..t.K..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\2DD568E5.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 771 x 632, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	53288
Entropy (8bit):	7.958406253467554
Encrypted:	false
SSDEEP:	1536:c7ffFzoJxLeq/jE34WSooQ2e8U8ZB787KL5QKIinw:c72JReLWU8ZBo7A5yinw
MD5:	8F34020098E737DEB165FC1F398E420D
SHA1:	E6C125C06A4F653F4FCC5BF271A1B84610EA7F75
SHA-256:	B2D118D095087556F1DC4679FEE3382B32680EF3FA38E6EEE5EEAB12E817B233
SHA-512:	0E6D6CA1D994DA7AD08FEEC26DD424C9A814768F02D0B6E456F0E6D6A6C53EBD14B90B3582BE42BA17F88A24C08E78806CE9069CFB711D08F69F0D9A14406700
Malicious:	false
Preview:	.PNG........IHDR.......x.....9.?.....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^...\.g......n..D...1k...X.;ua.M....t:7]8.....[1......'.s........\......~@...s_.]..........H.DDDDDda.......,.........b. """".P..DDDDD..a......B1......Y(.."""""..0@DDDDd........,.........b. """".P..DDDDD..a......B1......Y(.."""""..0@DDDDd........,.........b. """".P..DDDDD..a......B1......Y(.."""""..0@DDDDd........,.........b. """".P..DDDDD..a......B1......Y(.."""""..0@DDDDd........,............""""".,...K""""".$...~._.....D.Q..H.......KF.J...=\<J.B..(.(..W.4!8..4BT...:............Db.V?..>.......M...n..=.p9$.... .G.Z-.O_t..........4.".5.?...W.........^}...G.D...`..0e.n\....i..zq7..2....#A'.A..M.c. @DDDD.O.]".B.P..7IR.a........h2..X...r.:._..j....m.q.m.....y;.A#..%........Q.........^Zj.(.r."..N,...G....Z.m].m..=........._~..o'.......c..?..u.. ...v9.D.7^....?...Z.DDDDTX..\|2..4s...B....Va..Q.t...<......i.....<.K..c.....wm...(\|....Z...2....~ZQ..WV..........\$.v""""*x.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\3CC6780E.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 880 x 388, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35761
Entropy (8bit):	7.934432802318995
Encrypted:	false
SSDEEP:	768:dfXtcJTKiDl8dLyJWS37d3yh22xDCGjjB/rUlkU:d4S+WSrd3YDnjB/rUD
MD5:	33A82CBDF864FA927F7E8AA8A863224F
SHA1:	0D1D2AC52B00940C02E142B6548446FD37D97D29
SHA-256:	2126506630B82C3B7DDAD60809B87DCC092955B600D145772FB60064A62EFFDF
SHA-512:	6EFD7FFAD81DEFAF0D52321E80F6ED64E50ADA4002D60AB651DA8B761C4A3E0C7E2C024BDD7252AC615900C0FE126A036B2137104D14CF23323C2677866C5B4F
Malicious:	false
Preview:	.PNG........IHDR...p.........wv......sRGB.........gAMA......a.....pHYs..........o.d...FIDATx^...@.g........{...m...g..Uk..j.U...Y..Qk[.T........e..=.I..$.DF..Hx~.w..r..ys...r1..@DDDDDD...._""""""..X..........pDDDDDDz..........`.GDDDDD.'X..........pDDDDDDz..........`.GDDDDD.'X..........pDDDDDDz..........`.GDDDDD.'....x.1.q.j...(..w.R...9DDD.)...J<.GDDDDD.'X..........pDDDDDDz".....D......c........G..........8""""""=........HO..#"""""..,..........8""""""=........HO..#"""""..,..........8""""""=........HO..#"""""..,..........8""""""=........HO..#"""""..,..........8""""""=........HO..#"""""..,..........8""""""=........HO..#"""""..,..........8""""""=........HO..#"""""..,..........8""""""=........HO.....lc..d.X2..E.....'....'..5.S[T+.^}*...C...3.Y?T1G.....;.g.?..^......].q.X..!2F.&.0...xg.p..g.....{.a...~n.c..Po.tt+o.........=z.#..h..hP.Buc.....^x-S.x..%[..g.k....M...u..!g.a..kaL.II..........2.....=CQ..P...O5_I...N.."..~.=.....Y.h...a.}@'9....7.....9$....'.5...7...[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\408BC1F3.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 714 x 581, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	85581
Entropy (8bit):	7.962135401664537
Encrypted:	false
SSDEEP:	1536:FQhVqi8htv4avnL4U3Gh1dQK/DP9/JdmtC29gHrJ5tG6qTTuNfjljiEbpZh:J7hiavnQh1CcStR9mKYfhlpZh
MD5:	E6E9DF2B0217C9D801D5B6D3219494BA
SHA1:	D8473F04DC1C68A3FBAE5B26115BA57CC67B7195
SHA-256:	22661A9A725FE69766CBCAF309727D0E7896FCA6E8C999C666728C10D861C170
SHA-512:	969F9C32B22A3FF054B63997D7B78E06FE5E137030F17C72907FAA5C6203AA4295A5189592739B8A603B8345E32561A68D15E0DB89A2D97E5FE1FFE04595D2EC
Malicious:	false
Preview:	.PNG........IHDR.......E......p.M....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....U..{..lzOH.R(...;R.&M....E..V.D.QP@,(" ...z'...zH..RH..w.....g......fC.gs23g.>3.\|s..D.1!..B.!.GH6...B.!..yH(.!..B.....B.!..B.....B.!..- .,..B.!D.H(.!..B.....B.!..B.....B.!..- .,..B.!D.H(.!..B.....B.!..B.....B.!..- .,..B.!D.H(.!..B.....B.!..B.....B.!..- .,..B.!D.H(.!..B.......&<4a.=..k.4..D...3V.YH'3V.0K'.?!..B..* .V'.:5d..U.H...Zq....z..1z.....m...s..v.M.ZUi..d..4...L... ...TcH!..B..IA.eVa......'.. ...gj.k..`.>..\.M.6...<0....&..P...5$-.u..l..U.N.ed]2....J6.4.6~.4....7..4.c{.!.......T...w..a}..).w..V{@.....)F.f..j.}...7.......B.......\|..R. ......%..i.U=..!..B..Ir..d=.B.ea...}.A../........q....3.J.-.MY..dC.5.b.I.q.y-'..B.!>.YdU..B....4jd....9....}..v...is.....Ko..\(7X........E....oo$.d!..B.V#..f..E.e\|GA......e....\|..e..hs.\|.G.w.....(.X....r]..)>.+.v.R.B.!.h.2.U9.,...&...Mf.. i...iE5.v.Q...i.........i5E%.hp..-.H..i&m....PM.,..B..Jd............l..f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5300C82F.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 1137 x 1108, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	355947
Entropy (8bit):	7.988598897729917
Encrypted:	false
SSDEEP:	6144:faERH7Qa0/XDe41eineuV/ed9FdK8bI69+XdtzLYO0u9UfhNd35AxIZhNJQMvIx7:U37hxnekGd9Fd9ofnUu9eJAxIZGjxKy1
MD5:	C60A74D83C12D7EC61ECBFF46B40F625
SHA1:	D3A74B2987E5ABDA4DA8981C5EDBA652592834A9
SHA-256:	1437CCCE8BEADEC0D212A9787473488BC46580D6DCA95210F4A80BAE59AB3437
SHA-512:	B66EDDA3C67A2DDF27AA6DD1C56B91EB6C5B27D9C4F818A1A0A607D16D53298F7F62F0F868C485A48DF011E1800C987E81B6DDE2A49D76BA8BA165B0FBD1E0E4
Malicious:	false
Preview:	.PNG........IHDR...q...T...........sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...]E.......^IH......U.".....PQ,.....( EAQ:J...Z !$....m......&$/....g.l....7.......3o.W.L7.gU..k..9JG..L..JU.:.....X.HJ...r.VI.R&).W...:...#N..F.Z(es&..e...c.a.....\V.9........p,#.ynB9a.m...l.._......6Y.......^g..........p8.....p8...c...q.....p8.....p8:...p8.....p8.......F....p8.....p8..N.7.8.....p8.....pt.....p8.....p8.......8....p8.....p8...n.q8.....p8.......p#...p8.....p8..G'..q.....p8.....p8:...p8.....p8.......F....p8.....p8..N.7.8.....p8.....pt.d~m._!q...zj.[J....KJg..{...d.@.R....Q...[o.?.....m.....Kx..L.$.a.}.Y...=..6.xcu..5..=.X,..r.....+.}[[....?.+......r.).<y.6.p.....#~\|.k...g..9.B.---z.......MW^y...~.7O.z.....x..&..\|#..?i.v.ijoo.a.t....{...#TSS..g...O.+vH.).M.9..1....../~.[n.Ek......&.455.W[[.....>..p.u.w....}\|.xx@8h.-.ND.P.e......t...1>..M.0A.....Q.Fi.m.Y./..ipO:.w.\|>\.?.g....\...../u.M7i..7W}}......:K.]tQ.{..\|...Q..l..:.i..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\53EFF17E.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 680 x 586, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	105823
Entropy (8bit):	7.977948792282828
Encrypted:	false
SSDEEP:	1536:u4mSaZEwjp9Ghi3TM30bQ+psdLv9TwQb7SMH08R4za1mxcP59ppBE13vSwp/dlX:MjZEc9ii34300Nx1kQb7Z0Ipy9
MD5:	08841D98C1FEDE54A9A0CE2DDA2D9A9C
SHA1:	B4621886145D33231C926951230ECDF23285FAD8
SHA-256:	14B47C03AD0BE9075E0A6C79A33C9395AA26DFAA96BB4FFE91B842E712079546
SHA-512:	188E5E2B4EFC9BB2D1A3343730BC72B1C6EF40AC5DFB3C46F241F20A45EE5EF8E8493EC9440847CE458328962E1476357F9CB2D1230A440FD4C62DF4B9ED6D97
Malicious:	false
Preview:	.PNG........IHDR.......J......4......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...]E....ozOHB..tE.,4...TTT....c.{..@AE..Az.!..$.$..l........H..,....6g.9.w.(.r..q..q.~B.{.8..8..8......8..8N.....8..8..p..8..8...+\.:..8..8......8..8N.....8..8..p..8..8...+\.:..8..8......8..8N.....8..8..p..8..8...+\.:..8..8......8..8N.....8..8..H....^..f...S...S.b...XT.DQDXe..e.............C...........C...........}.G..o..8.b}cuLvGP......g..(.vg"i..Ky.i..t..;w..?..@..W.......u......).UH.OYa%_i.}=...1P....as.c..7.u....as..?.7.u..........}..@..5...\...v]..j)..t.kI...}..G.{.;..S...../.F...vu..Jd.T....j)..X)1S......q..q.Jz.W(.....M...HXT..E.{..u...+{.G..@=.......T.BHWIY.IT.B.9We.VD.P..q..qz.0.o.....D..T".b..l...AF.M..:Zu..G.G..P>...g...._]}.:.j...J..JZ...y%..R..r.:..8..8...taH.[^.L.....S)...&T...@m.h.9.:B.:.....}&P......U....j..z..i.%...U.YK....8..8.ETtkD..0Q..V2..0....D...N..&P...../.N...F...Z.d.@.......:...S.O_O"._..j...>l.q.......?.7l.q......c..7.u.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5842EDD.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 1145 x 617, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	349014
Entropy (8bit):	7.982340809053343
Encrypted:	false
SSDEEP:	6144:HSlDpH1cO7C+AD0lu55wd3EkgqAc8lDqSv2+/jD2DSvA6sUQV7XC:wR1puBD35wMqAc8J3/vvALVW
MD5:	10E3C802FED4D3B5268D11C969C7B322
SHA1:	ECED4C72B5CCB7138DACAF1256EDF43ECB3FD00D
SHA-256:	2DFC54BB959EED557949590D2E7202B707A9BF1F6128F342726B61DCA66D2031
SHA-512:	22995A1E7C581B0F4B9F43F4F3F8163DD62868D0501CA9A8FCC3F7BBC0EE9ABE34EF1EED9E28435C377B81CEC480BB694302169FC9BBE190DE21D5E366061666
Malicious:	false
Preview:	.PNG........IHDR...y...i.....9j.y....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.}..]E...z..M..^IO..........OE.]A...A:H...Jz...f........o.%$..j./....;w.3g.9wf.'O..........................................caaaaaaaaaaaaaaaq..:y,,,,,,,,,,,,,,,,..X'.................A.................8.`.<..................................... .u.XXXXXXXXXXXXXXXX...N.....................caaaaaaaaaaaaaaaq..:y,,,,,,,,,,,,,,,,..X'.................A.................8.`.<..................................... .u.XXXXXXXXXXXXXXXX...N.....................caaaaaaaaaaaaaaaq..:y,,,,,,,,,,,,,,,,..X'.................A.................8.`.<..................................... .'O..->f.....@..G.^.r...O...).y.<nT................2..O.>.CY.r..R^...!.8..=.....88`.<. .x...3. ..!.(..Yx.9.....h...:y,,,,,,,,,,,,,>.........C..E....nA...sN.....F.8(`.<. ......[..........]..?...k9...n................y.9.....Y.^.$.A..K...__vV!........q._.._...@....y...9....#e5..:y,,,,,,,,,,,,,>....ea..qdoz..x..:.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\5C8965F0.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 1063 x 477, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	95229
Entropy (8bit):	7.9836083596131795
Encrypted:	false
SSDEEP:	1536:d6jH/0yFLEX0bgyLYxKjSVWScWfIU0uKy25m0yR7qQMYoMZk+czfJPJcNf:IjsNX0Uy8x9cWfPPJAjtv+QfJPJcNf
MD5:	B306298C45DE231FCE09B4261CC6DC10
SHA1:	A9C454EEE2B707ED8CD74E9C6FCC2D295128535D
SHA-256:	3FD9AFC03BCDC8B2B492A5B877773EC99DE58564ED4329BD64E3833E86BC7FFB
SHA-512:	81AED2A8881D5623F5812659F37CFED2A746424F42166CF0446D47312872457D14C7C263BA65F88CF7BB6BCDE438ED921D178070EE84B2D9DA0A7A31EDCA2561
Malicious:	false
Preview:	.PNG........IHDR...'............\|....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...\|.E......BHH....z.E:.4A...IS......Q...."ETz...Zh..Cz!...,..j .z.\|?.Cv.6<.3...Q.%.. .. .. .. ..... .. .. .. .B... .. .. .. ..J... .. .. .. ..N.. .. .. ..P.D8!.. .. .. .B... .. .. .. ..J... .. .. .. ..N.. .. .. ..P.D8!.. .. .. .B... .. .. .. ..J... .. .. .. ..N.. .. .. ..P.D8!.. .. .. .B... .. .. .. ..J... .. .. .. ..N.. .. .. ..P.D8!.. .. .. .B... .. .. .. ..J... .. .. .. ..N.. .. .. ..P..z... ...B!.%.. .. ..`.L../FN.. .. .. ..P.D8!.. .. .. .B...u.&..c.-..d.)....f.9..E.B....4N-.%o.EA...`c.yK(r.l...P.Z..Nsh/.%.5...Q.().~.:..1d.2.1..v.U.$..`R......B...K.V(0J.et..F.b-..(jB.t$......4.VO......G..%......Z.(.u..aa.f}..}.Z.G+.R.eU.E..HTU......~r.P.<........(..J...jb.Y.!C..5.E<.!...W.r..y.Z.\#.......#...U.eH....I4O.k............E....rq.....,..g....".>#...U[..,..B2?..D..X.;...&J... .. .. .. ..N.. ...........T..A...m...4..fX..MEA...`.+. .. .yG.../..0..L<.S...Axg.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\6607CD31.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 690 x 583, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	123289
Entropy (8bit):	7.985063447620652
Encrypted:	false
SSDEEP:	3072:+ZDw/KU+zUWTyG/rgOHT5OusPaDiSTBvvYTTxwQA:+hw/szBZ/cYxYnEvWPA
MD5:	DA593A8DA8F434F314EA3E2D90F56414
SHA1:	70D033BE831E4D4D24DA88DDFDB0F333B970DDC2
SHA-256:	60B5AC2D393D7156B83E42B0DA8E336F44AB8227788E58BDDFA8B7151A63EADC
SHA-512:	5484E6988D201EFEE3AF845C94CAED26A281AFE6799EFE316E65678A13737D3EB5C0DCED6E47ED122546C044E6898D7CA7FC646824DF861CC481E9A32B470058
Malicious:	false
Preview:	.PNG........IHDR.......G.....l&.....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....E...SoM..H.J...E............b.?{C..HQ..bAz.....r....7{...@.$.'.....;}fgw..3;...r..q..q.&#].:..8..8NS.B.q..q..iJ\.:..8..8M..Y.q..q..)q!.8..8..4%.d..q..q.....8..8....u..q..q......8..8NS.B.q..q..iJ\.:..8..8M..Y.q..q..)q!.8..8..4%.d..q..q.....8..8....u..q..q......8..8NS.B.q..q..iJR5...Us.].u..y..dTKg.VA..4...m{umU.T%U.n(.......:.....\o.^O...PO~.7....ck.'?.....?.2MV....2.eU.)..T.J.8U..}..6#dO....._.P.2JgZ.+.B...e..5URi;akN.S..o...p.'?......5......i.........1..sK..S....VM.V2Z..@.W_\|.Kt....H.f...L.........6.&..._2![.X%..Sk...8..8.F...V.~S5e.5.....S.d......W^...mF.......J.\..l.TB.VU3!k._.R.\|..u..q......_%..[..M.&...V-...>..C...T........{.~t...T.f..e...,.\.:..8..lz...L.U.$e.V..#e2JW..>+.j........O....mF.~.....\...6U....I..e.l9.b.....8..8...].rU...E...`...."X-.........>}.!{.K..u.........P...).&.3......*+S-..c.J.l....4.....il....z..z.0..z.s.ax=m.[C=...06&~f.0.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\78C5F13B.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 1331 x 666, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	123738
Entropy (8bit):	7.9797054200527135
Encrypted:	false
SSDEEP:	3072:9/8A6kWS8ScIT5pdwYW6sTXAg90MEJTtE4H81gdQ:9kA6bS8FSpdwY2TXAgSMp4GgO
MD5:	D242D823B6110CEB0AEC1D8FC742C065
SHA1:	DE7665AF07BE240941A3E3BD1158FCE9C285458D
SHA-256:	3BA08D31A5BF47901963CA028BCA02F4D794EB8799EC06F9BD772850B10DA1DD
SHA-512:	1B26756C0051249B8448698B063D29B51BA6A5EAF8DEA54C5CA2A8578C7AE0782737B219C4B5F8332BAC84A49A45F55C7A840A678BFE6EB3861DF0C8FFFB51E1
Malicious:	false
Preview:	.PNG........IHDR...3..........z.g....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...\|......%...-UZ.......llL.m.]`.3......2c.6...-....Q.{....^.ki..R(....g..$..'...+.(...........MN%.............d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q..d&...........Lf.........Q. ....DDDTG.A..EDt..7A.....n....d.L"".:..<........n...;.d&............fNDDT..WB.;..CXgy.Q...a..\|.V.A...../.z..~.....o.../..]&.>.....n....a..'.!.;......d.L"".:..;. .....Q....G..S.-...;......b....cDO..&.".{nnn(.8+.".[^....U.1.IDDDDDDDDD....DDDDDDDDDT/0.IDDDDDDDDD....DDDDDDDDDT/0.IDDDDDDDDD....DDDDDDDDDT/0.IDDDDDDDDD....DDDDDD7......{.....K.k..6.]DDDd.d&......6,.u......7...X\|....#.6....i.;..\|O..\..;.......h.-^...ZX........h....."..FDDDDD....6...X..=...<...*.R.a.\|.......B...AU.5..k\7\|0Q..A..J.C:V+.qJ...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\7EC2098C.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 771 x 632, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	53288
Entropy (8bit):	7.958406253467554
Encrypted:	false
SSDEEP:	1536:c7ffFzoJxLeq/jE34WSooQ2e8U8ZB787KL5QKIinw:c72JReLWU8ZBo7A5yinw
MD5:	8F34020098E737DEB165FC1F398E420D
SHA1:	E6C125C06A4F653F4FCC5BF271A1B84610EA7F75
SHA-256:	B2D118D095087556F1DC4679FEE3382B32680EF3FA38E6EEE5EEAB12E817B233
SHA-512:	0E6D6CA1D994DA7AD08FEEC26DD424C9A814768F02D0B6E456F0E6D6A6C53EBD14B90B3582BE42BA17F88A24C08E78806CE9069CFB711D08F69F0D9A14406700
Malicious:	false
Preview:	.PNG........IHDR.......x.....9.?.....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^...\.g......n..D...1k...X.;ua.M....t:7]8.....[1......'.s........\......~@...s_.]..........H.DDDDDda.......,.........b. """".P..DDDDD..a......B1......Y(.."""""..0@DDDDd........,.........b. """".P..DDDDD..a......B1......Y(.."""""..0@DDDDd........,.........b. """".P..DDDDD..a......B1......Y(.."""""..0@DDDDd........,.........b. """".P..DDDDD..a......B1......Y(.."""""..0@DDDDd........,............""""".,...K""""".$...~._.....D.Q..H.......KF.J...=\<J.B..(.(..W.4!8..4BT...:............Db.V?..>.......M...n..=.p9$.... .G.Z-.O_t..........4.".5.?...W.........^}...G.D...`..0e.n\....i..zq7..2....#A'.A..M.c. @DDDD.O.]".B.P..7IR.a........h2..X...r.:._..j....m.q.m.....y;.A#..%........Q.........^Zj.(.r."..N,...G....Z.m].m..=........._~..o'.......c..?..u.. ...v9.D.7^....?...Z.DDDDTX..\|2..4s...B....Va..Q.t...<......i.....<.K..c.....wm...(\|....Z...2....~ZQ..WV..........\$.v""""*x.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\85F76F3A.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 956 x 602, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	262877
Entropy (8bit):	7.977092554682118
Encrypted:	false
SSDEEP:	6144:MddkYTmP+9xgBGkWS5eIs+UkEz9l4BfFboAn+LDT:UdkYTEUxgEkWMXWibU/
MD5:	05259B6AEA51222591E58B15E24E0EBC
SHA1:	1903C6C63898EB5443ECCC4AAE523D990002DEDE
SHA-256:	733DDEEF0DF0329837BC39D46CB31E921E635BF418F6B1449EBA5F3BA3CF8966
SHA-512:	21A19545043CD6886687B16B84B55D629960648D8622AC6367B8AB522EB5BBEB196072B3CEB2B72A80FCC51A8BB93AA5AA37D984943F736B38DE4027693A7AF3
Malicious:	false
Preview:	.PNG........IHDR.......Z......)K.....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.]..]..=..%...FB.`....-..(.._..PA..(...CB ..I...l<.Y}..?...@...-...}W.\|....{.I...............?2.S...............?................G...zxxxxxxxxxxxx.(..^..............%\|................x=<<<<<<<<<<<<~..................>...............Q................?J................G...zxxxxxxxxxxxx.(.H.......g`....F.I..p.'C.+T#...Y{xxxxxxxxxxxxx.....L...2..$l?.."..C...=.....x...+...O.Of0.8......P]U..@................o...b.".P.:.c..f..F0...G.;O?.R.....7p.{.Q..D2.u!..J2.. ..}!..&E}....M....O.}........i...o.t.7x:..<..../...N..O.}..O'..8.P5..`.1(. .../.....q....U....^..a... ..o ..].....j."~...j\|.m.<.....t.\|_..<....N..O.}.....i...b...o.t.7..t..H.!...H..............OpI.o..^....O.a.0.....#....,P..}..yxxxxxxxxxxxxx\|..3...T..4...:..d9..z....-.....{.w.3.Ef#.%..3.X..w..................7.fx.../.\..d.!...T......O.....5.......X`..U.t.+...._.................;....n.7.a.\._...?...=.{..z.w,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\89882326.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 690 x 583, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	123289
Entropy (8bit):	7.985063447620652
Encrypted:	false
SSDEEP:	3072:+ZDw/KU+zUWTyG/rgOHT5OusPaDiSTBvvYTTxwQA:+hw/szBZ/cYxYnEvWPA
MD5:	DA593A8DA8F434F314EA3E2D90F56414
SHA1:	70D033BE831E4D4D24DA88DDFDB0F333B970DDC2
SHA-256:	60B5AC2D393D7156B83E42B0DA8E336F44AB8227788E58BDDFA8B7151A63EADC
SHA-512:	5484E6988D201EFEE3AF845C94CAED26A281AFE6799EFE316E65678A13737D3EB5C0DCED6E47ED122546C044E6898D7CA7FC646824DF861CC481E9A32B470058
Malicious:	false
Preview:	.PNG........IHDR.......G.....l&.....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....E...SoM..H.J...E............b.?{C..HQ..bAz.....r....7{...@.$.'.....;}fgw..3;...r..q..q.&#].:..8..8NS.B.q..q..iJ\.:..8..8M..Y.q..q..)q!.8..8..4%.d..q..q.....8..8....u..q..q......8..8NS.B.q..q..iJ\.:..8..8M..Y.q..q..)q!.8..8..4%.d..q..q.....8..8....u..q..q......8..8NS.B.q..q..iJR5...Us.].u..y..dTKg.VA..4...m{umU.T%U.n(.......:.....\o.^O...PO~.7....ck.'?.....?.2MV....2.eU.)..T.J.8U..}..6#dO....._.P.2JgZ.+.B...e..5URi;akN.S..o...p.'?......5......i.........1..sK..S....VM.V2Z..@.W_\|.Kt....H.f...L.........6.&..._2![.X%..Sk...8..8.F...V.~S5e.5.....S.d......W^...mF.......J.\..l.TB.VU3!k._.R.\|..u..q......_%..[..M.&...V-...>..C...T........{.~t...T.f..e...,.\.:..8..lz...L.U.$e.V..#e2JW..>+.j........O....mF.~.....\...6U....I..e.l9.b.....8..8...].rU...E...`...."X-.........>}.!{.K..u.........P...).&.3......*+S-..c.J.l....4.....il....z..z.0..z.s.ax=m.[C=...06&~f.0.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8EEDC200.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 903 x 779, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	61151
Entropy (8bit):	7.889714706328939
Encrypted:	false
SSDEEP:	768:kejv+NombEe7g9HYXg3G/VZhuJIj5YSsROBkA7H8CKkV5S6CMHO3wpJoVO/6:kejrTeiHYXusPf1YSsAvy3uzJo8/6
MD5:	0B4879BB386D0F3043ED2ED85ED66D74
SHA1:	F6CA5DC42FC47510CB0A5E937B4AA7E32918299C
SHA-256:	75469DCB3C8916D768C910A895EFDF3564694DE91AE4F5DA516DDA58A1DE43F6
SHA-512:	1724F7D70B8473B5C1D564CE6084EF6FFDB8C303D73BFBD22D9224EDBE5722E2AAD380720593CD26738B378C62A0B3EF9F67E5537DF7013E93336A10EAEFA670
Malicious:	false
Preview:	.PNG........IHDR................5....sRGB.........gAMA......a.....pHYs..........o.d...tIDATx^...\.w...'a....EQ.u.PQq..{[.....k...uo.........." .(...{...0D.E.\|....]....H.nD!.@DDDDDD.iJ._""""""..c8$"""""".C""""""b8$""""""..!......1.........!..............................H.pHDDDDDD..DDDDDD.pHDDDDDD".C""""""b8$"""""".C"""""".1.........!......1.................D..ON.k.........EX7C~.=..!......1.........!..............................H.pHDDDDDD..DDDDDD....?..0$.....QR..9...>......e{..DDDDDD.pHDDDDDD..DDDDDD$b8$"""""".C""""""b8$""""""..!......1.........!..............................H.pHDDDDDD..DDDDDD.pHDDDDDD".C""""""b8$"""""".C"""""".1.........!......1..............................D..DDDDDD.pHDDDDDD..DDDDDD$b8$"""""".C""""""b8$""""""..!......1.........!..............................H.pHDDDDDD..DDDDDD.pHDDDDDD".C""""""b8$"""""".C"""""".1.........!......1..............................D..DDDDDD.pHDDDDDD..DDDDDD$b8$"""""".C""""""b8$""""""..!......1.........!................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\99FE91A2.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 826 x 717, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	193718
Entropy (8bit):	7.9861797938995185
Encrypted:	false
SSDEEP:	3072:SmGaDVjWd4Bya4POSFE1GM3lrelYc510pkW+zSHJMzlfMCZAeIPEplMgSbhga:SmHBya4POwEYM8qc5CpkW+zSHCzmtRPt
MD5:	3363C3CF7FD6D3DBA22900765B697508
SHA1:	19AA9FE82F161D7C85AEDF9CC80BB69A8FD4D414
SHA-256:	66DE856CFF30041F3CFBF3E8D1944DDC8F49CD16B1E33DBE74D8B9331B19B90F
SHA-512:	0871874B9529C429589340874CD54EA3936FC9E1112D0FA2D53FC9D4B3AE14CA16937D46551C46417693535DE51DE1016A64DC507D5CB0CDBEC8954ED00FAF16
Malicious:	false
Preview:	.PNG........IHDR...:..........Q......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....E...-.[z.=.J.. bCA.....;.b...A.D..Ez'..{(..^..[.....xr^.....\|a.<..3.mfw..by.8.....p8..G/B...p8.....p8.....8.....p8..^.wt.....p8..G..;:....p8...........p8...........p8......upG..p8.....p.:...p8.....p8z...q8.....p8.....8.....p8..^.wt.....p8..G..;:....p8...........p8...........p8......upG..p8.....p.:...m.....3..".....R...3Y.i\:...^.O..Kh.<).....p8....rj.g..7...:.....XL...T.E.7e..?vTH.....?.~....H..R..1e !%...<'.dF2..$....V..:6.w...w..t..n..... ..y7..{...).. ..y7..{...).wClJ.{-/.......L...../..Z.1I%.......QIK......#.oK.{....3o.G.\|.....-..L'quA........\[...8...F.....p8....b.....X....:8...8:...57...;Q.w.!.............^+.....J.u."EeZ...$....Z&/...w.zQ...H..C.U..1/....h.......y7....h.......y7..{...).. ...].1.3.bYM.).m/...R.n...\|.......z........\z..&U....J+%.....y..I.%...*u8.....p8z1.....lc3.c..(~seGGo..4...N=^.s..U.l[.-E.VB2..DN..D..Z.R".I..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A4FF1C12.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 714 x 581, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	85581
Entropy (8bit):	7.962135401664537
Encrypted:	false
SSDEEP:	1536:FQhVqi8htv4avnL4U3Gh1dQK/DP9/JdmtC29gHrJ5tG6qTTuNfjljiEbpZh:J7hiavnQh1CcStR9mKYfhlpZh
MD5:	E6E9DF2B0217C9D801D5B6D3219494BA
SHA1:	D8473F04DC1C68A3FBAE5B26115BA57CC67B7195
SHA-256:	22661A9A725FE69766CBCAF309727D0E7896FCA6E8C999C666728C10D861C170
SHA-512:	969F9C32B22A3FF054B63997D7B78E06FE5E137030F17C72907FAA5C6203AA4295A5189592739B8A603B8345E32561A68D15E0DB89A2D97E5FE1FFE04595D2EC
Malicious:	false
Preview:	.PNG........IHDR.......E......p.M....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....U..{..lzOH.R(...;R.&M....E..V.D.QP@,(" ...z'...zH..RH..w.....g......fC.gs23g.>3.\|s..D.1!..B.!.GH6...B.!..yH(.!..B.....B.!..B.....B.!..- .,..B.!D.H(.!..B.....B.!..B.....B.!..- .,..B.!D.H(.!..B.....B.!..B.....B.!..- .,..B.!D.H(.!..B.....B.!..B.....B.!..- .,..B.!D.H(.!..B.......&<4a.=..k.4..D...3V.YH'3V.0K'.?!..B..* .V'.:5d..U.H...Zq....z..1z.....m...s..v.M.ZUi..d..4...L... ...TcH!..B..IA.eVa......'.. ...gj.k..`.>..\.M.6...<0....&..P...5$-.u..l..U.N.ed]2....J6.4.6~.4....7..4.c{.!.......T...w..a}..).w..V{@.....)F.f..j.}...7.......B.......\|..R. ......%..i.U=..!..B..Ir..d=.B.ea...}.A../........q....3.J.-.MY..dC.5.b.I.q.y-'..B.!>.YdU..B....4jd....9....}..v...is.....Ko..\(7X........E....oo$.d!..B.V#..f..E.e\|GA......e....\|..e..hs.\|.G.w.....(.X....r]..)>.+.v.R.B.!.h.2.U9.,...&...Mf.. i...iE5.v.Q...i.........i5E%.hp..-.H..i&m....PM.,..B..Jd............l..f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A8A0ECEF.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 680 x 586, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	105823
Entropy (8bit):	7.977948792282828
Encrypted:	false
SSDEEP:	1536:u4mSaZEwjp9Ghi3TM30bQ+psdLv9TwQb7SMH08R4za1mxcP59ppBE13vSwp/dlX:MjZEc9ii34300Nx1kQb7Z0Ipy9
MD5:	08841D98C1FEDE54A9A0CE2DDA2D9A9C
SHA1:	B4621886145D33231C926951230ECDF23285FAD8
SHA-256:	14B47C03AD0BE9075E0A6C79A33C9395AA26DFAA96BB4FFE91B842E712079546
SHA-512:	188E5E2B4EFC9BB2D1A3343730BC72B1C6EF40AC5DFB3C46F241F20A45EE5EF8E8493EC9440847CE458328962E1476357F9CB2D1230A440FD4C62DF4B9ED6D97
Malicious:	false
Preview:	.PNG........IHDR.......J......4......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...]E....ozOHB..tE.,4...TTT....c.{..@AE..Az.!..$.$..l........H..,....6g.9.w.(.r..q..q.~B.{.8..8..8......8..8N.....8..8..p..8..8...+\.:..8..8......8..8N.....8..8..p..8..8...+\.:..8..8......8..8N.....8..8..p..8..8...+\.:..8..8......8..8N.....8..8..H....^..f...S...S.b...XT.DQDXe..e.............C...........C...........}.G..o..8.b}cuLvGP......g..(.vg"i..Ky.i..t..;w..?..@..W.......u......).UH.OYa%_i.}=...1P....as.c..7.u....as..?.7.u..........}..@..5...\...v]..j)..t.kI...}..G.{.;..S...../.F...vu..Jd.T....j)..X)1S......q..q.Jz.W(.....M...HXT..E.{..u...+{.G..@=.......T.BHWIY.IT.B.9We.VD.P..q..qz.0.o.....D..T".b..l...AF.M..:Zu..G.G..P>...g...._]}.:.j...J..JZ...y%..R..r.:..8..8...taH.[^.L.....S)...&T...@m.h.9.:B.:.....}&P......U....j..z..i.%...U.YK....8..8.ETtkD..0Q..V2..0....D...N..&P...../.N...F...Z.d.@.......:...S.O_O"._..j...>l.q.......?.7l.q......c..7.u.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\AE54441D.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 826 x 717, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	193718
Entropy (8bit):	7.9861797938995185
Encrypted:	false
SSDEEP:	3072:SmGaDVjWd4Bya4POSFE1GM3lrelYc510pkW+zSHJMzlfMCZAeIPEplMgSbhga:SmHBya4POwEYM8qc5CpkW+zSHCzmtRPt
MD5:	3363C3CF7FD6D3DBA22900765B697508
SHA1:	19AA9FE82F161D7C85AEDF9CC80BB69A8FD4D414
SHA-256:	66DE856CFF30041F3CFBF3E8D1944DDC8F49CD16B1E33DBE74D8B9331B19B90F
SHA-512:	0871874B9529C429589340874CD54EA3936FC9E1112D0FA2D53FC9D4B3AE14CA16937D46551C46417693535DE51DE1016A64DC507D5CB0CDBEC8954ED00FAF16
Malicious:	false
Preview:	.PNG........IHDR...:..........Q......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....E...-.[z.=.J.. bCA.....;.b...A.D..Ez'..{(..^..[.....xr^.....\|a.<..3.mfw..by.8.....p8..G/B...p8.....p8.....8.....p8..^.wt.....p8..G..;:....p8...........p8...........p8......upG..p8.....p.:...p8.....p8z...q8.....p8.....8.....p8..^.wt.....p8..G..;:....p8...........p8...........p8......upG..p8.....p.:...m.....3..".....R...3Y.i\:...^.O..Kh.<).....p8....rj.g..7...:.....XL...T.E.7e..?vTH.....?.~....H..R..1e !%...<'.dF2..$....V..:6.w...w..t..n..... ..y7..{...).. ..y7..{...).wClJ.{-/.......L...../..Z.1I%.......QIK......#.oK.{....3o.G.\|.....-..L'quA........\[...8...F.....p8....b.....X....:8...8:...57...;Q.w.!.............^+.....J.u."EeZ...$....Z&/...w.zQ...H..C.U..1/....h.......y7....h.......y7..{...).. ...].1.3.bYM.).m/...R.n...\|.......z........\z..&U....J+%.....y..I.%...*u8.....p8z1.....lc3.c..(~seGGo..4...N=^.s..U.l[.-E.VB2..DN..D..Z.R".I..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C3E598EB.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 1071 x 546, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	131867
Entropy (8bit):	7.979114492135894
Encrypted:	false
SSDEEP:	3072:MggggkEgggGH6ih7RwQ9qnVqcdUnvhJUPzN7ELrXBq:DQ6bQuB6pJINYfXQ
MD5:	2D21E35FE0A3EB81AFBD193D549A1F61
SHA1:	9479D6C220A3C8C51825D34F1D84BC729DF7BD5D
SHA-256:	78B79D31D063E7C0282E6D78453694F031A4D0B0CC1C21572D5CD1FDD2CCE1E1
SHA-512:	F8FAED1789291A5C44AA184792331918C2D60DEF1A940F7EEA7CD840476B560A59A4E76504EC16E9CD554F2CA5E9EAD855BC1D0801CD0FB53477F090392EE2E1
Malicious:	false
Preview:	.PNG........IHDR.../...".............sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...]U...-S2)$..........tTPA..(.....}.(.g....,t..{/..@B...Bzf....5..t&.;..K.....g......\-aB.!..B.!...J.k+..B.!..B...x!..B.!..B..F..!..B.!..B442^.!..B.!......B.!..B.!......B.!..B.!.hhd..B.!..B.!DC#..B.!..B.!.../..B.!..B....x!..B.!..B..F..!..B.!..B442^.!..B.!......B.!..B.!......B.!..B.!.hhd..B.!..B.!DC#..B.!..B.!.../..B.!..B....x!..B.!..B..F..!..B.!..B442^.!..B.!......B.!..B.!......B.!..B.!.hhd..B.!..B.!DC#..B.!..B.!.../..B.!..B....x!..B.!..B..F..!..B.!..B442^.!..B.!......B.!..B.!......B.!..B.!.hhd..B.!..B.!DC#..B.!..B.!.../..B.!..B....x!..B.!..B..F..!..B.!..B442^.!..B.!......B.!..B.!......B.!..B.!.hhd..B.!..B.!DC..%..........s@..V...Br.\|.J....9!..B.!I.7.M9..Y.~......(....g..i.....U.l.&9.......B.!...j..I0'.....si.m.t../..9k.Vl.5W.m..A.>....<<.N..OmZ...J.Zj..[...rRz..X..\|I..B.!..\...I.A.)'y]IJ...]J..+I.Y..h.t.T.\|!y.x.bT.%.H.\.!..Kr.Z.H..x59..].k.U.../..9kj.g'.v.}.C.b.[..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\C4808CB9.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 880 x 388, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35761
Entropy (8bit):	7.934432802318995
Encrypted:	false
SSDEEP:	768:dfXtcJTKiDl8dLyJWS37d3yh22xDCGjjB/rUlkU:d4S+WSrd3YDnjB/rUD
MD5:	33A82CBDF864FA927F7E8AA8A863224F
SHA1:	0D1D2AC52B00940C02E142B6548446FD37D97D29
SHA-256:	2126506630B82C3B7DDAD60809B87DCC092955B600D145772FB60064A62EFFDF
SHA-512:	6EFD7FFAD81DEFAF0D52321E80F6ED64E50ADA4002D60AB651DA8B761C4A3E0C7E2C024BDD7252AC615900C0FE126A036B2137104D14CF23323C2677866C5B4F
Malicious:	false
Preview:	.PNG........IHDR...p.........wv......sRGB.........gAMA......a.....pHYs..........o.d...FIDATx^...@.g........{...m...g..Uk..j.U...Y..Qk[.T........e..=.I..$.DF..Hx~.w..r..ys...r1..@DDDDDD...._""""""..X..........pDDDDDDz..........`.GDDDDD.'X..........pDDDDDDz..........`.GDDDDD.'X..........pDDDDDDz..........`.GDDDDD.'....x.1.q.j...(..w.R...9DDD.)...J<.GDDDDD.'X..........pDDDDDDz".....D......c........G..........8""""""=........HO..#"""""..,..........8""""""=........HO..#"""""..,..........8""""""=........HO..#"""""..,..........8""""""=........HO..#"""""..,..........8""""""=........HO..#"""""..,..........8""""""=........HO..#"""""..,..........8""""""=........HO..#"""""..,..........8""""""=........HO.....lc..d.X2..E.....'....'..5.S[T+.^}*...C...3.Y?T1G.....;.g.?..^......].q.X..!2F.&.0...xg.p..g.....{.a...~n.c..Po.tt+o.........=z.#..h..hP.Buc.....^x-S.x..%[..g.k....M...u..!g.a..kaL.II..........2.....=CQ..P...O5_I...N.."..~.=.....Y.h...a.}@'9....7.....9$....'.5...7...[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\DF8CC933.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 903 x 779, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	61151
Entropy (8bit):	7.889714706328939
Encrypted:	false
SSDEEP:	768:kejv+NombEe7g9HYXg3G/VZhuJIj5YSsROBkA7H8CKkV5S6CMHO3wpJoVO/6:kejrTeiHYXusPf1YSsAvy3uzJo8/6
MD5:	0B4879BB386D0F3043ED2ED85ED66D74
SHA1:	F6CA5DC42FC47510CB0A5E937B4AA7E32918299C
SHA-256:	75469DCB3C8916D768C910A895EFDF3564694DE91AE4F5DA516DDA58A1DE43F6
SHA-512:	1724F7D70B8473B5C1D564CE6084EF6FFDB8C303D73BFBD22D9224EDBE5722E2AAD380720593CD26738B378C62A0B3EF9F67E5537DF7013E93336A10EAEFA670
Malicious:	false
Preview:	.PNG........IHDR................5....sRGB.........gAMA......a.....pHYs..........o.d...tIDATx^...\.w...'a....EQ.u.PQq..{[.....k...uo.........." .(...{...0D.E.\|....]....H.nD!.@DDDDDD.iJ._""""""..c8$"""""".C""""""b8$""""""..!......1.........!..............................H.pHDDDDDD..DDDDDD.pHDDDDDD".C""""""b8$"""""".C"""""".1.........!......1.................D..ON.k.........EX7C~.=..!......1.........!..............................H.pHDDDDDD..DDDDDD....?..0$.....QR..9...>......e{..DDDDDD.pHDDDDDD..DDDDDD$b8$"""""".C""""""b8$""""""..!......1.........!..............................H.pHDDDDDD..DDDDDD.pHDDDDDD".C""""""b8$"""""".C"""""".1.........!......1..............................D..DDDDDD.pHDDDDDD..DDDDDD$b8$"""""".C""""""b8$""""""..!......1.........!..............................H.pHDDDDDD..DDDDDD.pHDDDDDD".C""""""b8$"""""".C"""""".1.........!......1..............................D..DDDDDD.pHDDDDDD..DDDDDD$b8$"""""".C""""""b8$""""""..!......1.........!................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E347ACB7.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 802 x 734, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	169784
Entropy (8bit):	7.985015804607024
Encrypted:	false
SSDEEP:	3072:E6ggoOtBYa4TsCfVGE5w5TWWGf76v8qmqiNZB/EvFwcPeUbDzC/Rkkucb+iD+s1:egoOTYfwCtGE5wRW1f7yh8ZB/EvuqbDQ
MD5:	1750BC8EE1FDAD643FCC21044F41D154
SHA1:	6C67FD77AE8B3D8579B8343D0FEE15DEE9646556
SHA-256:	1E8B6E99E172A31C5F22E21021C1666F1133CE0B18FFDE21263829FD0D08AA05
SHA-512:	C0C01C0DEEFEA3BFB504FC9191EBBEA4E8C7A9AAFD5DEE08196292DA6FFF73083C9B91EE0E33094821F73B9A1340C27D2FEC12DDEC961B7E9574703CF886D1DB
Malicious:	false
Preview:	.PNG........IHDR...".........Vj......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...^...O...=Ab@pw...P...v...V...m...v....E.-....!8!H.!.W?...9..\|...~C...=6g.93.;3.\|..0.q..q..q.!$].:..8..8....n.8..8..8.3.!.8..8..8...8..8..8C.."..8..8...9n.8..8..8.3.!.8..8..8...8..8..8C.."..8..8...9n.8..8..8.3.!.8..8..8...8..8..8C.."..8..8...9n.8..8..8.3.!.8..8..8...8..8..8C.."..8..8...9n.8..8..8.3.!.8..8..8...8..8..8C.."..8..8...9n.8..8..8.3.!.8..8..8......k..O..'...:S5+.R..[.\.....Y%e.Z.Z.k...q..q....T.S..6.Oh..b[.V..6~K.'-..s.L.}'....&..!..n........\..\|...UK[.J....U..Lr.Hx......7..x..v/4^.{7.\.{7.\........y)...y)...y)..h.B...to....]..G..n.....P.....i..e{..?.^..7...mM^sC...]a....Y......t.-..Ip5+e.2FjVE.v..q..q.g )....h.H..............R./..T..........!.......\|.U..#FZ.P.L...V.V...R...v..q..q...2U)....`..-.[~.k.J%k+...\|.4..qG..m=^{C......<...Z....M.......%.L9c.J.~..8..8..8.QIW...!...F."A......*..e..R.....g....i_z..Uy....^q......&+.2.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E71AAB58.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 1071 x 546, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	131867
Entropy (8bit):	7.979114492135894
Encrypted:	false
SSDEEP:	3072:MggggkEgggGH6ih7RwQ9qnVqcdUnvhJUPzN7ELrXBq:DQ6bQuB6pJINYfXQ
MD5:	2D21E35FE0A3EB81AFBD193D549A1F61
SHA1:	9479D6C220A3C8C51825D34F1D84BC729DF7BD5D
SHA-256:	78B79D31D063E7C0282E6D78453694F031A4D0B0CC1C21572D5CD1FDD2CCE1E1
SHA-512:	F8FAED1789291A5C44AA184792331918C2D60DEF1A940F7EEA7CD840476B560A59A4E76504EC16E9CD554F2CA5E9EAD855BC1D0801CD0FB53477F090392EE2E1
Malicious:	false
Preview:	.PNG........IHDR.../...".............sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...]U...-S2)$..........tTPA..(.....}.(.g....,t..{/..@B...Bzf....5..t&.;..K.....g......\-aB.!..B.!...J.k+..B.!..B...x!..B.!..B..F..!..B.!..B442^.!..B.!......B.!..B.!......B.!..B.!.hhd..B.!..B.!DC#..B.!..B.!.../..B.!..B....x!..B.!..B..F..!..B.!..B442^.!..B.!......B.!..B.!......B.!..B.!.hhd..B.!..B.!DC#..B.!..B.!.../..B.!..B....x!..B.!..B..F..!..B.!..B442^.!..B.!......B.!..B.!......B.!..B.!.hhd..B.!..B.!DC#..B.!..B.!.../..B.!..B....x!..B.!..B..F..!..B.!..B442^.!..B.!......B.!..B.!......B.!..B.!.hhd..B.!..B.!DC#..B.!..B.!.../..B.!..B....x!..B.!..B..F..!..B.!..B442^.!..B.!......B.!..B.!......B.!..B.!.hhd..B.!..B.!DC..%..........s@..V...Br.\|.J....9!..B.!I.7.M9..Y.~......(....g..i.....U.l.&9.......B.!...j..I0'.....si.m.t../..9k.Vl.5W.m..A.>....<<.N..OmZ...J.Zj..[...rRz..X..\|I..B.!..\...I.A.)'y]IJ...]J..+I.Y..h.t.T.\|!y.x.bT.%.H.\.!..Kr.Z.H..x59..].k.U.../..9kj.g'.v.}.C.b.[..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EF5EDA01.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 984 x 1097, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	135551
Entropy (8bit):	7.9542709799258935
Encrypted:	false
SSDEEP:	3072:7k0IpeD0Hz//z6aTFIzn33WmdpTIDC9SAyvJv9gjsOMSQYMo:7Qro2ITDOvF8Qo
MD5:	A9C85DE5996755FBC737416F7DBB4B34
SHA1:	734978527CB17C7551339586F9DDCCEB77A41C1C
SHA-256:	5D55CB0D9A9322C3DEF316155C9CB613FB7074A5976013A28A8011470055B6A2
SHA-512:	45ADDF6AEE70CE67010CADFEF8C3B3838F963411AA5E115CDCCB9759819E68C94EE6C36D05EB0E6AF0857C5D776086204D0A6C14F1F94AA5DEDB28682971BDDF
Malicious:	false
Preview:	.PNG........IHDR.......I.....2.......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...@.g.............G...Z.Z..Q.........:@A.QQ....D."...$.].."h..\|~m.r.{......n.). """""".l..........Q60.&""""""..&.DDDDDDD:.........H..`..........l""""""".`.MDDDDDD..L........t..6........0.&""""""..&.DDDDDDD:.........H..`........B............Q.Pl...J..CDD9-..C...l""""""".`.MDDDDDD..L........t..`.@F...\."".P....."".%....l""""""".`.MDDDDDD..L........t..6........0.&""""""..&.DDDDDDD:.........H..`..........l""""""".`.MDDDDDD..L........t..6........0.&""""""..&.DDDDDDD:.........H..`..........l""""""".`.MDDDDDD..L........t..6........0.&""""""..&.DDDDDDD:.........H..`..........l""""""".`.MDDDDDD..L........t..6........0.&""""""..&.DDDDDDD:.........H.....0} ..&..R)..W..J...9.7..(..y..../..G.8.t..>l..k.*..B....)<.....V.{C..s..L.L=B$A.z.0......Bq...N=..=j.....1.S.,.....EB...?...^C...i.ZE../.<.46o.F.\=..}X7.F....[.....R.....=..[..Q..!.PZ_=^w..}.."+.......>.m...?..'8s..>!...k..-+"..t.K..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F0A9DB66.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 802 x 734, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	169784
Entropy (8bit):	7.985015804607024
Encrypted:	false
SSDEEP:	3072:E6ggoOtBYa4TsCfVGE5w5TWWGf76v8qmqiNZB/EvFwcPeUbDzC/Rkkucb+iD+s1:egoOTYfwCtGE5wRW1f7yh8ZB/EvuqbDQ
MD5:	1750BC8EE1FDAD643FCC21044F41D154
SHA1:	6C67FD77AE8B3D8579B8343D0FEE15DEE9646556
SHA-256:	1E8B6E99E172A31C5F22E21021C1666F1133CE0B18FFDE21263829FD0D08AA05
SHA-512:	C0C01C0DEEFEA3BFB504FC9191EBBEA4E8C7A9AAFD5DEE08196292DA6FFF73083C9B91EE0E33094821F73B9A1340C27D2FEC12DDEC961B7E9574703CF886D1DB
Malicious:	false
Preview:	.PNG........IHDR...".........Vj......sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...^...O...=Ab@pw...P...v...V...m...v....E.-....!8!H.!.W?...9..\|...~C...=6g.93.;3.\|..0.q..q..q.!$].:..8..8....n.8..8..8.3.!.8..8..8...8..8..8C.."..8..8...9n.8..8..8.3.!.8..8..8...8..8..8C.."..8..8...9n.8..8..8.3.!.8..8..8...8..8..8C.."..8..8...9n.8..8..8.3.!.8..8..8...8..8..8C.."..8..8...9n.8..8..8.3.!.8..8..8...8..8..8C.."..8..8...9n.8..8..8.3.!.8..8..8......k..O..'...:S5+.R..[.\.....Y%e.Z.Z.k...q..q....T.S..6.Oh..b[.V..6~K.'-..s.L.}'....&..!..n........\..\|...UK[.J....U..Lr.Hx......7..x..v/4^.{7.\.{7.\........y)...y)...y)..h.B...to....]..G..n.....P.....i..e{..?.^..7...mM^sC...]a....Y......t.-..Ip5+e.2FjVE.v..q..q.g )....h.H..............R./..T..........!.......\|.U..#FZ.P.L...V.V...R...v..q..q...2U)....`..-.[~.k.J%k+...\|.4..qG..m=^{C......<...Z....M.......%.L9c.J.~..8..8..8.QIW...!...F."A......*..e..R.....g....i_z..Uy....^q......&+.2.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\F753AF4C.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 1137 x 1108, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	355947
Entropy (8bit):	7.988598897729917
Encrypted:	false
SSDEEP:	6144:faERH7Qa0/XDe41eineuV/ed9FdK8bI69+XdtzLYO0u9UfhNd35AxIZhNJQMvIx7:U37hxnekGd9Fd9ofnUu9eJAxIZGjxKy1
MD5:	C60A74D83C12D7EC61ECBFF46B40F625
SHA1:	D3A74B2987E5ABDA4DA8981C5EDBA652592834A9
SHA-256:	1437CCCE8BEADEC0D212A9787473488BC46580D6DCA95210F4A80BAE59AB3437
SHA-512:	B66EDDA3C67A2DDF27AA6DD1C56B91EB6C5B27D9C4F818A1A0A607D16D53298F7F62F0F868C485A48DF011E1800C987E81B6DDE2A49D76BA8BA165B0FBD1E0E4
Malicious:	false
Preview:	.PNG........IHDR...q...T...........sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...]E.......^IH......U.".....PQ,.....( EAQ:J...Z !$....m......&$/....g.l....7.......3o.W.L7.gU..k..9JG..L..JU.:.....X.HJ...r.VI.R&).W...:...#N..F.Z(es&..e...c.a.....\V.9........p,#.ynB9a.m...l.._......6Y.......^g..........p8.....p8...c...q.....p8.....p8:...p8.....p8.......F....p8.....p8..N.7.8.....p8.....pt.....p8.....p8.......8....p8.....p8...n.q8.....p8.......p#...p8.....p8..G'..q.....p8.....p8:...p8.....p8.......F....p8.....p8..N.7.8.....p8.....pt.d~m._!q...zj.[J....KJg..{...d.@.R....Q...[o.?.....m.....Kx..L.$.a.}.Y...=..6.xcu..5..=.X,..r.....+.}[[....?.+......r.).<y.6.p.....#~\|.k...g..9.B.---z.......MW^y...~.7O.z.....x..&..\|#..?i.v.ijoo.a.t....{...#TSS..g...O.+vH.).M.9..1....../~.[n.Ek......&.455.W[[.....>..p.u.w....}\|.xx@8h.-.ND.P.e......t...1>..M.0A.....Q.Fi.m.Y./..ipO:.w.\|>\.?.g....\...../u.M7i..7W}}......:K.]tQ.{..\|...Q..l..:.i..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{3D9F596D-742F-47D4-8E4B-E373EBA344FB}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3613836054883338
Encrypted:	false
SSDEEP:	3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
MD5:	679672A5004E0AF50529F33DB5469699
SHA1:	427A4EC3281C9C4FAEB47A22FFBE7CA3E928AFB0
SHA-256:	205D000AA762F3A96AC3AD4B25D791B5F7FC8EFB9056B78F299F671A02B9FD21
SHA-512:	F8615C5E5CF768A94E06961C7C8BEF99BEB43E004A882A4E384F5DD56E047CA59B963A59971F78DCF4C35D1BB92D3A9BC7055BFA3A0D597635DE1A9CE06A3476
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{4018C136-4109-43F0-AB39-4415EEBB3D33}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	1.4248425402005538
Encrypted:	false
SSDEEP:	6:rl912N0xVN+CFQXcXw9X6aA9X6aA9XCw9XRbGs/tA9XRbGs/tA9XCw9XCw9XCB9/:rl3lTpFQcXI6h6hCIUrUrCICICb77
MD5:	2026D03F1DD2A50C4DF8242BE4FC2E54
SHA1:	5A385C523A0182D342CB46A4564CDD4F96F0F09F
SHA-256:	A18ACA63459D9BD2567CDB44B4531302A4A7DF5AE84F8B03DD9C7645DE3236E9
SHA-512:	6E73EC4DCB941D978A5841331856324C9811E1834393A2C54957D3CC86E257AB2740AFB48B1951C1295C0D9BFFC48E607183AD83372F1C5451E2F7638743D162
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{03E5B094-5296-445D-A4A1-8B43CAB0F955}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.502587340714275
Encrypted:	false
SSDEEP:	6:mEMEEEbyaol9lCgKeDsuqLLtlqEvk2qEvAEvCi:XoYP/v1vhvP
MD5:	B9F01F24057146F0AFDC6590AD99A177
SHA1:	95C809938813A7B5E38AE4F5B337AEC4A2D3E5B4
SHA-256:	5DBC6BB59DB325D34A3FF8B7C2DBDA9F97A0DF73D834813DC4AA2FF17C1FB95B
SHA-512:	8FEDEF4D9CE17363790ABDBE4E65CA87711C379AE95411D9EA50D8D6E15C6BA748B70C911988AB5B0F32DE48F8D7119374F18C0D55CEEE026F25952F8EF59A28
Malicious:	false
Preview:	....1.2.....1.2.....1.....1.....1.2.....1.2.....1.2.....1.2.....(.....(.....(.....(.....(...a.l.f.o.n.s...a............................................................................................................................................................................................................................................................................................................................................................................................................................................................. ...&...(.......0...6...8...>...@...D...F...J...L...P...R...V...X...\...j.......................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{17B45BA7-CA61-4446-89F4-49831EDC62B7}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	29654
Entropy (8bit):	3.510934535159603
Encrypted:	false
SSDEEP:	384:/l+7KM0CeHX3KWdf1HHhc5E5MUpxx8xZg/HspG5k+2Knioi8Rn:/GKMxeHnKeMoMUZyO0Ck+2KDT
MD5:	C072C1DE2207E17E7DDBCCF0B8B3E5E6
SHA1:	8839D08014ED93864496A5C74BF82997A27635B2
SHA-256:	29B8A772A78BE548DA470B1F0AFB67ACF9857D48588F094937DC60C3965873FF
SHA-512:	4A44A7AF69DCE2DC552A57AB26C59DFC5178076F8CD243E2CE50757E2E8426C06EF764917FEB7C35B46633D3C5342A51C29B5AB0494EA261860485D2EED334FA
Malicious:	false
Preview:	..D.r... .J.o.n. .H.o.l.m.e.n.,...I. .a.m. .a. .p.a.r.e.n.t. .i.n. .L.W.S.D. .a.n.d. .m.y. .t.w.o. .s.o.n.s. .a.r.e. .s.t.u.d.y.i.n.g. .i.n. .L.W.S.D... .I. .a.m. .v.e.r.y. .p.r.o.u.d................................................................................................................................................................................................................................................................................................................................................."...j...b.......B...F...J...........Z#..^#..H&..J&..N&..R&...,...,...0...0...0...6...6...6...<.."<................................................................................................................................................................................................................................................................................................................................................................".gd.. .........^...gd.. .."..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{2C27AA77-AC31-4282-A0A9-072385398593}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	29654
Entropy (8bit):	3.5126274568193416
Encrypted:	false
SSDEEP:	384:/l+zKMkCeHXPK2df1HHhc5E5MUpxx8xZg/HspG5k+2Knioi8Rn:/OKMBeHfK+MoMUZyO0Ck+2KDT
MD5:	7608B522B9F45A221DEC85AF6B20208D
SHA1:	93A27BA6F2B8BBEE523D37C67B9B6AD9F5F96BD1
SHA-256:	8ABEF59DF27289E1B639A4B852F1A0964208D4D362CE923A86AEAF6957928535
SHA-512:	992677E0DC1F3AD93B6E8EE5C93DEEE4CDA89FAC15B9FFF937501BF9F24099BC9AC787BB374EBE191F610763017A379F34D1129C27785C2387E07596EFE4CF1C
Malicious:	false
Preview:	..D.r... .J.o.n. .H.o.l.m.e.n.,...I. .a.m. .a. .p.a.r.e.n.t. .i.n. .L.W.S.D. .a.n.d. .m.y. .t.w.o. .s.o.n.s. .a.r.e. .s.t.u.d.y.i.n.g. .i.n. .L.W.S.D... .I. .a.m. .v.e.r.y. .p.r.o.u.d................................................................................................................................................................................................................................................................................................................................................."...j...b.......B...F...J...........Z#..^#..H&..J&..N&..R&...,...,...0...0...0...6...6...6...<.."<................................................................................................................................................................................................................................................................................................................................................................".gd.. .........^...gd.. .."..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{2C6D1186-16F5-46F4-963E-7B4C6214D7F0}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.03351732319703582
Encrypted:	false
SSDEEP:	3:ol3lG:40
MD5:	830FBF83999E052538EAF156AB6ECB17
SHA1:	9F6C69FA4232801D3A4857C630BA7A719662135A
SHA-256:	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
SHA-512:	A83E2E9D5274F0065A26C306F355E9590D6126297EAD87AF053CC78FB64CB31694C533139F72686C77FC772148181D8AAE973E65978D04E5F20F6F6C6BA0A013
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{5492467F-ED3C-4B60-8FB5-AB968AFD976D}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.03351732319703582
Encrypted:	false
SSDEEP:	3:ol3lG:40
MD5:	830FBF83999E052538EAF156AB6ECB17
SHA1:	9F6C69FA4232801D3A4857C630BA7A719662135A
SHA-256:	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
SHA-512:	A83E2E9D5274F0065A26C306F355E9590D6126297EAD87AF053CC78FB64CB31694C533139F72686C77FC772148181D8AAE973E65978D04E5F20F6F6C6BA0A013
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{790B767A-4385-4685-B6DA-F0FBBB506C27}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.03351732319703582
Encrypted:	false
SSDEEP:	3:ol3lG:40
MD5:	830FBF83999E052538EAF156AB6ECB17
SHA1:	9F6C69FA4232801D3A4857C630BA7A719662135A
SHA-256:	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
SHA-512:	A83E2E9D5274F0065A26C306F355E9590D6126297EAD87AF053CC78FB64CB31694C533139F72686C77FC772148181D8AAE973E65978D04E5F20F6F6C6BA0A013
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{8559302C-6843-40B8-9F6C-3A1DBB4C44A8}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.03351732319703582
Encrypted:	false
SSDEEP:	3:ol3lG:40
MD5:	830FBF83999E052538EAF156AB6ECB17
SHA1:	9F6C69FA4232801D3A4857C630BA7A719662135A
SHA-256:	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
SHA-512:	A83E2E9D5274F0065A26C306F355E9590D6126297EAD87AF053CC78FB64CB31694C533139F72686C77FC772148181D8AAE973E65978D04E5F20F6F6C6BA0A013
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{99FED713-84C5-49E1-B40D-79CAFD7F9D5A}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.03351732319703582
Encrypted:	false
SSDEEP:	3:ol3lG:40
MD5:	830FBF83999E052538EAF156AB6ECB17
SHA1:	9F6C69FA4232801D3A4857C630BA7A719662135A
SHA-256:	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
SHA-512:	A83E2E9D5274F0065A26C306F355E9590D6126297EAD87AF053CC78FB64CB31694C533139F72686C77FC772148181D8AAE973E65978D04E5F20F6F6C6BA0A013
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{E4DE79A3-ED39-41EA-A2EE-5A25977C426C}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.03351732319703582
Encrypted:	false
SSDEEP:	3:ol3lG:40
MD5:	830FBF83999E052538EAF156AB6ECB17
SHA1:	9F6C69FA4232801D3A4857C630BA7A719662135A
SHA-256:	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
SHA-512:	A83E2E9D5274F0065A26C306F355E9590D6126297EAD87AF053CC78FB64CB31694C533139F72686C77FC772148181D8AAE973E65978D04E5F20F6F6C6BA0A013
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{F116A80A-C586-4013-A051-6DCCC7806020}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.03351732319703582
Encrypted:	false
SSDEEP:	3:ol3lG:40
MD5:	830FBF83999E052538EAF156AB6ECB17
SHA1:	9F6C69FA4232801D3A4857C630BA7A719662135A
SHA-256:	D5098A2CEAE815DB29CD53C76F85240C95DC4D2E3FEDDD71D628617064C29869
SHA-512:	A83E2E9D5274F0065A26C306F355E9590D6126297EAD87AF053CC78FB64CB31694C533139F72686C77FC772148181D8AAE973E65978D04E5F20F6F6C6BA0A013
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1730145716325517400_A4FA213B-A550-4ADC-BD66-DA44A9415795.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (6577), with CRLF line terminators
Category:	dropped
Size (bytes):	39998
Entropy (8bit):	5.530659491318116
Encrypted:	false
SSDEEP:	768:S3TjijeAgyFPSslhXlq3WiVR79frC4ojQ6JWcwk7FaC3uEPnPKxDuKgKU9dO8xk5:S3TjijeAgUPSuzqmiVdlrroM6Qcwk798
MD5:	9FB6053BF1534FCC81F410558AF063AB
SHA1:	F07EE026B39BE9D94A558F8D4FAF75DB19AC8D79
SHA-256:	6DB4FD1ABB23258A6778AE35B826B3627AB21BDFB6D961D47045B154B8E5A70D
SHA-512:	3031E8A8B54D051398F75318DAEDC05A56562FB94D3789175B6D1F691780834F7B3B7126EE45D66D4C45D625EA2D14CA28B241633589E5AA5DD990F25B185B35
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/28/2024 20:01:56.523.WINWORD (0x15E4).0x85C.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-10-28T20:01:56.523Z","Contract":"Office.System.Activity","Activity.CV":"OyH6pFCl3Eq9ZtpEqUFXlQ.7.1","Activity.Duration":172,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...10/28/2024 20:01:56.523.WINWORD (0x15E4).0x85C.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":24,"Time":"2024-10-28T20:01:56.523Z","Contract":"Office.System.Activity","Activity.CV":"OyH6pFCl3Eq9ZtpEqUFXlQ.7","Activity.Duration":3432,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.FailureDia

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1730145871751226000_D40368CF-653B-44F6-8841-1D77C75A80EC.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (28919), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.19721710286525154
Encrypted:	false
SSDEEP:	1536:c3iXK0m0O9OX7MiRHEWOTmG7Qvxki+ko9C4NPTjyPRc3aQKKHNKLg3oexbk7pnPY:oh0zHE7IvqnRdBkk
MD5:	9D53F8E045DE05AE4656A053C0967613
SHA1:	623163E69E91C9BC6007A64186F3D277647CFB31
SHA-256:	63F89777E171E02F71543A2FFAEA4494C6CC701E64374ED77D735446B05F33DD
SHA-512:	2255E1FBD9E8A994407CE9ECA0417DB279D4E485C1E5E8BE1DC4D591329A681E30D3AEB415D8A936C62112DC9BE6F0905EFA0FD0029DF351FBFA4F293B7BEFD1
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/28/2024 20:04:31.806.WINWORD (0x1264).0x117C.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-10-28T20:04:31.806Z","Contract":"Office.System.Activity","Activity.CV":"z2gD1Dtl9kSIQR13x1qA7A.1.13","Activity.Duration":19,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...10/28/2024 20:04:31.822.WINWORD (0x1264).0x117C.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":26,"Time":"2024-10-28T20:04:31.822Z","Contract":"Office.System.Activity","Activity.CV":"z2gD1Dtl9kSIQR13x1qA7A.1.14","Activity.Duration":14005,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVersio

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1730145871751539700_D40368CF-653B-44F6-8841-1D77C75A80EC.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TCD1C0C.tmp\Main_Event.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Local\Temp\TCD1C0C.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5434534344080606
Encrypted:	false
SSDEEP:	6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
MD5:	C9812793A4E94320C49C7CA054EE6AA4
SHA1:	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA
SHA-256:	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
SHA-512:	D28AADEDE0473C5889F3B770E8D34B20570282B154CD9301932BF90BF6205CBBB96B51027DEC6788961BAF2776439ADBF9B56542C82D89280C0BEB600DF4B633
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.a.i.n._.E.v.e.n.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7B20.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4845992218379616
Encrypted:	false
SSDEEP:	6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
MD5:	E8B30D1070779CC14FBE93C8F5CF65BE
SHA1:	9C87F7BC66CF55634AB3F070064AAF8CC977CD05
SHA-256:	2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
SHA-512:	C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7B20.tmp\HexagonRadial.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Local\Temp\TCD7B33.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.538396048757031
Encrypted:	false
SSDEEP:	6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
MD5:	149948E41627BE5DC454558E12AF2DA4
SHA1:	DB72388C037F0B638FCD007FAB46C916249720A8
SHA-256:	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
SHA-512:	070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B33.tmp\sist02.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7B34.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.5230842510951934
Encrypted:	false
SSDEEP:	6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	F25AC64EC63FA98D9E37782E2E49D6E6
SHA1:	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
SHA-256:	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
SHA-512:	A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B34.tmp\ieee2006officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Local\Temp\TCD7B44.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.5026803317779778
Encrypted:	false
SSDEEP:	6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
MD5:	A0D51783BFEE86F3AC46A810404B6796
SHA1:	93C5B21938DA69363DBF79CE594C302344AF9D9E
SHA-256:	47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
SHA-512:	CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B44.tmp\gosttitle.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7B45.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5039994158393686
Encrypted:	false
SSDEEP:	6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
MD5:	16711B951E1130126E240A6E4CC2E382
SHA1:	8095AA79AEE029FD06428244CA2A6F28408448DB
SHA-256:	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
SHA-512:	454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7B45.tmp\TabbedArc.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Local\Temp\TCD7B56.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	3.5414485333689694
Encrypted:	false
SSDEEP:	6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
MD5:	2F7A8FE4E5046175500AFFA228F99576
SHA1:	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
SHA-256:	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
SHA-512:	4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B56.tmp\Text Sidebar (Annual Report Red and Black design).docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Local\Temp\TCD7B79.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.537169234443227
Encrypted:	false
SSDEEP:	6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
MD5:	9C00979164E78E3B890E56BE2DF00666
SHA1:	1FA3C439D214C34168ADF0FBA5184477084A0E51
SHA-256:	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
SHA-512:	54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B79.tmp\iso690nmerical.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Local\Temp\TCD7B7A.tmp\BracketList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Local\Temp\TCD7B7A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.4916022431157345
Encrypted:	false
SSDEEP:	6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
MD5:	1A314B08BB9194A41E3794EF54017811
SHA1:	D1E70DB69CA737101524C75E634BB72F969464FF
SHA-256:	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
SHA-512:	AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7B7B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5280239200222887
Encrypted:	false
SSDEEP:	6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
MD5:	877A8A960B2140E3A0A2752550959DB9
SHA1:	FBEC17B332CBC42F2F16A1A08767623C7955DF48
SHA-256:	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
SHA-512:	B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B7B.tmp\gb.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7B7C.tmp\APASixthEditionOfficeOnline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Local\Temp\TCD7B7C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.541819892045459
Encrypted:	false
SSDEEP:	6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
MD5:	C3216C3FC73A4B3FFFE7ED67153AB7B5
SHA1:	F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
SHA-256:	7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
SHA-512:	D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B7D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5502940710609354
Encrypted:	false
SSDEEP:	6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
MD5:	9B8D7EFE8A69E41CDC2439C38FE59FAF
SHA1:	034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
SHA-256:	70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
SHA-512:	E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B7D.tmp\iso690.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7B7E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.523917709458511
Encrypted:	false
SSDEEP:	6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
MD5:	4A9A2E8DB82C90608C96008A5B6160EF
SHA1:	A49110814D9546B142C132EBB5B9D8A1EC23E2E6
SHA-256:	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
SHA-512:	320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B7E.tmp\chicago.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7B7F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5081874837369886
Encrypted:	false
SSDEEP:	6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
MD5:	8D9B02CC69FA40564E6C781A9CC9E626
SHA1:	352469A1ABB8DA1DC550D7E27924E552B0D39204
SHA-256:	1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
SHA-512:	8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7B7F.tmp\gostname.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Local\Temp\TCD7B80.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.4842773155694724
Encrypted:	false
SSDEEP:	6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
MD5:	923D406B2170497AD4832F0AD3403168
SHA1:	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
SHA-256:	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
SHA-512:	A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7B80.tmp\ConvergingText.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Local\Temp\TCD7B91.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4721586910685547
Encrypted:	false
SSDEEP:	6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
MD5:	4DD225E2A305B50AF39084CE568B8110
SHA1:	C85173D49FC1522121AA2B0B2E98ADF4BB95B897
SHA-256:	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
SHA-512:	0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7B91.tmp\chevronaccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Local\Temp\TCD7BA1.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.48087342759872
Encrypted:	false
SSDEEP:	6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
MD5:	69757AF3677EA8D80A2FBE44DEE7B9E4
SHA1:	26AF5881B48F0CB81F194D1D96E3658F8763467C
SHA-256:	0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
SHA-512:	BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7BA1.tmp\PictureFrame.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Local\Temp\TCD7BA2.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.4871192480632223
Encrypted:	false
SSDEEP:	6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	333BA58FCE326DEA1E4A9DE67475AA95
SHA1:	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
SHA-256:	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
SHA-512:	BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7BA2.tmp\mlaseventheditionofficeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Local\Temp\TCD7BA3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5161159456784024
Encrypted:	false
SSDEEP:	6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
MD5:	C15EB3F4306EBF75D1E7C3C9382DEECC
SHA1:	A3F9684794FFD59151A80F97770D4A79F1D030A6
SHA-256:	23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
SHA-512:	ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7BA3.tmp\turabian.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Local\Temp\TCD7BF2.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.4680595384446202
Encrypted:	false
SSDEEP:	6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
MD5:	D79B5DE6D93AC06005761D88783B3EE6
SHA1:	E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
SHA-256:	96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
SHA-512:	34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7BF2.tmp\architecture.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Local\Temp\TCD7BF3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.547857457374301
Encrypted:	false
SSDEEP:	6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	4EC6724CBBA516CF202A6BD17226D02C
SHA1:	E412C574D567F0BA68B4A31EDB46A6AB3546EA95
SHA-256:	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
SHA-512:	DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7BF3.tmp\harvardanglia2008officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Local\Temp\TCD7C05.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4901887319218092
Encrypted:	false
SSDEEP:	6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
MD5:	52BD0762F3DC77334807DDFC60D5F304
SHA1:	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
SHA-256:	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
SHA-512:	FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C05.tmp\RadialPictureList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Local\Temp\TCD7C17.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.472155835869843
Encrypted:	false
SSDEEP:	6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
MD5:	2240CF2315F2EB448CEA6E9CE21B5AC5
SHA1:	46332668E2169E86760CBD975FF6FA9DB5274F43
SHA-256:	0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
SHA-512:	10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C17.tmp\rings.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Local\Temp\TCD7C28.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.494357416502254
Encrypted:	false
SSDEEP:	6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
MD5:	6F8FE7B05855C203F6DEC5C31885DD08
SHA1:	9CC27D17B654C6205284DECA3278DA0DD0153AFF
SHA-256:	B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
SHA-512:	C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C28.tmp\ThemePictureGrid.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Local\Temp\TCD7C3B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.4895685222798054
Encrypted:	false
SSDEEP:	6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
MD5:	63E8B0621B5DEFE1EF17F02EFBFC2436
SHA1:	2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
SHA-256:	9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
SHA-512:	A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C3B.tmp\VaryingWidthList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Local\Temp\TCD7C4D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.4938093034530917
Encrypted:	false
SSDEEP:	6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
MD5:	A6B2731ECC78E7CED9ED5408AB4F2931
SHA1:	BA15D036D522978409846EA682A1D7778381266F
SHA-256:	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
SHA-512:	666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C4D.tmp\TabList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Local\Temp\TCD7C5D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.4866056878458096
Encrypted:	false
SSDEEP:	6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
MD5:	6C489D45F3B56845E68BE07EA804C698
SHA1:	C4C9012C0159770CB882870D4C92C307126CEC3F
SHA-256:	3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
SHA-512:	D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C5D.tmp\ThemePictureAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Local\Temp\TCD7C6E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	3.4692172273306268
Encrypted:	false
SSDEEP:	6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
MD5:	C1B36A0547FB75445957A619201143AC
SHA1:	CDB0A18152F57653F1A707D39F3D7FB504E244A7
SHA-256:	4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
SHA-512:	0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C6E.tmp\pictureorgchart.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Local\Temp\TCD7C7E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4670546921349774
Encrypted:	false
SSDEEP:	6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
MD5:	3D52060B74D7D448DC733FFE5B92CB52
SHA1:	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
SHA-256:	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
SHA-512:	952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7C7E.tmp\ThemePictureAlternatingAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Local\Temp\TCD7C90.tmp\CircleProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Local\Temp\TCD7C90.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4720677950594836
Encrypted:	false
SSDEEP:	6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
MD5:	D04EC08EFE18D1611BDB9A5EC0CC00B1
SHA1:	668FF6DFE64D5306220341FC2C1353199D122932
SHA-256:	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
SHA-512:	97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7CB0.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.484503080761839
Encrypted:	false
SSDEEP:	6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
MD5:	1309D172F10DD53911779C89A06BBF65
SHA1:	274351A1059868E9DEB53ADF01209E6BFBDFADFB
SHA-256:	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
SHA-512:	31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7CB0.tmp\InterconnectedBlockProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Local\Temp\TCD7CC2.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.438490642908344
Encrypted:	false
SSDEEP:	6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
MD5:	0F98498818DC28E82597356E2650773C
SHA1:	1995660972A978D17BC483FCB5EE6D15E7058046
SHA-256:	4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
SHA-512:	768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD7CC2.tmp\Element design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Local\Temp\TCD7CE3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.464918006641019
Encrypted:	false
SSDEEP:	6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
MD5:	93149E194021B37162FD86684ED22401
SHA1:	1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
SHA-256:	50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
SHA-512:	410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD7CE3.tmp\Equations.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Local\Temp\TCD8031.tmp\Banded.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD8031.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.535736910133401
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
MD5:	487E25E610F3FC2EEA27AB54324EA8F6
SHA1:	11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
SHA-256:	022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
SHA-512:	B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8063.tmp\View.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD8063.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.535303979138867
Encrypted:	false
SSDEEP:	6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
MD5:	35AFE8D8724F3E19EB08274906926A0B
SHA1:	435B528AAF746428A01F375226C5A6A04099DF75
SHA-256:	97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
SHA-512:	ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8065.tmp\Frame.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD8065.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5159096381406645
Encrypted:	false
SSDEEP:	6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
MD5:	71CCB69AF8DD9821F463270FB8CBB285
SHA1:	8FED3EB733A74B2A57D72961F0E4CF8BCA42C851
SHA-256:	8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4
SHA-512:	E62FC5BEAEC98C5FDD010FABDAA8D69237D31CA9A1C73F168B1C3ED90B6A9B95E613DEAD50EB8A5B71A7422942F13D6B5A299EB2353542811F2EF9DA7C3A15DC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .F.r.a.m.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8085.tmp\Parcel.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD8085.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.516359852766808
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
MD5:	960E28B1E0AB3522A8A8558C02694ECF
SHA1:	8387E9FD5179A8C811CCB5878BAC305E6A166F93
SHA-256:	2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
SHA-512:	89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD80F5.tmp\Dividend.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD80F5.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5459495297497368
Encrypted:	false
SSDEEP:	6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
MD5:	76340C3F8A0BFCEDAB48B08C57D9B559
SHA1:	E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
SHA-256:	78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
SHA-512:	49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8106.tmp\Basis.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD8106.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5361139545278144
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
MD5:	133D126F0DE2CC4B29ECE38194983265
SHA1:	D8D701298D7949BE6235493925026ED405290D43
SHA-256:	08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
SHA-512:	75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8137.tmp\Metropolitan.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD8137.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5091498509646044
Encrypted:	false
SSDEEP:	6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
MD5:	23D59577F4AE6C6D1527A1B8CDB9AB19
SHA1:	A345D683E54D04CC0105C4BFFCEF8C6617A0093D
SHA-256:	9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
SHA-512:	B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD859E.tmp\Parallax.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD859E.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.51145753448333
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
MD5:	7956D2B60E2A254A07D46BCA07D0EFF0
SHA1:	AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
SHA-256:	C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
SHA-512:	668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8775.tmp\Quotable.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Local\Temp\TCD8775.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5323495192404475
Encrypted:	false
SSDEEP:	6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
MD5:	BD6B5A98CA4E6C5DBA57C5AD167EDD00
SHA1:	CCFF7F635B31D12707DC0AC6D1191AB5C4760107
SHA-256:	F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
SHA-512:	A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD890D.tmp\Berlin.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD890D.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5270134268591966
Encrypted:	false
SSDEEP:	6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
MD5:	327DA4A5C757C0F1449976BE82653129
SHA1:	CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
SHA-256:	341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
SHA-512:	9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8F29.tmp\Savon.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Local\Temp\TCD8F29.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5364757859412563
Encrypted:	false
SSDEEP:	6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
MD5:	CD465E8DA15E26569897213CA9F6BC9C
SHA1:	9EA9B5E6C9B7BF72A777A21EC17FD82BC4386D4C
SHA-256:	D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610
SHA-512:	869A42679F96414FE01FE1D79AF7B33A0C9B598B393E57E0E4D94D68A4F2107EC58B63A532702DA96A1F2F20CE72E6E08125B38745CD960DF62FE539646EDD8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.a.v.o.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8FD7.tmp\Circuit.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD8FD7.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5286004619027067
Encrypted:	false
SSDEEP:	6:Q+sxnxUXOzXkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6WymD0wbnKNAH/lMz1
MD5:	40FF521ED2BA1B015F17F0B0E5D95068
SHA1:	0F29C084311084B8FDFE67855884D8EB60BDE1A6
SHA-256:	CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB
SHA-512:	9507E6145417AC730C284E58DC6B2063719400B395615C40D7885F78F57D55B251CB9C954D573CB8B6F073E4CEA82C0525AE90DEC68251C76A6F1B03FD9943C0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.u.i.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD9018.tmp\Gallery.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Local\Temp\TCD9018.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5301133500353727
Encrypted:	false
SSDEEP:	6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
MD5:	1C5D58A5ED3B40486BC22B254D17D1DD
SHA1:	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A
SHA-256:	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
SHA-512:	4736E4F26C6FAAB47718945BA54BD841FE8EF61F0DBA927E5C4488593757DBF09689ABC387A8A44F7C74AA69BA89BEE8EA55C87999898FEFEB232B1BA8CC7086
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .G.a.l.l.e.r.y...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD93E3.tmp\Droplet.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD93E3.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.528155916440219
Encrypted:	false
SSDEEP:	6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
MD5:	AA7B919B21FD42C457948DE1E2988CB3
SHA1:	19DA49CF5540E5840E95F4E722B54D44F3154E04
SHA-256:	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
SHA-512:	01D27377942F69A0F2FE240DD73A1F97BB915E19D3D716EE4296C6EF8D8933C80E4E0C02F6C9FA72E531246713364190A2F67F43EDBE12826A1529BC2A629B00
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.r.o.p.l.e.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD9C12.tmp\Slate.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD9C12.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.516423078177173
Encrypted:	false
SSDEEP:	6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
MD5:	5402138088A9CF0993C08A0CA81287B8
SHA1:	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A
SHA-256:	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
SHA-512:	F40A8704F16AB1D5DCD861355B07C7CB555934BB9DA85AACDCF869DC942A9314FFA12231F9149D28D438BE6A1A14FCAB332E54B6679E29AD001B546A0F48DE64
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.l.a.t.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDB7AC.tmp\Damask.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Local\Temp\TCDB7AC.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.544065206514744
Encrypted:	false
SSDEEP:	6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
MD5:	06B3DDEFF905F75FA5FA5C5B70DCB938
SHA1:	E441B94F0621D593DC870A27B28AC6BE3842E7DB
SHA-256:	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
SHA-512:	058792BAA633516037E7D833C8F59584BA5742E050FA918B1BEFC6F64A226AB3821B6347A729BEC2DF68BB2DFD2F8E27947F74CD4F6BDF842606B9DEDA0B75CC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.a.m.a.s.k...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDB869.tmp\Vapor_Trail.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDB869.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.5359188337181853
Encrypted:	false
SSDEEP:	6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
MD5:	0FEA64606C519B78B7A52639FEA11492
SHA1:	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76
SHA-256:	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
SHA-512:	E04102E435B8297BF33086C0AD291AD36B5B4A97A59767F9CAC181D17CFB21D3CAA3235C7CD59BB301C58169C51C05DDDF2D637214384B9CC0324DAB0BB1EF8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.p.o.r._.T.r.a.i.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDB8D8.tmp\Mesh.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCDB8D8.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5303110391598502
Encrypted:	false
SSDEEP:	6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
MD5:	8D1E1991838307E4C2197ECB5BA9FA79
SHA1:	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93
SHA-256:	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
SHA-512:	DCDC9DB834303CC3EC8F1C94D950A104C504C588CE7631CE47E24268AABC18B1C23B6BEC3E2675E8A2A11C4D80EBF020324E0C7F985EA3A7BBC77C1101C23D01
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.s.h...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDCF7F.tmp\Wood_Type.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Local\Temp\TCDCF7F.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.5552837910707304
Encrypted:	false
SSDEEP:	6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
MD5:	5728F26DF04D174DE9BDFF51D0668E2A
SHA1:	C998DF970655E4AF9C270CC85901A563CFDBCC22
SHA-256:	979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840
SHA-512:	491B36AC6D4749F7448B9A3A6E6465E8D97FB30F33EF5019AF65660E98F4570711EFF5FC31CBB8414AD9355029610E6F93509BC4B2FB6EA79C7CB09069DE7362
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .W.o.o.d._.T.y.p.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDD0B9.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.4699940532942914
Encrypted:	false
SSDEEP:	6:fxnxUXGWWYlIWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxny2WzIgN2RGHmD0wbnKYZAH+Vwv
MD5:	55BA5B2974A072B131249FD9FD42EB91
SHA1:	6509F8AC0AA23F9B8F3986217190F10206A691EA
SHA-256:	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
SHA-512:	3DFB0B21D09B63AF69698252D073D51144B4E6D56C87B092F5D97CE07CBCF9C966828259C8D95944A7732549C554AE1FF363CB936CA50C889C364AA97501B558
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.s.i.g.h.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDD0B9.tmp\Insight design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Local\Temp\cab1BBD.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2527736
Entropy (8bit):	7.992272975565323
Encrypted:	true
SSDEEP:	49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
MD5:	F256ACA509B4C6C0144D278C7036B0A8
SHA1:	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6
SHA-256:	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
SHA-512:	08C57661F8CC9B547BBE42B4A5F8072B979E93346679ADE23CA685C0085F7BC14C26707B3D3C02F124359EBB640816E13763C7546FF095C96D2BB090320F3A95
Malicious:	false
Preview:	MSCF.....R&.....D............................R&.8?..............Z..............M). .content.inf..,........M). .Main_Event.thmx......R..[...............=.1.^xa..^...../..^x....QA^"....^/.I.{/F..F..........6Vn. ..._Hmc......<....#.{.@.....Xl../Y....Ye..'V.f.S.Vf.T..0t+..y...5O...{.....-.dT...........!...[ .ns..k.....QAA.. ....B..u.`.....{.\u8.0.....@t........K....@..w.......>...-1F...........1.E....O............_M.m..CP.O......X......g......].../..:C...Q...i.._"...M..1o...S../...9....k;...}S........y..;1o....1h......t.CL.3...].@...T...4.6.}.....M...f...[.s.."f....nZ.W......0.c.{.`.^..Oo.[.JT.2].^.f..a....kO......Q..G..s.5...V.Wj.....e...I,]...SHa..U.N.N.....v.C.....x..J{.Z.t...]WN...77BO-J......g......3:i..2..EFeL.,n..t:..,~4gt.w...M.5.'h.L..#..A&.O.ys%K.Z....F.PW..=jH...jGB.i..j.J.^.#.\n...J@.....-5.f.1jZ68.o...H2.......$O...>..ld&,#$.&_....yl.fkP$.........l....s....i.tx.~<.z...>..2.Gx..B..z.E.3.N<....`$.....b..?.w.[.X..1.=q!.s......v.......r.w

C:\Users\user\AppData\Local\Temp\cab7AB0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	7.662386258803613
Encrypted:	false
SSDEEP:	384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
MD5:	ABBF10CEE9480E41D81277E9538F98CB
SHA1:	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
SHA-256:	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
SHA-512:	9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
Malicious:	false
Preview:	MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....\|.\|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.\|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d\|...4\|...C......R28.E......a....e...J.S..Ng.]<&..mm

C:\Users\user\AppData\Local\Temp\cab7AC1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20457
Entropy (8bit):	7.612540359660869
Encrypted:	false
SSDEEP:	384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
MD5:	4EFA48EC307EAF2F9B346A073C67FCFB
SHA1:	76A7E1234FF29A2B18C968F89082A14C9C851A43
SHA-256:	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
SHA-512:	2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
Malicious:	false
Preview:	MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t.....!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......\|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.\|.?7.'....b.G.4..'..A...o.Z...//..?...d.......C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.\|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

C:\Users\user\AppData\Local\Temp\cab7AD1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31008
Entropy (8bit):	7.806058951525675
Encrypted:	false
SSDEEP:	768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
MD5:	E033CCBC7BA787A2F824CE0952E57D44
SHA1:	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
SHA-256:	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
SHA-512:	B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
Malicious:	false
Preview:	MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...\|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......^..'.4.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

C:\Users\user\AppData\Local\Temp\cab7AD2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	35519
Entropy (8bit):	7.846686335981972
Encrypted:	false
SSDEEP:	768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
MD5:	53EE9DA49D0B84357038ECF376838D2E
SHA1:	AB03F46783B2227F312187DD84DC0C517510DE20
SHA-256:	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
SHA-512:	751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
Malicious:	false
Preview:	MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]...n<.7........=......"Q.E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%.VdS..H...o...s.....+..%[../>.t..I....F.....".G\|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

C:\Users\user\AppData\Local\Temp\cab7AD3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31562
Entropy (8bit):	7.81640835713744
Encrypted:	false
SSDEEP:	384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
MD5:	1D6F8E73A0662A48D332090A4C8C898F
SHA1:	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
SHA-256:	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
SHA-512:	5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
Malicious:	false
Preview:	MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O....#.P.,{..m...\|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f\|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#..rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h...sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

C:\Users\user\AppData\Local\Temp\cab7AD4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	33610
Entropy (8bit):	7.8340762758330476
Encrypted:	false
SSDEEP:	768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
MD5:	51804E255C573176039F4D5B55C12AB2
SHA1:	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
SHA-256:	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
SHA-512:	2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
Malicious:	false
Preview:	MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`....^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.\|...=..R...-7......TU.....7a...&I.noOK\|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...\|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

C:\Users\user\AppData\Local\Temp\cab7AD5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	30957
Entropy (8bit):	7.808231503692675
Encrypted:	false
SSDEEP:	384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
MD5:	D3C9036E4E1159E832B1B4D2E9D42BF0
SHA1:	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
SHA-256:	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
SHA-512:	D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
Malicious:	false
Preview:	MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../\|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'.....C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.\|..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..\|m:.):......F

C:\Users\user\AppData\Local\Temp\cab7AD6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31605
Entropy (8bit):	7.820497014278096
Encrypted:	false
SSDEEP:	384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
MD5:	69EDB3BF81C99FE8A94BBA03408C5AE1
SHA1:	1AC85B369A976F35244BEEFA9C06787055C869C1
SHA-256:	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
SHA-512:	BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
Malicious:	false
Preview:	MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..\|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...\|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..\|b?.N.}..MyO..q..:q.7..-~.xa.S...\|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......\|.Q\d-.S..2... ......Y..A...s....

C:\Users\user\AppData\Local\Temp\cab7AD7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.840826397575377
Encrypted:	false
SSDEEP:	768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
MD5:	62863124CDCDA135ECC0E722782CB888
SHA1:	2543B8A9D3B2304BB73D2ADBEC60DB040B732055
SHA-256:	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
SHA-512:	2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
Malicious:	false
Preview:	MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S\|..-.duN.Z..g.O......X8....1.....\|,.f/..w.\|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.\|5...i.%H..<.J...0n.....lZ.....?.?.~..O .)..

C:\Users\user\AppData\Local\Temp\cab7AD8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	32833
Entropy (8bit):	7.825460303519308
Encrypted:	false
SSDEEP:	768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
MD5:	205AF51604EF96EF1E8E60212541F742
SHA1:	D436FE689F8EF51FBA898454CF509DDB049C1545
SHA-256:	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
SHA-512:	BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
Malicious:	false
Preview:	MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P\|....F...F.......&&J.:I.34......+M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K\|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...[.A1....m...4h.9...N[....h5 n%k.~RR.c..n..=...4....).eH.-./..>.....r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...\|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

C:\Users\user\AppData\Local\Temp\cab7AE9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31835
Entropy (8bit):	7.81952379746457
Encrypted:	false
SSDEEP:	768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
MD5:	92A819D434A8AAEA2C65F0CC2F33BB3A
SHA1:	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
SHA-256:	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
SHA-512:	01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
Malicious:	false
Preview:	MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v\|..[.{7m.......\|}aI..\|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....\|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z...u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

C:\Users\user\AppData\Local\Temp\cab7AEA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20235
Entropy (8bit):	7.61176626859621
Encrypted:	false
SSDEEP:	384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
MD5:	E3C64173B2F4AA7AB72E1396A9514BD8
SHA1:	774E52F7E74B90E6A520359840B0CA54B3085D88
SHA-256:	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
SHA-512:	7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
Malicious:	false
Preview:	MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc\|.....a...j...=...{..a.`!8!..\|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE.....3.\|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).Q.\|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

C:\Users\user\AppData\Local\Temp\cab7AFB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	26944
Entropy (8bit):	7.7574645319832225
Encrypted:	false
SSDEEP:	384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
MD5:	F913DD84915753042D856CEC4E5DABA5
SHA1:	FB1E423C8D09388C3F0B6D44364D94D786E8CF53
SHA-256:	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
SHA-512:	C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
Malicious:	false
Preview:	MSCF....0......D...........................0...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+\|.Cb.t6f],.n.LV......OVg....O.at\|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v\|......l...t..l#{...H....9..\|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......\|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.\|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

C:\Users\user\AppData\Local\Temp\cab7B0B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21791
Entropy (8bit):	7.65837691872985
Encrypted:	false
SSDEEP:	384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
MD5:	7BF88B3CA20EB71ED453A3361908E010
SHA1:	F75F86557051160507397F653D7768836E3B5655
SHA-256:	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
SHA-512:	2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
Malicious:	false
Preview:	MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...\|..j..Q.,.....7.W...\|;j...%...:...\|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.\|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

C:\Users\user\AppData\Local\Temp\cab7B0C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22149
Entropy (8bit):	7.659898883631361
Encrypted:	false
SSDEEP:	384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
MD5:	66C5199CF4FB18BD4F9F3F2CCB074007
SHA1:	BA9D8765FFC938549CC19B69B3BF5E6522FB062E
SHA-256:	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
SHA-512:	94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
Malicious:	false
Preview:	MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...\|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..\|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...\|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..\|.T.jjS..4p.Pxu....W...\|.A)..\|9;....H.e.^.8D..S...M..Lj.\|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

C:\Users\user\AppData\Local\Temp\cab7B0D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31471
Entropy (8bit):	7.818389271364328
Encrypted:	false
SSDEEP:	768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
MD5:	91AADBEC4171CFA8292B618492F5EF34
SHA1:	A47DEB62A21056376DD8F862E1300F1E7DC69D1D
SHA-256:	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
SHA-512:	1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.\|.J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.\|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................\|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9\|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-...u.Rm..x<...?...!g@.}..).J...:...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5\|.9+....$M..L........(...@#.....N.....N...........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

C:\Users\user\AppData\Local\Temp\cab7B0E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	28911
Entropy (8bit):	7.7784119983764715
Encrypted:	false
SSDEEP:	384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
MD5:	6D787B1E223DB6B91B69238062CCA872
SHA1:	A02F3D847D1F8973E854B89D4558413EA2E349F7
SHA-256:	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
SHA-512:	9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
Malicious:	false
Preview:	MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.....\|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K...].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

C:\Users\user\AppData\Local\Temp\cab7B1F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31482
Entropy (8bit):	7.808057272318224
Encrypted:	false
SSDEEP:	768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
MD5:	F10DF902980F1D5BEEA96B2C668408A7
SHA1:	92D341581B9E24284B7C29E5623F8028DBBAAFE9
SHA-256:	E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
SHA-512:	00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3....bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9\|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..\|fB.il.(`..h.d;.l...`.s:

C:\Users\user\AppData\Local\Temp\cab7B31.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19893
Entropy (8bit):	7.592090622603185
Encrypted:	false
SSDEEP:	384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
MD5:	EF9CB8BDFBC08F03BEF519AD66BA642F
SHA1:	D98C275E9402462BF52A4D28FAF57DF0D232AF6B
SHA-256:	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
SHA-512:	4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
Malicious:	false
Preview:	MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.\|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR.....?..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...\|Lu.\|mCU..b.^.n39.h[M...%D{..w.1

C:\Users\user\AppData\Local\Temp\cab7B32.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	46413
Entropy (8bit):	7.9071408623961394
Encrypted:	false
SSDEEP:	768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
MD5:	C455C4BC4BEC9E0DA67C4D1E53E46D5A
SHA1:	7674600C387114B0F98EC925BE74E811FB25C325
SHA-256:	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
SHA-512:	08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
Malicious:	false
Preview:	MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n.../....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N\|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0Vh...C..//....W..:w......7.6....]....4.9...sL.0k...zHh..2N.H.....]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.\|......5S..=.............l.../\|....G\|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

C:\Users\user\AppData\Local\Temp\cab7B57.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20554
Entropy (8bit):	7.612044504501488
Encrypted:	false
SSDEEP:	384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
MD5:	486CBCB223B873132FFAF4B8AD0AD044
SHA1:	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
SHA-256:	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
SHA-512:	69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
Malicious:	false
Preview:	MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u\|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....\|.E-Y....]n".\|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.\|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...\|p....`lrA.\|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

C:\Users\user\AppData\Local\Temp\cab7B58.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	25314
Entropy (8bit):	7.729848360340861
Encrypted:	false
SSDEEP:	384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
MD5:	C47E3430AF813DF8B02E1CB4829DD94B
SHA1:	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
SHA-256:	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
SHA-512:	6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
Malicious:	false
Preview:	MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b..}",n.qou..M.[.;%../c.x.4.z.2.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

C:\Users\user\AppData\Local\Temp\cab7B59.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	23597
Entropy (8bit):	7.692965575678876
Encrypted:	false
SSDEEP:	384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
MD5:	7C645EC505982FE529D0E5035B378FFC
SHA1:	1488ED81B350938D68A47C7F0BCE8D91FB1673E2
SHA-256:	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
SHA-512:	9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
Malicious:	false
Preview:	MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..\|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB... .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D..P..!.)S.{..c....&'E.lJ%.\|O.a...FG.\|.....A..h.=c7.)d.5...D...L...IQ..TTE.NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

C:\Users\user\AppData\Local\Temp\cab7BF4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	7.641082043198371
Encrypted:	false
SSDEEP:	384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
MD5:	97F5B7B7E9E1281999468A5C42CB12E7
SHA1:	99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
SHA-256:	1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
SHA-512:	ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
Malicious:	false
Preview:	MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..\|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M\|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..a.$..-.K.Hf....L..;.#...H....U,........P.@.-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

C:\Users\user\AppData\Local\Temp\cab7C06.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	7.668619892503165
Encrypted:	false
SSDEEP:	384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
MD5:	8B29FAB506FD65C21C9CD6FE6BBBC146
SHA1:	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
SHA-256:	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
SHA-512:	AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
Malicious:	false
Preview:	MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...\|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

C:\Users\user\AppData\Local\Temp\cab7C18.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19288
Entropy (8bit):	7.570850633867256
Encrypted:	false
SSDEEP:	384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
MD5:	B9A6FF715719EE9DE16421AB983CA745
SHA1:	6B3F68B224020CD4BF142D7EDAAEC6B471870358
SHA-256:	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
SHA-512:	062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
Malicious:	false
Preview:	MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l\|.D.p9`..Y09.:.u....p. :,..YD=0.p. ......w...........<..;.....u.."......7[....8.....?^........-..;q.\|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...\|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....\|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h\|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}\|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

C:\Users\user\AppData\Local\Temp\cab7C29.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21111
Entropy (8bit):	7.6297992466897675
Encrypted:	false
SSDEEP:	384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
MD5:	D30AD26DBB6DECA4FDD294F48EDAD55D
SHA1:	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
SHA-256:	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
SHA-512:	7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
Malicious:	false
Preview:	MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%\|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=\|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........\|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

C:\Users\user\AppData\Local\Temp\cab7C2A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21875
Entropy (8bit):	7.6559132103953305
Encrypted:	false
SSDEEP:	384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
MD5:	E532038762503FFA1371DF03FA2E222D
SHA1:	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
SHA-256:	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
SHA-512:	E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
Malicious:	false
Preview:	MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...\|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.\|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9\|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.\|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.\|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

C:\Users\user\AppData\Local\Temp\cab7C3C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22594
Entropy (8bit):	7.674816892242868
Encrypted:	false
SSDEEP:	384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
MD5:	EE0129C7CC1AC92BBC3D6CB0F653FCAE
SHA1:	4ABAA858176B349BDAB826A7C5F9F00AC5499580
SHA-256:	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
SHA-512:	CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
Malicious:	false
Preview:	MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

C:\Users\user\AppData\Local\Temp\cab7C7F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	31083
Entropy (8bit):	7.814202819173796
Encrypted:	false
SSDEEP:	384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
MD5:	89A9818E6658D73A73B642522FF8701F
SHA1:	E66C95E957B74E90B444FF16D9B270ADAB12E0F4
SHA-256:	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
SHA-512:	321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
Malicious:	false
Preview:	MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`\|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.I.N.......@\|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.\|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r\|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

C:\Users\user\AppData\Local\Temp\cab7CB1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	42788
Entropy (8bit):	7.89307894056
Encrypted:	false
SSDEEP:	768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
MD5:	21A4B7B71631C2CCDA5FBBA63751F0D2
SHA1:	DE65DC641D188062EF9385CC573B070AAA8BDD28
SHA-256:	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
SHA-512:	075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
Malicious:	false
Preview:	MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d.. . (.8.".......(>..<...@...~v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u.....J3.V....~...~tn#.Kf6.s.\|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..\|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....\|..........WX..-?..........W.)^`1.......].R2..s6...H.......

C:\Users\user\AppData\Local\Temp\cab7CC3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	43653
Entropy (8bit):	7.899157106666598
Encrypted:	false
SSDEEP:	768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
MD5:	DA3380458170E60CBEA72602FDD0D955
SHA1:	1D059F8CFD69F193D363DA337C87136885018F0F
SHA-256:	6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
SHA-512:	17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
Malicious:	false
Preview:	MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F....@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11..m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x\|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

C:\Users\user\AppData\Local\Temp\cab8011.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307348
Entropy (8bit):	7.996451393909308
Encrypted:	true
SSDEEP:	6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
MD5:	0EBC45AA0E67CC435D0745438371F948
SHA1:	5584210C4A8B04F9C78F703734387391D6B5B347
SHA-256:	3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
SHA-512:	31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
Malicious:	false
Preview:	MSCF....tq......D...........................tq.. ?..........\|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...\|.\|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w.......E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.Kf.*P(..F..-.y.Z...

C:\Users\user\AppData\Local\Temp\cab8042.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	222992
Entropy (8bit):	7.994458910952451
Encrypted:	true
SSDEEP:	6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
MD5:	26BEAB9CCEAFE4FBF0B7C0362681A9D2
SHA1:	F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
SHA-256:	217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
SHA-512:	2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
Malicious:	false
Preview:	MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._\|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.\|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

C:\Users\user\AppData\Local\Temp\cab8043.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	271273
Entropy (8bit):	7.995547668305345
Encrypted:	true
SSDEEP:	6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
MD5:	21437897C9B88AC2CB2BB2FEF922D191
SHA1:	0CAD3D026AF2270013F67E43CB44F0568013162D
SHA-256:	372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384
SHA-512:	A74DA3775C19A7AF4A689FA4D920E416AB9F40A8BDA82CCF651DDB3EACBC5E932A120ABF55F855474CEBED0B0082F45D091E211AAEA6460424BFD23C2A445CC7
Malicious:	false
Preview:	MSCF....Q.......D...............y...........Q...XJ..........{..................M.. .content.inf.(..........M.. .Frame.thmx.1....b..[.........B.....6....ZZ}....BH..-D..}..V.V-........Z..O.....H.f..........;..@d.`......!..=;.,bp..K.q....s.y....D.qZ)p......D...r.S....s=B.4.).8B....4.a6 ...~........."....#.....}....n.Q.1cH.%c/.U....E..E...!..Da.p....X..G..:.....1.@.....W.'...._........W.c...<.v.k.....&.8......?.h.>d._:-.X.......9..tL}........3.;.N3.D~......>.^?..\|:...}......oT.z.......w..[..}:...._fu........Kk.......L..9..p..e..^......K.%...Mapqhvv..E&.^.....[...9\|"l...9...U......!..w..Nya...~C.yx...w.K..q.z.j.W?t.......DY.x.S2.....]..na.Qj...X.K..^...S.hK.W...Z....s.0...NF...8C.......j.'Zc...k.%...l....S.....OW..o.Qf.x...X.;<.rO].....W.m.e....T.1.6........".....Q.3........l..v.."..I...&......w..4vE...c.s[.3.m..8.q$.....a...)...&:6..,..#..?....;.!.....~.UP.r=.}h.&U......X...]..X.e\u.G<....E....lG.@.Z...10.D@.]....z+-.S....p..Y.PK.:.S..p.....1E`..-

C:\Users\user\AppData\Local\Temp\cab8064.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	230916
Entropy (8bit):	7.994759087207758
Encrypted:	true
SSDEEP:	6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
MD5:	93FA9F779520AB2D22AC4EA864B7BB34
SHA1:	D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
SHA-256:	6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
SHA-512:	AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
Malicious:	false
Preview:	MSCF.....F......D................g...........F...?..........\|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....uO..g.y....f...].5.........W.....h^[..w.\|.=.ru.\|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...s,(.o.@.ar.!.J.....

C:\Users\user\AppData\Local\Temp\cab80D4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.995561338730199
Encrypted:	true
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
MD5:	84D8F3848E7424CBE3801F9570E05018
SHA1:	71D7F2621DA8B295CE6885F8C7C81016D583C6B1
SHA-256:	B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
SHA-512:	E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cab80D5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.996203550147553
Encrypted:	true
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
MD5:	9A07035EF802BF89F6ED254D0DB02AB0
SHA1:	9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
SHA-256:	6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
SHA-512:	BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cab8117.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	261258
Entropy (8bit):	7.99541965268665
Encrypted:	true
SSDEEP:	6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
MD5:	65828DC7BE8BA1CE61AD7142252ACC54
SHA1:	538B186EAF960A076474A64F508B6C47B7699DD3
SHA-256:	849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
SHA-512:	8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
Malicious:	false
Preview:	MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..\|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H[%i.GNHB1D<......(# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

C:\Users\user\AppData\Local\Temp\cab856E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	550906
Entropy (8bit):	7.998289614787931
Encrypted:	true
SSDEEP:	12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
MD5:	1C12315C862A745A647DAD546EB4267E
SHA1:	B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
SHA-256:	4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
SHA-512:	CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
Malicious:	false
Preview:	MSCF....#......D...............Q...........#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q.R.".RTH.%.T..F......u.{.+.P.....FK0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6.78..X~.e+..CCw...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/.

C:\Users\user\AppData\Local\Temp\cab8745.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	640684
Entropy (8bit):	7.99860205353102
Encrypted:	true
SSDEEP:	12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
MD5:	F93364EEC6C4FFA5768DE545A2C34F07
SHA1:	166398552F6B7F4509732E148F93E207DD60420B
SHA-256:	296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
SHA-512:	4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
Malicious:	false
Preview:	MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..\|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.\|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K..F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C\|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!\|.u.3t....2e.wWH..'7p....E_...e.._;..k....&E.^.f=V..{..al.y:.4a...+.g...-..>e

C:\Users\user\AppData\Local\Temp\cab888F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	698244
Entropy (8bit):	7.997838239368002
Encrypted:	true
SSDEEP:	12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
MD5:	E29CE2663A56A1444EAA3732FFB82940
SHA1:	767A14B51BE74D443B5A3FEFF4D870C61CB76501
SHA-256:	3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
SHA-512:	6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
Malicious:	false
Preview:	MSCF....lh......D...............P...........lh...?..........\|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D..........&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)\|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$\|\X...8.....Fj'%,.)6w...u\|C..,y..E..`Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.\|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.\|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

C:\Users\user\AppData\Local\Temp\cab8EFA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1065873
Entropy (8bit):	7.998277814657051
Encrypted:	true
SSDEEP:	24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
MD5:	E1101CCA6E3FEDB28B57AF4C41B50D37
SHA1:	990421B1D858B756E6695B004B26CDCCAE478C23
SHA-256:	69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E
SHA-512:	B1EDEA65B6D0705A298BFF85FC894A11C1F86B43FAC3C2149D0BD4A13EDCD744AF337957CBC21A33AB7A948C11EA9F389F3A896B6B1423A504E7028C71300C44
Malicious:	false
Preview:	MSCF....q.......D...........................q... ?..........{...%..............M. .content.inf.Q_.........M. .Savon.thmx...O>.o..[..............&.5....UUcC.C....A...`TU...F....".54.E.....g.-.7-D....1g...p.6......@..w(....h'?.....(..........p..J.2n$4.........A......?...........@.C.W.R.5X..:....I..?....r.y..~!.....!.A.a...!........O.........5.x<C...?.?....C.C.......'....F../....../.$................4.7...................P...(.w.}6.........7.....01.1r........._..?.............'.._..JOx.CFA<.........0..2.?...>F.../...;..6-8..4...8&yb....".1%..v'..N...x......}.gYb..~L.....f[..!......Y.G.....p..r...?.p...F.Vy.....o.Whll...+...M.V...:.]...B.%.H....n..@.].zaVxf...y{.@....V.t.W....$Kp-.....7W.J..h..0A3mK.=.ub..R...W......*'T2..G#G,.^..T..XZu...U. ...76.d..#.I.JB.v...d...%.....6..O.K.[.:.L.\.....1.D..2a.>f......X...b5...ZgN.u.f...a!..."...sx....>..?.a.3.8.^._q..JS1.E..9..Lg.n.+....lE.f:j.9)Q..H1=..<.R.......{c>:.p[..S.9h.a.gL.U....8.z..z.!.....2I.~.b..2..c...

C:\Users\user\AppData\Local\Temp\cab8FA7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1097591
Entropy (8bit):	7.99825462915052
Encrypted:	true
SSDEEP:	24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
MD5:	BF95E967E7D1CEC8EFE426BC0127D3DE
SHA1:	BA44C5500A36D748A9A60A23DB47116D37FD61BC
SHA-256:	4C3B008E0EB10A722D8FEDB325BFB97EDAA609B1E901295F224DD4CB4DF5FC26
SHA-512:	0697E394ABAC429B00C3A4F8DB9F509E5D45FF91F3C2AF2C2A330D465825F058778C06B129865B6107A0731762AD73777389BB0E319B53E6B28C363232FA2CE8
Malicious:	false
Preview:	MSCF............D...............-,..............x?..........}...-...RU.........M. .Circuit.thmx.....RU.....M. .content.inf.g...&\|..[......=..R.....=.,.!QA?h..Q.!....Uk!.HJ.......VKuk.....q.w.w.U.....;...K.@.URA..0..B..\|rv.ND(.`{..@.1.}...s?.....-...O.(V.w..1..a.....aW...a.Z..aX....5.I...!..........(. ./.d...me.( ..f.........w.......Xp.s....c..vB.98.....C.J......V ..ML.M...B.n.>...\|....u!.5@t..q4....(K...u qL.S....>/%v%.2..TF.].e..'..-..L.N..c].a..(WU\o.%^..;...\|o.6..L..[..;&....^p.Lu.sr,-.R=.:.8.>VOB...:.?$.h.o....Zh.h....`.B.c.../K......b^...;2..bY.[.V.Q8....@..V7....I0c.cQN7..I.p..}..!..M....1K....+....9.2......a..W.V..........;.J .i......]%O.-......CeQ.0.c....MbP3.0.w..8w..Y...\|...H;#.J.+M......>.`y..aWk\|.i.BF.pJv;.....S..6....F.....RLG~..........J.=......"..........H.....h..o...u........M.6F?.F.p.B.>./*l....J.R..#P.....K......<iu..gm^..n...#c..zO"7M.O......4'>A..(.E.Cy.N.)....6.tx.r[.....7.......m.t..E?.....5.5.6.\..{.V.T.D.j..=~a^.I

C:\Users\user\AppData\Local\Temp\cab8FF8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	953453
Entropy (8bit):	7.99899040756787
Encrypted:	true
SSDEEP:	24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
MD5:	D4EAC009E9E7B64B8B001AE82B8102FA
SHA1:	D8D166494D5813DB20EA1231DA4B1F8A9B312119
SHA-256:	8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D
SHA-512:	561653F9920661027D006E7DEF7FB27DE23B934E4860E0DF78C97D183B7CEBD9DCE0D395E2018EEF1C02FC6818A179A661E18A2C26C4180AFEE5EF4F9C9C6035
Malicious:	false
Preview:	MSCF....]M......D...............=...........]M...?..........}..."..............Li. .content.inf............Li. .Gallery.thmx.].(.Vq..[.....0Y..........v.....w.wwwww.wwwwww.w.....".83....y8..mg...o..U..N(..@uD.:O<........{.G....~~.....c.c.5..6./\|G .@#1O.B.............PT@...b.d.~..U....B.{.........0.H.....`.H.`..'S.......Ic..W..x...z....... .........g......._....o......S......p...$....._........._...K......x..?.6.U~...'./.r.................../.......5.8..2........2b.@j ....0.........``....H... ,5...........X........\|..Y.QoiW..\|.......x.sO8...Yb....7...m..b.f.hv..b......=...:Ar.-...[..A\.D..g..u....].9..M...'.R-`.....<..+.....]...1.^..I.z..W{.._....L.. ...4;..6O.....9,.-.Vt+b/$7..}.O05.Y...-..S.....$.....1."Z.r;.!..E.mMN..s .U...P%.[.P...cU...j...h.d.../.s..N/..:..X...p5.7\}h.Q ..._.F.X.C..z$.nV..+.k..\|.@.L...&.........^#.G.a..x..w!wx.8e+..E. i..$?9..8...:......\|..[."..y..&y..?...W....s..._...3Z0c.....i.q.........1c.jI....W..^%xH.._...n.......&J..

C:\Users\user\AppData\Local\Temp\cab93B3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1310275
Entropy (8bit):	7.9985829899274385
Encrypted:	true
SSDEEP:	24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
MD5:	9C9F49A47222C18025CC25575337A965
SHA1:	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0
SHA-256:	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
SHA-512:	9FDCBAB988CBE97BFD931B727D31BA6B8ECF795D0679A714B9AFBC2C26E7DCF529E7A51289C7A1AE7EF04F4A923C2D7966D5AF7C0BC766DCD0FCA90251576794
Malicious:	false
Preview:	MSCF...........D...............9..............XJ..........}...6..............M.. .content.inf............M.. .Droplet.thmx..m7.>J..[...............2.QQPIj..."o^R.H5^...^(e.W...R..x..^`..m...."..+.....{o.......Q.-....$V.N>...T]..L.... ..N.h..dOY.......S......N.%.d..d....Y.....e..$...<.m...`............@....=.z..n..[...,G..1Fn.qPDH{C<...3.Q...2..r.....E.E.E.ErM"&a..'..W....:...?I..<.I..6o.`.d.?!..!..._.4\.._.E..).._O.S....; ..#..p.H.....c....o\.K..?$U.e.........!...J.v.....gNe._..[....#A.O.n_.....gm:P._.........{@..-g..j.69b.NH.I.$Hk?.6.n...@......'.C.._.U..:,j.-G.....e.#.Sr.t.L......d[.[...s.....rx.3.F[.5o..:....K.x..)M.fb...3IP.&h.Q.VX^%U.......x..l......@6.k.P..zSW.?....F..[L...4..b.l.w."&.....`.j...i.5}".~.-.....{\.:...o.'H\+)....3.Y......\...f:.;....e........4't7..f...w..j...3....N..9`.J...P..?.....=3_.y]...f.<.......JM5.}Q/ .F.a..Z.._yh......V..>m .......a....f....!.hz..\.....F_..'z...,....h.=.......=.o..T....3.e..........$..g.2.

C:\Users\user\AppData\Local\Temp\cab9BD3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1766185
Entropy (8bit):	7.9991290831091115
Encrypted:	true
SSDEEP:	24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
MD5:	828F96031F40BF8EBCB5E52AAEEB7E4C
SHA1:	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2
SHA-256:	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
SHA-512:	61F6355FF4D984931E79624394CCCA217054AE0F61B9AF1A1EDED5ACCA3D6FEF8940E338C313BE63FC766E6E7161CAFA0C8AE44AD4E0BE26C22FF17E2E6ABAF7
Malicious:	false
Preview:	MSCF............D...............)q..............0?..........{...H..............M.. .content.inf.;.#........M.. .Slate.thmx.p.+..P..[......U..............p..K.!..........K..w..v........=....D$r...B....6 ...X.F0..d..m.s...$$r........m.)6.m3....vXn.l..o...a...V......Ru.:=2M.........T.....4S`EP......\..r,..v...G.P......'._H0]..%_............X.P.,.............H.?.-.H..".......M..&..o....R........<......`...D.H.._.G.Qv..(..U,.9..D...."..T..i.e../.e.."....,S...o.X.....c./..V....Z..o.O..2....{...+... ....0.@J.R.Q.m.....{.....h?u.q.O{...l.d)..Yk`.....#...u.-.m..#CXwrz4..7.>......v.E:.#.oGSKS.TX.Chm.4aQ......avH..{..j+@6[k].....`c..W8..j.v.Zh.]....4......K..#Hzyd..K}.....H\|<H..\(l...+..%Z......~.S:^..d>..1..H%..7N-v.....Wu.*..b^.B.....k0gc.2.{.!...E7.}3.d...{.Ye...&#f6...:2......v..&!..k0d.p.b...,..$.....Y..60...h.N}.r...<[./........{...Es..&.nf.....2.@Fh3.9.G....l.[.C..SD/6.H.K....}..m....M..........gl.P.]..I......5....e.c...V....P...[.=.......O.eq+

C:\Users\user\AppData\Local\Temp\cabB5D5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1881952
Entropy (8bit):	7.999066394602922
Encrypted:	true
SSDEEP:	49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
MD5:	53C5F45B22E133B28D4BD3B5A350FDBD
SHA1:	D180CFB1438D27F76E1919DA3E84F307CB83434F
SHA-256:	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
SHA-512:	46AD3DA58C63CA62FCFC4FAF9A7B5B320F4898A1E84EEF4DE16E0C0843BAFE078982FC9F78C5AC6511740B35382400B5F7AC3AE99BB52E32AD9639437DB481D1
Malicious:	false
Preview:	MSCF.....x......D...............l............x..`?..........\|...D..............M[. .content.inf...!........M[. .Damask.thmx...o.PI..[.............../.TU.jj0..3jCUPU.jF...m.UU.P}.....PU..........w..#....E..].................A.. w.$..@..'g.......6%:..r9..d.M;M+.r.8[d{.s..dh..(P..........!.. ..ne..f.Nc..#..Y..q....KB}..b].@..F.&.t....E.........@&.m......$w......q...:.H....p.p.....?.9x.. .....?...ao....I....................o......g.u..;."....O;....{..(k..._.w/.Z......Jb..P.O?...........?....F....ty..72......! #....v..J......?.....!,.5.7..Em.....is.h.. \.H)i1v..zwp.....P.....x].X{O//..\....Z>z....6...+..a.c...;.K..+...?014..p.w%o^.....]...MguF...`....r.S.......eF..):.dnk#.p{..<..{..Ym...>...H......x.}.hI..M....e......*G.&.?..~.~G6.....+...D..p...._...T....F6.[Cx./Q..Xe.>.;.}>.^..:..SB.X..2.......(A..&j9....\\.......Haf+]Y...$t^Y=........><.w....tL../E...%6.Vr~MI...l.....<.0.I....7.Q8y.f.uu...I.p..O..eYYS.O......9..Qo.......:..........o.............{

C:\Users\user\AppData\Local\Temp\cabB70F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	3256855
Entropy (8bit):	7.996842935632312
Encrypted:	true
SSDEEP:	98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
MD5:	8867BDF5FC754DA9DA6F5BA341334595
SHA1:	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9
SHA-256:	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
SHA-512:	93421D7FE305D27E7E2FD8521A8B328063CD22FE4DE67CCCF5D3B8F0258EF28027195C53062D179CD2EBA3A7E6F6A34A7A29297D4AF57650AA6DD19D1EF8413D
Malicious:	false
Preview:	MSCF....Gm1.....D...............cM..........Gm1..D..............o... ..........MP. .content.inf...7. ......MP. .Vapor_Trail.thmx..n...N..[......L........7...+I..x...P7/...BH..Rm.\yqi.x..B....{.m.............=.....p.%.@......BpV.[......C.4..X./..Y.'SB..........0.Gr.FG.).....R\...2..Jt..1..._.4_B..................cn7H.-.....Q...1..G{G.~.. '.$......@.(....=@=..`....@.@.A. ....'.4`. .@....D...'....S.s..9.7" /....?.aY.c.........LG....k...?_.....P.....?.1.....FB..m..t...['......:...?...W..../~..z.Tr...X.@...._....3..N..p.....b...t.....^..t...~..t.8A...t_....D..3R.Z.=..{.A.8).3-5..v.isz....0A~%.s.D.4....k.K......8......)R.}f.E..n.g&:W...'E....4%T..>......b.y..[..zI....e...j.s....F.....\|7826U.C.,..BY.U.F.f......"..#.m..,..._...#.\.....gPP.2.}Kas......g..3.d0.Z.Z.]..n......MY]6.....].m..D.6...?.n.20.,.#...S...JK..#.W.%.Z4.....i..CBf...../..z......n.N...U.....8t...ny...=.!..#..SF..e...1.P..@.Qx*.f.;..t..S.>..... F..)...@.Y..5j....x....vI.mM....Z.W..77...

C:\Users\user\AppData\Local\Temp\cabB859.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2591108
Entropy (8bit):	7.999030891647433
Encrypted:	true
SSDEEP:	49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
MD5:	BEB12A0464D096CA33BAEA4352CE800F
SHA1:	F678D650B4A41676BA05C836D462F34BDC5BF648
SHA-256:	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
SHA-512:	B6E7CCD1ECBB9A49FC72E40771725825DAF41DDB2FF8EA4ECCE18B8FA1A59D3B2C474ADD055F30DA58C7E833A6E6555EBB77CCC324B61CA337187B4B41F7008B
Malicious:	false
Preview:	MSCF.....D'.....D............................D'..D..........z...^..............M7. .content.inf............M7. .Mesh.thmx....&~j..[.....0.................]............ww,v.\....D......3m..m!f..0..E{..?..`..A...k.:....I..........\|bmG.FS...f.;.J.vzb.......R.......-....\|.......ESD.....".4M..M..t.N....y..,..#.4.5.2.......'.8.Q..3.D..T....!.......&rJg...s........(..9........Dw..'....9.-..G.c............E.. .O.....a..O.._..s..)7Wz~....bJ..D...o....0..R/.#...?.......~6.Q?....?y...g.?............TP..r-...>....-..!.6...B.....\../...2....4...p$...Oge.G.?.....S.#x(..$.A~.U.%f....dJ..S.f{.g.._..3{.fm2.....Z.\o&.[k.m....ko.8..r.-.Go.OQ..'!6..f.L...Ud.$.q.L.....R.. J.T&4g...7.2K...#k.[.].:....lk.....;c..DRx.`..&L..cpv.>.Ngz~.{..v5.\...'C.<R:.C8.\|.fE{......K...).....T...gz}..rF..Q.dof7.....D.f=cm...U\|.O.]F...5zg(.. ....S..._?D....^..+.i...Z.....+X..U!4qy..._..`I..>./.W.7......=.O....BG..=..%9\|...3.?...}.$"..H..u...0.......a..:t?.....8...Z..#g.=<.e.`\......KQ..U....

C:\Users\user\AppData\Local\Temp\cabCF4F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	723359
Entropy (8bit):	7.997550445816903
Encrypted:	true
SSDEEP:	12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
MD5:	748A53C6BDD5CE97BD54A76C7A334286
SHA1:	7DD9EEDB13AC187E375AD70F0622518662C61D9F
SHA-256:	9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351
SHA-512:	EC8601D1A0DBD5D79C67AF2E90FAD44BBC0B890412842BF69065A2C7CB16C12B1C5FF594135C7B67B830779645801DA20C9BE8D629B6AD8A3BA656E0598F0540
Malicious:	false
Preview:	MSCF....?.......D...........................?...`J..............3..............M.. .content.inf..+.........M.. .Wood_Type.thmx......r..[.........................!.wwwwqwwwwwwwwwww..."....+......nR..x..\..w..r.5R.....(\|.>.$e3.!..g....f..`9NL......o./.O.bxI...7.....\|........6.n."J.....4^g.........?...................o.......s3.....8. .T.j...._.Z.Q.t.k,(o.c.t.......?Z....`o........?.a....6.)....6b..../.t...........Mz....q}......C.......+{.......o...K.tQjt............7.._....O.....\....` ..............@..`....%..t....V.]........m..m....u..1.yr;..t..F.'..+{....zqvd.g._..$H..Vl...m..../....g..rG.....:......8....h...[...a06...U.W....5.Z.W..1I..#.2.....B3...x....$PRh...\{J.c.v.y..5+Y.W.N..hG......<..F..W.d8_....c...g....p\|7.]..^.o.H.[$Zj..{4......m.KZ..n.T%...4.Z..Y."q7?kuB......U....).~.......W%..!.e.U.mp.o...h...?.w...T.s.YG#......Y.}....Z.O.i.r,...n..4.\....P..m..=....f........v....g....j....wP..4.VK.y.z...C..oum.b.1......?.Z.>.7.!?......A..Q>..Z....-

C:\Users\user\AppData\Local\Temp\cabD04B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	3417042
Entropy (8bit):	7.997652455069165
Encrypted:	true
SSDEEP:	98304:1YYkj2mRz6vkkB15AW4QD0ms+FdniD60bDUpS:qYkj7d6vP7NZDLn+PM8
MD5:	749C3615E54C8E6875518CFD84E5A1B2
SHA1:	64D51EB1156E850ECA706B00961C8B101F5AC2FC
SHA-256:	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
SHA-512:	A5F591BA5C31513BD52BBFC5C6CAA79C036C7B50A55C4FDF96C84D311CCDCF1341F1665F1DA436D3744094280F98660481DCA4AA30BCEB3A7FCCB2A62412DC99
Malicious:	false
Preview:	MSCF......3.....L.............................3..?..............j.....3.....t.4.............Insight design set.dotx.................Content.inf...QJ.N..[.........R.....L....N).J\|E.B.$.B).3,...n.....JW....k.U1..M...3#.5....$^.....;vR...Z.nj...#......^......a.{..(..o.v...!L`...T.-&jZ`.\.0.....G.."b.m..F.X......$>%..?.D..H.l.j....$.......MrQ......q-....hx...6.D.3...j....n..U#R..3....sm?..xJr..............$G8..t.g...?.g.}......$P._...7.#..w..9DR....lu....?..'.Ai..v.vl..`......B..N_....W./.;...c=oYW.lL'bv.......+...9.P..B=...Y.SX=EL.5o....?H.e\|.Fn.M[...d.v.....i......9..U..H....uq.Nrn..@..e...3....8.....s8}z..$........B....26...d..?.l....=.aeM.[..\|n....H.;..7A.`....=.F...V.Y.l..8.........%e.x0S.....~..2..%.....U..#.r_.0V.v.6w.l.......Y.........v..o+....sn.$^'.Il...akUU....w....~.....&8.Vwj.....Q.uQ..&..G.($.2.s.?m.B.~j...+G.W..qi..g..5.)){O........o.ow.(;.{...y;n...J...&.F2.@.;......[{'w..........`....czW.........?W...}..w....x..........

C:\Users\user\AppData\Local\Temp\mso3E52.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	GIF image data, version 89a, 15 x 15
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.949125862393289
Encrypted:	false
SSDEEP:	12:PlrojAxh4bxdtT/CS3wkxWHMGBJg8E8gKVYQezuYEecp:trPsTTaWKbBCgVqSF
MD5:	ED3C1C40B68BA4F40DB15529D5443DEC
SHA1:	831AF99BB64A04617E0A42EA898756F9E0E0BCCA
SHA-256:	039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
SHA-512:	C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
Malicious:	false
Preview:	GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;

C:\Users\user\AppData\Local\Temp\mso93BC.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	GIF image data, version 89a, 15 x 15
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.949125862393289
Encrypted:	false
SSDEEP:	12:PlrojAxh4bxdtT/CS3wkxWHMGBJg8E8gKVYQezuYEecp:trPsTTaWKbBCgVqSF
MD5:	ED3C1C40B68BA4F40DB15529D5443DEC
SHA1:	831AF99BB64A04617E0A42EA898756F9E0E0BCCA
SHA-256:	039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
SHA-512:	C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
Malicious:	false
Preview:	GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:hWI:A
MD5:	B2BD6432A75FB72CD6A5B7DA247C439F
SHA1:	CDF3D19648E987669F3C37E63199ADE26180B6AF
SHA-256:	A4518B96B6337B9DBD5775F252BE5B35528E1DAEBF73DEB609DB5A9F3DA32EC1
SHA-512:	212D1FC7487984C2FAA8F8393090D1AE488991E38247187ABF56E60A72FBD9761D071E0B0C69A99EF132F5D16422FBC0F74C479A90E4CA92D0A1F33A993BD41B
Malicious:	false
Preview:	....V3........................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Superintendent Dr.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Oct 4 13:16:54 2023, mtime=Mon Oct 28 19:04:32 2024, atime=Mon Oct 28 19:01:54 2024, length=2250547, window=hide
Category:	dropped
Size (bytes):	556
Entropy (8bit):	4.739352960045891
Encrypted:	false
SSDEEP:	12:8HioQZKa/34UstfAjALqn/0CtsgOGOfmV:8CP0y4UstUALdC6gZom
MD5:	0FEF941A96B11BE4D16E007AC6A52946
SHA1:	DD7902ACC85EB4F9566C7F56B9E15507823E79CF
SHA-256:	919E094D7EB9287C34BF63AF5AF8E7FD98CE3FDE00C38EE1BAD752F6ECB2DC18
SHA-512:	A406EF25D5EF0E1CF31781ADFCCFB5E24C1232278B74BA6715792470F8AE07BDA71805EA0FD3666BC1BA0BEFF15CB1C3FE56429A1E9842E593812FF8DD20DC6E
Malicious:	false
Preview:	L..................F.... ....^,m.......t)..+.i<t)..3W".....................\|.z.2.3W".\Y<. .SUPERI~1.DOC..^......DW.r\YA...............................S.u.p.e.r.i.n.t.e.n.d.e.n.t. .D.r...d.o.c.x.......]...............-.......\............F.......C:\Users\user\Desktop\Superintendent Dr.docx..-.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.S.u.p.e.r.i.n.t.e.n.d.e.n.t. .D.r...d.o.c.x.`.......X.......849224...........hT..CrF.f4... ..}2=.b...,...W..hT..CrF.f4... ..}2=.b...,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Mon Oct 28 19:01:56 2024, mtime=Mon Oct 28 19:03:13 2024, atime=Mon Oct 28 19:03:13 2024, length=0, window=hide
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	4.60927419876489
Encrypted:	false
SSDEEP:	12:8fMgMUYVCECHiWD+lIe/8QEls0/7XeLwCJTvXzfMil4jABHSuT1lilGqNfBZks4H:8ZDMkHVTX4WAEuTm0R/Nqygm
MD5:	5A2AE0029729E4BBEB50AE0B284660D1
SHA1:	54309B0ED71196135AC922955EBE9B85E7491BF0
SHA-256:	D59F48CBE8232F541CDF54074EE1524E5006EBD05A3C4D531242DE70B8CF508C
SHA-512:	C1B339B813B0D1712A1C8DCFA1E609EA820B56877945E13435AD3AAF4898A7E554F3ABD8BE44C97408F5D3C47B2C39B36E370937F39DA269CC553BDD22B0588A
Malicious:	false
Preview:	L..................F........Q#\|=t)....vkt)....skt).........................._....P.O. .:i.....+00.../C:\...................x.1.....DW(m..Users.d......OwH\Y3.....................:.....NvM.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....T.1.....\Y8...user..>......DWSl\Y:.....2.....................~.@.a.l.f.o.n.s.....V.1.....DWSl..AppData.@......DWSl\Y3.....B.....................Bdg.A.p.p.D.a.t.a.....V.1.....\Y8...Roaming.@......DWSl\Y8.....C.......................6.R.o.a.m.i.n.g.....\.1.....\YD...MICROS~1..D......DWSl\YD.....D......................P'.M.i.c.r.o.s.o.f.t.....\.1.....\YG...TEMPLA~1..D......\Y=.\YG..... ....................._...T.e.m.p.l.a.t.e.s.......b...............-.......a............F.......C:\Users\user\AppData\Roaming\Microsoft\Templates........\.....\.T.e.m.p.l.a.t.e.s...........................>.e.L.:..er.=....`.......X.......849224...........hT..CrF.f4... ...g....,...W..hT..CrF.f4... ...g....,...W..............1SPS.XF.L8C....&.m.q............

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.635258511252218
Encrypted:	false
SSDEEP:	3:H9mdnom4uMJlumdnov:H9mBN8By
MD5:	59512FE182CC95B3043BD92A50757F46
SHA1:	D24D36C8E607AB989B3A9613CB1AEFEDDAF6F989
SHA-256:	EED9CF8A57B5A32B570476C00B75460D4106B26349606DBA1DFEE2634B5D656A
SHA-512:	F7FBAD53836CF0668E1E86DB016B743B329F65EBC91BB37109BE590425062D7B1AF4AD10E426D54A500E29C5A231C870764988A59B1C4B1F08AD92BD62D8294E
Malicious:	false
Preview:	[misc]..Superintendent Dr.LNK=0..[folders]..Templates.LNK=0..Superintendent Dr.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19360
Entropy (8bit):	7.467579805726307
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUIlZAyjdMckvazU5mjOq6m9szIk:VAxllNVJLjN3k
MD5:	889AFCAAB8762EBDDE2A3FA812BAF731
SHA1:	02DB655E411A125D9961322F05ACEB2D24F5B6ED
SHA-256:	CBB8B92EB6CF36CD62647F03A62D0E9FCCDCA54917E84D624B51CEF71952BA1E
SHA-512:	12141A720FCC3980E11A0DC9CA07256614FB8043E0C6179C90633AE93BD22CFDA87EE56711CAF78DAD5FE0695042D6990BFFA12B3401CAC88469700D2B839C66
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.736460212499601
Encrypted:	false
SSDEEP:	3:klt+lllU3DEAq8EmDmJryQjevRfYDEZUMRslllriJ/iaa2zFn:7tU4Aq8Em65YoMel/+J/5ayn
MD5:	DE450EC376FA070FBBDE21EC35461C9E
SHA1:	7FEBC3F7C80F815ABF73DD680D19AE2DAC370CA6
SHA-256:	F0F83FD18ABEC91DAFB97528E49DEB1978DBC8326AD45EDD6B6C326274372624
SHA-512:	BAD9BC22951C190AFF25D7496B9464F742C54ADBF199AF0DECC1ED8936F99611534248D8019AA1948A333F8E63C3CC4F43CCCCEE83E08155749CD1E8260D1141
Malicious:	false
Preview:	.user.................................................a.l.f.o.n.s...qR.k....$.,.%].X!l....~._....e....Ld4.}y.2!#.......^-M.it)......:..r....}..j.........=.i

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19360
Entropy (8bit):	7.467579805726307
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUIlZAyjdMckvazU5mjOq6m9szIk:VAxllNVJLjN3k
MD5:	889AFCAAB8762EBDDE2A3FA812BAF731
SHA1:	02DB655E411A125D9961322F05ACEB2D24F5B6ED
SHA-256:	CBB8B92EB6CF36CD62647F03A62D0E9FCCDCA54917E84D624B51CEF71952BA1E
SHA-512:	12141A720FCC3980E11A0DC9CA07256614FB8043E0C6179C90633AE93BD22CFDA87EE56711CAF78DAD5FE0695042D6990BFFA12B3401CAC88469700D2B839C66
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	2.836591668108979
Encrypted:	false
SSDEEP:	3:QETlbol9:QEiv
MD5:	5FFBAD261CA1D087BDEA2DAA185561A0
SHA1:	A961E6EBC140F64BC9CBD47EB820DF77764969AB
SHA-256:	2FFE94EBE8D67CD72EE7F1D088DA8AC1B6BA2EBAB80463CC38AC10617ADF933B
SHA-512:	DE56BFA3EF7EB40E7D40CCEC2A99795CEEEB708F7D2E47520A6F82AAC3A72D69F4887BF3C515FB0C0136AF6D04DC90E4CBF4A704E13561EC3171373ABAE1D73A
Malicious:	false
Preview:	..a.l.f.o.n.s.....

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 19:02:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9678197629129404
Encrypted:	false
SSDEEP:	48:8rWodA6TgmD/HvidAKZdA19ehwiZUklqehey+3:8rm6sGpty
MD5:	A6DEA445FAD04D34D6433FC9A620A70B
SHA1:	F27E0BC91E26A61D49653777F9600FEDE2B9BD29
SHA-256:	3006F232A836492D5F21DDB20EDB8D4954C9CE7BD33E3E6287B32837199DD5BA
SHA-512:	4653E5AF785FDF570EEE9BF12829352C178572A36A840FC4E094FE5A0DB90E0ED984F3D865438E2E6F5DECA68ADAAF1618DE1D3D17369CBA27A4DE1DECEA3CFC
Malicious:	false
Preview:	L..................F.@.. ...$+.,....jRwSt)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\Y<.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\YO.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\YO.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\YO............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\YQ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 19:02:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9845786822500466
Encrypted:	false
SSDEEP:	48:8X4odA6TgmD/HvidAKZdA1weh/iZUkAQkqehdy+2:8A6sG79Q0y
MD5:	3179C6C380820FBE86661BB6D2ACA0BB
SHA1:	40DBF043606F4C3A034773BEBCB8124BDA7F2959
SHA-256:	DC300B12B73F1F74BCF905778DD6E9DC66E6CC76E4FF74D09A97C7F3724B975E
SHA-512:	54509299E584F63FB7734FDBA2A31A8AD9A026F8A744982AC1546C46B5197D896FCBEDD0C331FF4221942B944B46303E7403D30ACB88B17B8D45BE31B5305F60
Malicious:	false
Preview:	L..................F.@.. ...$+.,......lSt)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\Y<.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\YO.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\YO.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\YO............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\YQ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.999886815719543
Encrypted:	false
SSDEEP:	48:8x+odA6TgmDsHvidAKZdA14tseh7sFiZUkmgqeh7s7y+BX:8x+6sGinRy
MD5:	072B55746B5A145DE3402AC8B4958460
SHA1:	2A8817ED9536F10F70A4A35B348C5320A9694815
SHA-256:	2FDD12CBBE0DC17AB2C7EED932CF0766A9699A1DCE900C6A7EAC2B8D147C8455
SHA-512:	0F2DFD302AFCF55FA4933ADA69B3E3F20A0631E3F752C123391C97C1F03BA80530818A004877148E5E0363FFB2004CC548E7E74C04AFF9DF47CDD2AA0DDDFA93
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\Y<.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\YO.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\YO.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\YO............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 19:02:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.981776161986215
Encrypted:	false
SSDEEP:	48:8vodA6TgmD/HvidAKZdA1vehDiZUkwqehZy+R:8R6sGYjy
MD5:	CF6F89852C86FAD11977D7FFF8AF1310
SHA1:	72A253B2DA865B9319DB59122BF4388A108B346F
SHA-256:	A49992D678812CA13CCAB95C85608B8C39A351D2815FA9E6DA86A163B7514488
SHA-512:	415EC7F7F7CA4ECC44687A5E09F504DE097C913F347C81DA64C26304823C636E613087A69DF6F4A8887A26B3EE9FA1B7584CEAC8358CA63D129A984621146FE9
Malicious:	false
Preview:	L..................F.@.. ...$+.,....k.fSt)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\Y<.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\YO.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\YO.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\YO............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\YQ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 19:02:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.972899386677086
Encrypted:	false
SSDEEP:	48:8+odA6TgmD/HvidAKZdA1hehBiZUk1W1qeh/y+C:8+6sGI9fy
MD5:	0787210E8D4C9EE67FC0076FB8C468B0
SHA1:	C75D00B4BCD66BCD2B17EB6E63E35CB636E4DC90
SHA-256:	F0CB1492547FA4CC07CC916FF782CFCCF8BC6ADC3B3428758D6151EFCE863B2C
SHA-512:	DDE6E0463BD5898E199480009AD10667AE11D2659B9F4E5F748B7A0925A93121F2BD62E0D2402D6E26B224F3991D7A5E36D8C5A7530B6CBECA631812A2074EBD
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....qSt)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\Y<.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\YO.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\YO.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\YO............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\YQ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 19:02:32 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9849259380745523
Encrypted:	false
SSDEEP:	48:8QWodA6TgmD/HvidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbRy+yT+:8Qm6sGmT/TbxWOvTbRy7T
MD5:	145FC2F4877E00D36B6474B60C643E6E
SHA1:	EF7747D76BDE425E6EA8DF8877866C3B68CCB9F6
SHA-256:	232B08B08CB5EE534A0FB21D9B23C3FF4E6607AC79C8216075C2B188856018EE
SHA-512:	CAB09A6F6993102D26524D7A7088063B550E659B76FDAADA02E410619E13DD3E1A4702076104DF07437A7904608753121CD4B19532C88DD828AE4484E1CA2ACA
Malicious:	false
Preview:	L..................F.@.. ...$+.,......[St)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\Y<.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\YO.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\YO.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\YO............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\YQ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........7.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Desktop\~$perintendent Dr.docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.764018196738551
Encrypted:	false
SSDEEP:	3:klt+lllLv5mc3TGmV0tCCAcTRMRMb/l7GRYlHaaamljM:7tT4ETGntCCxRQMhaeDaSjM
MD5:	E7F6CF804B63B50B31CF11C83C6433EB
SHA1:	D6048CC2BD93CF2AE3030EFEF0496356FCB5DCDA
SHA-256:	26B0169B2F372E0BA5F6EF5F7F346C23B52F34D302894E061476630A4410393A
SHA-512:	D1D66CC6C67178185F128D8CE83355A77EB31146854E373A60B28E68E901371E4E159C1B274DBFA9F60AF39D9AE7B53F7CADDA6F39AAA992506063742CBEFF5E
Malicious:	false
Preview:	.user.................................................a.l.f.o.n.s...n...?....y@..1.....hp...)....m.x...t......_.%y....B4J..t).........r4(..}..j....@....=.i

C:\Users\user\Downloads\df65232e-24c4-42b8-97c7-5378dc93edce.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	3850845
Entropy (8bit):	7.840419010383623
Encrypted:	false
SSDEEP:	49152:lg/aZL3F0J1exLxsjHQKsiJPGhF1BEahI1RXDKgXyQgX0eFyL2KFY5ImCc+EnCDV:2y98exLxoMiJPkCawDP3Lde5IYCDYcX
MD5:	9FB97A36C5C067B156554517881E68CA
SHA1:	112DED85DCDF24F1622FACE67D5C4674C3B3AF17
SHA-256:	CB406B414C9CB0DD513A4EFACEBD68FB9D36D684944F41C660EEC0ADCF7E6C41
SHA-512:	E619E9C3DEF61667F995A28CF9299EA08659D039AF66923DBB6FDCAC2029C46CC9C38502F1EC9C7BA1FE36010AAA0688473E0987C9A0193D88B09BF33F2B53EB
Malicious:	false
Preview:	%PDF-1.7..4 0 obj.(Identity).endobj.5 0 obj.(Adobe).endobj.8 0 obj.<<./Filter /FlateDecode./Length 33413./Length1 88080./Type /Stream.>>.stream.x..}.@.G.pu..p...(..x.. .x!.x"...2...\..."x...&!QcL..0'..1&...M6..d7.l6.n.$.uM.n.e....g.g........y]].W.^.zU....... #..g...u.J.....w.NY...>..f.!..~vZF....q.03...-[...=....B.w.K^Z.........p...\[...W....yZ.V.C....!..!.........>.....m).VW............+.$dD.!QO..a..k>..@.......$...f..Y@.0hT.J....t...&..tYe..%.MOH......k.V.......r]...................H...!....k..$....4..AWU....24...F^..d....{.?..m.!.~..'z={!g....[.+.(h^tP.eK..@S....."&.........$.+...(.b...[...2...."'....)(.O...H..'.z..K.LM..H..........yC..U...s..q..hK...".2q.?r...Sb.Wy+)s.......v...N.-..l7.<e...w.4...x.x...(...:...x'..../P..s[.d-d.....}.... w..h,.......>...m^Y")%w....A..8.K.....;G..'j.....]..h...H..A.<4.Y..E.k..a./..a..vTF..9(......>3;K.A......}E.z*....l.s-.Cn......_...i....#.Md..^....[Y...e..o..3...qm$..............!'.E.....r.....[!..k..V

C:\Users\user\Downloads\downloaded.pdf (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	3850845
Entropy (8bit):	7.840419010383623
Encrypted:	false
SSDEEP:	49152:lg/aZL3F0J1exLxsjHQKsiJPGhF1BEahI1RXDKgXyQgX0eFyL2KFY5ImCc+EnCDV:2y98exLxoMiJPkCawDP3Lde5IYCDYcX
MD5:	9FB97A36C5C067B156554517881E68CA
SHA1:	112DED85DCDF24F1622FACE67D5C4674C3B3AF17
SHA-256:	CB406B414C9CB0DD513A4EFACEBD68FB9D36D684944F41C660EEC0ADCF7E6C41
SHA-512:	E619E9C3DEF61667F995A28CF9299EA08659D039AF66923DBB6FDCAC2029C46CC9C38502F1EC9C7BA1FE36010AAA0688473E0987C9A0193D88B09BF33F2B53EB
Malicious:	false
Preview:	%PDF-1.7..4 0 obj.(Identity).endobj.5 0 obj.(Adobe).endobj.8 0 obj.<<./Filter /FlateDecode./Length 33413./Length1 88080./Type /Stream.>>.stream.x..}.@.G.pu..p...(..x.. .x!.x"...2...\..."x...&!QcL..0'..1&...M6..d7.l6.n.$.uM.n.e....g.g........y]].W.^.zU....... #..g...u.J.....w.NY...>..f.!..~vZF....q.03...-[...=....B.w.K^Z.........p...\[...W....yZ.V.C....!..!.........>.....m).VW............+.$dD.!QO..a..k>..@.......$...f..Y@.0hT.J....t...&..tYe..%.MOH......k.V.......r]...................H...!....k..$....4..AWU....24...F^..d....{.?..m.!.~..'z={!g....[.+.(h^tP.eK..@S....."&.........$.+...(.b...[...2...."'....)(.O...H..'.z..K.LM..H..........yC..U...s..q..hK...".2q.?r...Sb.Wy+)s.......v...N.-..l7.<e...w.4...x.x...(...:...x'..../P..s[.d-d.....}.... w..h,.......>...m^Y")%w....A..8.K.....;G..'j.....]..h...H..A.<4.Y..E.k..a./..a..vTF..9(......>3;K.A......}E.z*....l.s-.Cn......_...i....#.Md..^....[Y...e..o..3...qm$..............!'.E.....r.....[!..k..V

C:\Users\user\Downloads\downloaded.pdf.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	3850845
Entropy (8bit):	7.840419010383623
Encrypted:	false
SSDEEP:	49152:lg/aZL3F0J1exLxsjHQKsiJPGhF1BEahI1RXDKgXyQgX0eFyL2KFY5ImCc+EnCDV:2y98exLxoMiJPkCawDP3Lde5IYCDYcX
MD5:	9FB97A36C5C067B156554517881E68CA
SHA1:	112DED85DCDF24F1622FACE67D5C4674C3B3AF17
SHA-256:	CB406B414C9CB0DD513A4EFACEBD68FB9D36D684944F41C660EEC0ADCF7E6C41
SHA-512:	E619E9C3DEF61667F995A28CF9299EA08659D039AF66923DBB6FDCAC2029C46CC9C38502F1EC9C7BA1FE36010AAA0688473E0987C9A0193D88B09BF33F2B53EB
Malicious:	false
Preview:	%PDF-1.7..4 0 obj.(Identity).endobj.5 0 obj.(Adobe).endobj.8 0 obj.<<./Filter /FlateDecode./Length 33413./Length1 88080./Type /Stream.>>.stream.x..}.@.G.pu..p...(..x.. .x!.x"...2...\..."x...&!QcL..0'..1&...M6..d7.l6.n.$.uM.n.e....g.g........y]].W.^.zU....... #..g...u.J.....w.NY...>..f.!..~vZF....q.03...-[...=....B.w.K^Z.........p...\[...W....yZ.V.C....!..!.........>.....m).VW............+.$dD.!QO..a..k>..@.......$...f..Y@.0hT.J....t...&..tYe..%.MOH......k.V.......r]...................H...!....k..$....4..AWU....24...F^..d....{.?..m.!.~..'z={!g....[.+.(h^tP.eK..@S....."&.........$.+...(.b...[...2...."'....)(.O...H..'.z..K.LM..H..........yC..U...s..q..hK...".2q.?r...Sb.Wy+)s.......v...N.-..l7.<e...w.4...x.x...(...:...x'..../P..s[.d-d.....}.... w..h,.......>...m^Y")%w....A..8.K.....;G..'j.....]..h...H..A.<4.Y..E.k..a./..a..vTF..9(......>3;K.A......}E.z*....l.s-.Cn......_...i....#.Md..^....[Y...e..o..3...qm$..............!'.E.....r.....[!..k..V

C:\Users\user\Downloads\eebb189e-5f81-45ac-b0d1-27ba176561ed.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	15621
Entropy (8bit):	7.979998335888321
Encrypted:	false
SSDEEP:	384:EQ0qM1roipWKLdcwoiWo7XQvo4IhCQKZbZKoiLjf7RO:EJlYKLdx/LXWoONZKoiLA
MD5:	9BB99CDE75B0BC948247A1ABD7D75EBD
SHA1:	DFF9D3622C41AB2E26B20ACEAC6A16B25AF654A3
SHA-256:	1A9BCAE6CFB8EBC79827CDC012528C56FE60991B115C6BC997F0A4B354816D31
SHA-512:	C28320CBC9308800D2DB7BA02052B7B971499D283A49403CF12650E8575523804DA4A002CE661AD7A6BAED45042537090C4E04967FFE2D90EEB9383F3A79C969
Malicious:	false
Preview:	%PDF-1.7..4 0 obj.(Identity).endobj.5 0 obj.(Adobe).endobj.8 0 obj.<<./Filter /FlateDecode./Length 33413./Length1 88080./Type /Stream.>>.stream.x..}.@.G.pu..p...(..x.. .x!.x"...2...\..."x...&!QcL..0'..1&...M6..d7.l6.n.$.uM.n.e....g.g........y]].W.^.zU....... #..g...u.J.....w.NY...>..f.!..~vZF....q.03...-[...=....B.w.K^Z.........p...\[...W....yZ.V.C....!..!.........>.....m).VW............+.$dD.!QO..a..k>..@.......$...f..Y@.0hT.J....t...&..tYe..%.MOH......k.V.......r]...................H...!....k..$....4..AWU....24...F^..d....{.?..m.!.~..'z={!g....[.+.(h^tP.eK..@S....."&.........$.+...(.b...[...2...."'....)(.O...H..'.z..K.LM..H..........yC..U...s..q..hK...".2q.?r...Sb.Wy+)s.......v...N.-..l7.<e...w.4...x.x...(...:...x'..../P..s[.d-d.....}.... w..h,.......>...m^Y")%w....A..8.K.....;G..'j.....]..h...H..A.<4.Y..E.k..a./..a..vTF..9(......>3;K.A......}E.z*....l.s-.Cn......_...i....#.Md..^....[Y...e..o..3...qm$..............!'.E.....r.....[!..k..V

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.844489769282747
Encrypted:	false
SSDEEP:	192:j1ZhbH9XnZTL61JJG4333F+swljhbURbqz0iixO:j1bH9XZTL03X33VxwljhbURbqz0if
MD5:	3E760B8C9B3653228328C6360BC78DDF
SHA1:	91A7BFC73542BEFAC269AAEACE2B9854650E1761
SHA-256:	65439CEED8B0E8DFED712511F34D8C857C3A46AE249C1EDF01B27DE4C32AE227
SHA-512:	9C0F0E9CBDD878CDD4D11E73710CE9E908B75D9E6C6BED50D3B927FBB3F87B6CF61783968318FA7E11427CB85493E037EA48D92DF4B3640E9D0676BC24FD5E22
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$......................................................................................................gT.&gT..gT..gT..gT..gT.'................................................................................................................................................................gT..gT.>gT..gT..gT..gT..gT..gT..gT.>gT......................................................................................................................................................gT..gT.egT..gT..gT..gT..gT..gT..gT..gT..gT.cgT..............................................................................................................................................gT..gT..gT..gT..gT..gT..gT..gT..gT..gT..gT..gT..gT..gT......................................................................................................................................gT.-gT..gT..gT..gT..gT..gT..gT.3gT.1gT..gT..gT..gT..gT..gT..gT.*..........

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	15086
Entropy (8bit):	2.844489769282747
Encrypted:	false
SSDEEP:	192:j1ZhbH9XnZTL61JJG4333F+swljhbURbqz0iixO:j1bH9XZTL03X33VxwljhbURbqz0if
MD5:	3E760B8C9B3653228328C6360BC78DDF
SHA1:	91A7BFC73542BEFAC269AAEACE2B9854650E1761
SHA-256:	65439CEED8B0E8DFED712511F34D8C857C3A46AE249C1EDF01B27DE4C32AE227
SHA-512:	9C0F0E9CBDD878CDD4D11E73710CE9E908B75D9E6C6BED50D3B927FBB3F87B6CF61783968318FA7E11427CB85493E037EA48D92DF4B3640E9D0676BC24FD5E22
Malicious:	false
URL:	https://resources.finalsite.net/favicon.ico
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$......................................................................................................gT.&gT..gT..gT..gT..gT.'................................................................................................................................................................gT..gT.>gT..gT..gT..gT..gT..gT..gT.>gT......................................................................................................................................................gT..gT.egT..gT..gT..gT..gT..gT..gT..gT..gT.cgT..............................................................................................................................................gT..gT..gT..gT..gT..gT..gT..gT..gT..gT..gT..gT..gT..gT......................................................................................................................................gT.-gT..gT..gT..gT..gT..gT..gT.3gT.1gT..gT..gT..gT..gT..gT..gT.*..........

Chrome Cache Entry: 300

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7
Category:	downloaded
Size (bytes):	3850845
Entropy (8bit):	7.840419010383623
Encrypted:	false
SSDEEP:	49152:lg/aZL3F0J1exLxsjHQKsiJPGhF1BEahI1RXDKgXyQgX0eFyL2KFY5ImCc+EnCDV:2y98exLxoMiJPkCawDP3Lde5IYCDYcX
MD5:	9FB97A36C5C067B156554517881E68CA
SHA1:	112DED85DCDF24F1622FACE67D5C4674C3B3AF17
SHA-256:	CB406B414C9CB0DD513A4EFACEBD68FB9D36D684944F41C660EEC0ADCF7E6C41
SHA-512:	E619E9C3DEF61667F995A28CF9299EA08659D039AF66923DBB6FDCAC2029C46CC9C38502F1EC9C7BA1FE36010AAA0688473E0987C9A0193D88B09BF33F2B53EB
Malicious:	false
URL:	https://resources.finalsite.net/images/v1716560654/lwsdorg/o4vxkncseuoqphvgnvy1/HSDayReport-05-23-2024.pdf
Preview:	%PDF-1.7..4 0 obj.(Identity).endobj.5 0 obj.(Adobe).endobj.8 0 obj.<<./Filter /FlateDecode./Length 33413./Length1 88080./Type /Stream.>>.stream.x..}.@.G.pu..p...(..x.. .x!.x"...2...\..."x...&!QcL..0'..1&...M6..d7.l6.n.$.uM.n.e....g.g........y]].W.^.zU....... #..g...u.J.....w.NY...>..f.!..~vZF....q.03...-[...=....B.w.K^Z.........p...\[...W....yZ.V.C....!..!.........>.....m).VW............+.$dD.!QO..a..k>..@.......$...f..Y@.0hT.J....t...&..tYe..%.MOH......k.V.......r]...................H...!....k..$....4..AWU....24...F^..d....{.?..m.!.~..'z={!g....[.+.(h^tP.eK..@S....."&.........$.+...(.b...[...2...."'....)(.O...H..'.z..K.LM..H..........yC..U...s..q..hK...".2q.?r...Sb.Wy+)s.......v...N.-..l7.<e...w.4...x.x...(...:...x'..../P..s[.d-d.....}.... w..h,.......>...m^Y")%w....A..8.K.....;G..'j.....]..h...H..A.<4.Y..E.k..a./..a..vTF..9(......>3;K.A......}E.z*....l.s-.Cn......_...i....#.Md..^....[Y...e..o..3...qm$..............!'.E.....r.....[!..k..V

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.998317468604181
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	Superintendent Dr.docx
File size:	2'250'547 bytes
MD5:	a0122150b44563db6bb8ef18e3d1d599
SHA1:	72d449df047fffb9989a9d47ffa5acb118034d96
SHA256:	d6e5f4427bf23f651faa35e61ddab70b7d241ac92c584a1f200ca2e7809c6318
SHA512:	1984031d3d03a7b472c34f89f03954040211cdf9dc263546e33a658850574a8d0e7408b7c07a1ea4c23e6fa7dbc66fd61a7258e966a58d8f3e499d55b3fe053b
SSDEEP:	49152:wQzWuWiTUZNTWigcqMloYySRQuX4nX+O6GWj+UKluwSjf7:wj+Q3WigcKluX4n/+Pw+
TLSH:	B9A5338DDCD0F820F428C464B66EF3DEEE970FE9D0A66E8344596A804A4464FA7D1D7C
File Content Preview:	PK..........IJ..0.:...........docProps/app.xml...N.1.._.........1.p....um.0..K{A..\.H... ....]..z.O...>...&;.Q9[.QQR.V8....[l..(.....Y.h....)....<.T.I....-..0.E...".69...c...sM..,.......r.`.`%...........*.......C....d..k.......;%...A...$).`...........K...

File Icon


Icon Hash:	35e5c48caa8a8599

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "Superintendent Dr.docx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 21:01:57.533566952 CET	49675	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:01:57.533587933 CET	49674	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:01:57.674211025 CET	49673	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:01:59.428173065 CET	443	49703	23.1.237.91	192.168.2.5
Oct 28, 2024 21:01:59.428272963 CET	49703	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:03.249038935 CET	49715	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:03.249092102 CET	443	49715	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:03.249222040 CET	49715	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:03.251189947 CET	49715	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:03.251209021 CET	443	49715	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:04.377456903 CET	443	49715	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:04.377535105 CET	49715	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:05.670687914 CET	49715	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:05.670706987 CET	443	49715	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:05.671655893 CET	443	49715	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:05.673264980 CET	49715	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:05.673302889 CET	49715	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:05.673322916 CET	443	49715	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:06.183569908 CET	443	49715	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:06.236686945 CET	49715	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:06.236711025 CET	443	49715	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:06.236908913 CET	49715	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:06.236953020 CET	49715	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:06.237276077 CET	443	49715	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:06.237353086 CET	443	49715	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:06.237436056 CET	49715	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:06.255155087 CET	49718	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:06.255240917 CET	443	49718	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:06.255354881 CET	49718	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:06.255801916 CET	49718	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:06.255835056 CET	443	49718	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:06.325670004 CET	49719	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:06.325704098 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:06.325839043 CET	49719	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:06.326122046 CET	49719	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:06.326138020 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:07.522803068 CET	443	49718	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:07.522905111 CET	49718	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:07.532516956 CET	49718	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:07.532563925 CET	443	49718	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:07.532891989 CET	443	49718	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:07.533320904 CET	49718	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:07.533368111 CET	49718	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:07.533430099 CET	443	49718	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:07.534080982 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:07.534452915 CET	49719	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:07.534468889 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:07.535382032 CET	49719	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:07.535387039 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:07.535453081 CET	49719	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:07.535460949 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:07.953778028 CET	443	49718	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:08.002346992 CET	49718	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:08.002408028 CET	443	49718	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:08.049318075 CET	49718	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:08.079205036 CET	443	49718	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:08.079257011 CET	443	49718	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:08.079355955 CET	49718	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:08.095539093 CET	49718	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:08.095539093 CET	49718	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:08.095583916 CET	443	49718	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:08.095611095 CET	443	49718	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:08.644110918 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:08.644148111 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:08.644208908 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:08.644793034 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:08.644810915 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:08.684685946 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:08.684722900 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:08.684823036 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:08.687339067 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:08.687354088 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.382606030 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.382730007 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.384934902 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.384953022 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.385179043 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.396018982 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.443331957 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.501363039 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.501444101 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.504432917 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.504450083 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.504848003 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.549216986 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.618777037 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.618807077 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.618823051 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.618866920 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.618887901 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.618910074 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.618947983 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.635611057 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.640182972 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.640199900 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.640280962 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.640297890 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.640309095 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.640356064 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.683336973 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.735945940 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.735966921 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.736028910 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.736047029 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.736128092 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.736150026 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.756342888 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.756360054 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.756443977 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.756464958 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.756530046 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.757961988 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.757977962 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.758037090 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.758047104 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.758111000 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.759886980 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.759902954 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.759949923 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.759962082 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.759984970 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.760021925 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.873857975 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.873876095 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.873945951 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.873965025 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.874005079 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.874597073 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.874610901 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.874696016 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.874705076 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.874747038 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.876318932 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.876334906 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.876394033 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.876404047 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.876456976 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.877670050 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.877684116 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.877729893 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.877742052 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:09.877769947 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.877787113 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:09.900301933 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.900352955 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.900373936 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.900424957 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.900430918 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.900459051 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.900465965 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.900477886 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.900482893 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.900532961 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.900532961 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.900921106 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.900985956 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.900999069 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.901365042 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.901427031 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.912472010 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.912497997 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:09.912513018 CET	49724	443	192.168.2.5	20.109.210.53
Oct 28, 2024 21:02:09.912523031 CET	443	49724	20.109.210.53	192.168.2.5
Oct 28, 2024 21:02:10.011665106 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.011682987 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.011740923 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.011761904 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.011781931 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.011811018 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.018201113 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.018217087 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.018276930 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.018290997 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.018343925 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.115554094 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.115571976 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.115633965 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.115652084 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.115681887 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.115700960 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.116405010 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.116456985 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.116461039 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.116502047 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.146126986 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.146147013 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.146198034 CET	49723	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.146205902 CET	443	49723	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.251975060 CET	49726	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.252053976 CET	443	49726	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.252186060 CET	49726	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.256334066 CET	49726	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.256362915 CET	443	49726	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.256956100 CET	49727	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.257086039 CET	443	49727	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.257158041 CET	49727	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.257337093 CET	49727	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.257344007 CET	443	49727	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.258821964 CET	49728	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.258840084 CET	443	49728	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.258999109 CET	49728	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.259135008 CET	49728	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.259171963 CET	443	49728	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.319991112 CET	49729	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.320056915 CET	443	49729	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.320141077 CET	49729	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.321260929 CET	49730	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.321290016 CET	443	49730	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.321387053 CET	49730	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.362425089 CET	49729	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.362471104 CET	443	49729	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.362616062 CET	49730	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.362632036 CET	443	49730	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.988802910 CET	443	49726	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.989773989 CET	49726	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.989824057 CET	443	49726	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:10.990494967 CET	49726	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:10.990509987 CET	443	49726	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.016647100 CET	443	49728	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.017047882 CET	49728	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.017080069 CET	443	49728	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.017524958 CET	49728	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.017532110 CET	443	49728	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.021910906 CET	443	49727	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.023217916 CET	49727	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.023238897 CET	443	49727	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.023709059 CET	49727	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.023714066 CET	443	49727	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.091243029 CET	443	49730	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.091777086 CET	49730	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.091789007 CET	443	49730	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.093414068 CET	49730	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.093425035 CET	443	49730	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.093946934 CET	443	49729	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.094337940 CET	49729	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.094388962 CET	443	49729	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.094724894 CET	49729	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.094738007 CET	443	49729	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.141208887 CET	443	49726	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.141227961 CET	443	49726	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.141268015 CET	443	49726	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.141307116 CET	49726	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.141355991 CET	49726	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.143969059 CET	49726	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.144012928 CET	443	49726	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.144041061 CET	49726	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.144057035 CET	443	49726	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.149662971 CET	49731	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.149708986 CET	443	49731	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.150492907 CET	49731	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.150719881 CET	443	49728	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.150729895 CET	443	49728	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.150768042 CET	443	49728	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.150818110 CET	49728	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.150863886 CET	49728	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.151354074 CET	49731	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.151387930 CET	443	49731	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.151776075 CET	49728	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.151776075 CET	49728	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.151796103 CET	443	49728	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.151807070 CET	443	49728	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.154320955 CET	49732	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.154356956 CET	443	49732	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.154486895 CET	49732	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.154622078 CET	49732	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.154639959 CET	443	49732	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.158860922 CET	443	49727	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.158929110 CET	443	49727	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.159115076 CET	49727	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.159140110 CET	49727	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.159140110 CET	49727	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.159149885 CET	443	49727	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.159158945 CET	443	49727	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.161407948 CET	49733	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.161437035 CET	443	49733	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.161766052 CET	49733	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.161855936 CET	49733	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.161866903 CET	443	49733	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.222073078 CET	443	49730	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.222223997 CET	443	49730	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.222294092 CET	49730	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.222424030 CET	49730	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.222435951 CET	443	49730	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.222441912 CET	49730	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.222449064 CET	443	49730	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.224569082 CET	49734	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.224600077 CET	443	49734	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.224668026 CET	49734	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.224914074 CET	49734	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.224935055 CET	443	49734	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.225594997 CET	443	49729	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.225663900 CET	443	49729	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.225733995 CET	49729	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.225779057 CET	443	49729	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.225816965 CET	443	49729	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.225864887 CET	49729	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.225905895 CET	443	49729	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.225934982 CET	49729	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.225934982 CET	49729	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.225955009 CET	443	49729	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.225975990 CET	443	49729	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.227781057 CET	49735	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.227809906 CET	443	49735	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.227921009 CET	49735	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.228071928 CET	49735	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.228080988 CET	443	49735	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.896331072 CET	443	49732	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.897367954 CET	49732	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.897386074 CET	443	49732	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.898044109 CET	49732	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.898051977 CET	443	49732	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.898576021 CET	443	49733	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.898890018 CET	49733	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.898909092 CET	443	49733	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.899235964 CET	49733	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.899240971 CET	443	49733	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.911339998 CET	443	49731	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.912019014 CET	49731	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.912070990 CET	443	49731	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.912482977 CET	49731	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.912497997 CET	443	49731	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.959604979 CET	443	49734	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.960063934 CET	49734	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.960084915 CET	443	49734	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:11.960418940 CET	49734	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:11.960424900 CET	443	49734	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.011938095 CET	443	49735	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.012434006 CET	49735	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.012447119 CET	443	49735	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.013147116 CET	49735	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.013150930 CET	443	49735	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.029885054 CET	443	49733	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.030147076 CET	443	49733	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.030206919 CET	49733	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.030457020 CET	49733	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.030468941 CET	443	49733	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.030477047 CET	49733	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.030481100 CET	443	49733	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.030581951 CET	443	49732	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.030827999 CET	443	49732	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.031718016 CET	49732	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.031836987 CET	49732	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.031836987 CET	49732	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.031860113 CET	443	49732	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.031873941 CET	443	49732	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.035698891 CET	49736	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.035758972 CET	443	49736	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.035976887 CET	49736	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.036998034 CET	49737	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.037066936 CET	443	49737	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.037144899 CET	49737	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.037343025 CET	49737	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.037364960 CET	443	49737	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.037825108 CET	49736	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.037858009 CET	443	49736	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.049433947 CET	443	49731	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.049774885 CET	443	49731	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.049833059 CET	49731	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.049911022 CET	49731	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.049911022 CET	49731	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.049947977 CET	443	49731	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.049978018 CET	443	49731	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.053462029 CET	49738	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.053493977 CET	443	49738	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.053564072 CET	49738	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.053661108 CET	49738	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.053673983 CET	443	49738	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.090182066 CET	443	49734	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.090322971 CET	443	49734	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.090369940 CET	49734	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.090909004 CET	49734	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.090924978 CET	443	49734	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.099746943 CET	49739	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.099805117 CET	443	49739	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.099952936 CET	49739	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.100586891 CET	49739	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.100610971 CET	443	49739	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.150141001 CET	443	49735	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.150348902 CET	443	49735	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.150413990 CET	49735	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.150491953 CET	49735	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.150501013 CET	443	49735	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.150518894 CET	49735	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.150523901 CET	443	49735	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.152813911 CET	49740	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.152843952 CET	443	49740	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.153531075 CET	49740	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.153640985 CET	49740	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.153654099 CET	443	49740	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.614039898 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:12.614099979 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:12.614142895 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:12.614176035 CET	49719	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:12.614193916 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:12.614216089 CET	49719	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:12.614243031 CET	49719	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:12.614249945 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:12.615430117 CET	49719	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:12.615447044 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:12.615458012 CET	49719	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:12.615776062 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:12.615859032 CET	443	49719	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:12.615921974 CET	49719	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:12.748482943 CET	49741	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:12.748544931 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:12.748641014 CET	49741	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:12.752902031 CET	49741	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:12.752934933 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:12.783548117 CET	443	49736	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.784348011 CET	49736	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.784373999 CET	443	49736	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.784934044 CET	49736	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.784950972 CET	443	49736	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.816617012 CET	443	49737	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.817234993 CET	49737	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.817296028 CET	443	49737	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.818176985 CET	49737	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.818183899 CET	443	49737	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.828397989 CET	443	49738	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.828766108 CET	49738	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.828803062 CET	443	49738	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.829209089 CET	49738	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.829226971 CET	443	49738	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.837785006 CET	443	49739	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.838121891 CET	49739	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.838151932 CET	443	49739	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.838530064 CET	49739	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.838540077 CET	443	49739	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.890434027 CET	443	49740	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.891057014 CET	49740	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.891071081 CET	443	49740	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.891587973 CET	49740	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.891593933 CET	443	49740	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.925266027 CET	443	49736	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.925457001 CET	443	49736	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.925530910 CET	49736	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.925757885 CET	49736	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.925796986 CET	443	49736	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.925823927 CET	49736	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.925843954 CET	443	49736	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.929111004 CET	49742	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.929135084 CET	443	49742	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.929204941 CET	49742	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.929416895 CET	49742	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.929430008 CET	443	49742	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.955240011 CET	443	49737	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.955617905 CET	443	49737	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.955712080 CET	49737	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.955780983 CET	49737	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.955780983 CET	49737	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.955815077 CET	443	49737	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.955843925 CET	443	49737	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.957920074 CET	49743	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.958003044 CET	443	49743	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.958219051 CET	49743	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.958342075 CET	49743	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.958374977 CET	443	49743	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.964936018 CET	443	49738	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.965182066 CET	443	49738	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.965248108 CET	49738	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.965292931 CET	49738	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.965292931 CET	49738	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.965317965 CET	443	49738	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.965339899 CET	443	49738	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.967292070 CET	49744	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.967359066 CET	443	49744	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.967436075 CET	49744	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.967602968 CET	49744	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.967634916 CET	443	49744	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.968703985 CET	443	49739	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.970514059 CET	443	49739	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.970700026 CET	49739	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.970747948 CET	49739	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.970747948 CET	49739	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.970773935 CET	443	49739	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.970799923 CET	443	49739	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.972872972 CET	49745	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.972919941 CET	443	49745	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:12.973057032 CET	49745	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.973196030 CET	49745	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:12.973226070 CET	443	49745	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.027793884 CET	443	49740	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.028039932 CET	443	49740	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.028198004 CET	49740	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.028258085 CET	49740	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.028270006 CET	443	49740	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.028280973 CET	49740	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.028287888 CET	443	49740	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.030365944 CET	49746	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.030388117 CET	443	49746	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.030566931 CET	49746	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.030711889 CET	49746	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.030725956 CET	443	49746	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.668071985 CET	443	49742	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.668637037 CET	49742	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.668651104 CET	443	49742	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.669141054 CET	49742	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.669147968 CET	443	49742	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.693164110 CET	443	49743	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.693831921 CET	49743	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.693878889 CET	443	49743	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.694323063 CET	49743	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.694351912 CET	443	49743	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.695223093 CET	443	49744	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.695475101 CET	49744	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.695514917 CET	443	49744	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.695811987 CET	49744	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.695827007 CET	443	49744	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.712285995 CET	443	49745	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.712676048 CET	49745	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.712704897 CET	443	49745	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.713340044 CET	49745	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.713352919 CET	443	49745	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.780025005 CET	443	49746	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.780900955 CET	49746	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.780915976 CET	443	49746	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.782881975 CET	49746	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.782887936 CET	443	49746	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.797425985 CET	443	49742	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.797637939 CET	443	49742	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.797729969 CET	49742	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.797760010 CET	49742	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.797774076 CET	443	49742	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.797789097 CET	49742	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.797796011 CET	443	49742	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.801021099 CET	49748	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.801090956 CET	443	49748	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.801181078 CET	49748	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.801316023 CET	49748	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.801335096 CET	443	49748	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.822467089 CET	443	49744	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.822670937 CET	443	49744	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.822829008 CET	49744	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.822829008 CET	49744	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.822829008 CET	49744	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.824671984 CET	443	49743	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.824861050 CET	443	49743	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.824973106 CET	49743	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.824989080 CET	49749	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.825010061 CET	443	49749	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.825098991 CET	49743	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.825109959 CET	443	49743	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.825136900 CET	49749	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.825254917 CET	49749	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.825268984 CET	443	49749	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.827771902 CET	49750	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.827785969 CET	443	49750	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.827869892 CET	49750	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.828007936 CET	49750	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.828022003 CET	443	49750	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.843231916 CET	443	49745	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.843425989 CET	443	49745	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.843488932 CET	49745	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.843642950 CET	49745	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.843643904 CET	49745	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.843679905 CET	443	49745	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.843707085 CET	443	49745	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.845599890 CET	49751	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.845613003 CET	443	49751	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.845690012 CET	49751	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.845823050 CET	49751	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.845834970 CET	443	49751	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.875493050 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:13.876395941 CET	49741	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:13.876434088 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:13.880235910 CET	49741	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:13.880247116 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:13.880290985 CET	49741	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:13.880312920 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:13.916198969 CET	443	49746	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.916399002 CET	443	49746	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.916492939 CET	49746	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.916748047 CET	49746	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.916760921 CET	443	49746	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.916774988 CET	49746	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.916780949 CET	443	49746	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.920049906 CET	49752	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.920139074 CET	443	49752	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:13.920247078 CET	49752	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.920429945 CET	49752	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:13.920463085 CET	443	49752	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.049222946 CET	49744	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.049246073 CET	443	49744	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.529123068 CET	443	49748	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.529917002 CET	49748	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.529938936 CET	443	49748	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.530407906 CET	49748	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.530414104 CET	443	49748	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.561131001 CET	443	49749	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.561172962 CET	443	49750	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.561971903 CET	49750	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.561995983 CET	443	49750	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.562051058 CET	49749	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.562078953 CET	443	49749	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.562520027 CET	49750	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.562546015 CET	443	49750	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.562700033 CET	49749	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.562707901 CET	443	49749	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.588457108 CET	443	49751	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.593693972 CET	49751	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.593723059 CET	443	49751	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.594317913 CET	49751	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.594322920 CET	443	49751	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.655143023 CET	443	49752	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.655917883 CET	49752	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.655993938 CET	443	49752	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.656546116 CET	49752	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.656564951 CET	443	49752	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.657917023 CET	443	49748	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.658080101 CET	443	49748	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.658153057 CET	49748	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.658246994 CET	49748	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.658246994 CET	49748	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.658283949 CET	443	49748	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.658309937 CET	443	49748	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.661581993 CET	49753	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.661633968 CET	443	49753	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.661700010 CET	49753	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.661919117 CET	49753	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.661940098 CET	443	49753	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.692270994 CET	443	49750	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.692627907 CET	443	49750	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.692702055 CET	49750	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.692934990 CET	443	49749	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.693139076 CET	443	49749	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.693203926 CET	49749	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.693351984 CET	49750	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.693351984 CET	49750	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.693375111 CET	443	49750	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.693397999 CET	443	49750	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.694866896 CET	49749	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.694878101 CET	443	49749	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.694915056 CET	49749	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.694921017 CET	443	49749	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.697405100 CET	49754	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.697468042 CET	443	49754	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.697542906 CET	49754	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.700268984 CET	49755	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.700289011 CET	443	49755	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.700438976 CET	49755	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.700647116 CET	49754	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.700680017 CET	443	49754	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.700757980 CET	49755	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.700772047 CET	443	49755	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.724438906 CET	443	49751	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.724733114 CET	443	49751	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.724834919 CET	49751	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.733875990 CET	49751	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.733880997 CET	443	49751	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.733890057 CET	49751	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.733895063 CET	443	49751	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.741210938 CET	49756	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.741241932 CET	443	49756	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.741307020 CET	49756	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.741487980 CET	49756	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.741499901 CET	443	49756	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.785813093 CET	443	49752	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.786036968 CET	443	49752	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.786115885 CET	49752	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.787282944 CET	49752	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.787283897 CET	49752	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.787307978 CET	443	49752	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.787344933 CET	443	49752	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.790472031 CET	49779	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.790497065 CET	443	49779	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.790587902 CET	49779	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.790702105 CET	49779	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:14.790725946 CET	443	49779	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:14.879338980 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:14.879405022 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:14.879466057 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:14.879537106 CET	49741	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:14.879554033 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:14.879638910 CET	49741	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:14.880248070 CET	49741	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:14.880254984 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:14.880276918 CET	49741	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:14.880588055 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:14.880681038 CET	443	49741	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:14.880747080 CET	49741	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:14.990377903 CET	49792	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:14.990416050 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:14.990494013 CET	49792	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:14.990662098 CET	49792	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:14.990678072 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:15.409953117 CET	443	49753	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.411956072 CET	49753	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.411979914 CET	443	49753	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.412667990 CET	49753	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.412674904 CET	443	49753	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.432393074 CET	443	49754	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.433288097 CET	49754	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.433289051 CET	49754	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.433331966 CET	443	49754	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.433368921 CET	443	49754	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.433629036 CET	443	49755	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.433917046 CET	49755	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.433940887 CET	443	49755	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.434359074 CET	49755	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.434365988 CET	443	49755	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.509964943 CET	443	49756	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.510392904 CET	49756	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.510420084 CET	443	49756	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.510817051 CET	49756	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.510826111 CET	443	49756	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.528342009 CET	443	49779	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.528892994 CET	49779	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.528944969 CET	443	49779	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.529280901 CET	49779	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.529294968 CET	443	49779	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.543248892 CET	443	49753	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.543390989 CET	443	49753	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.543857098 CET	49753	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.543884993 CET	49753	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.543884993 CET	49753	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.543903112 CET	443	49753	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.543914080 CET	443	49753	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.546730995 CET	49812	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.546776056 CET	443	49812	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.546859026 CET	49812	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.547012091 CET	49812	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.547028065 CET	443	49812	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.562953949 CET	443	49754	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.563472986 CET	443	49754	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.563523054 CET	49754	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.563561916 CET	49754	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.563561916 CET	49754	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.563580990 CET	443	49754	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.563596010 CET	443	49754	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.565956116 CET	49813	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.565984011 CET	443	49813	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.566149950 CET	49813	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.566598892 CET	49813	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.566612959 CET	443	49813	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.571702957 CET	443	49755	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.572561979 CET	443	49755	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.572613955 CET	49755	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.572679043 CET	49755	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.572685957 CET	443	49755	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.572711945 CET	49755	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.572722912 CET	443	49755	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.574986935 CET	49814	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.575021029 CET	443	49814	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.575253963 CET	49814	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.575381994 CET	49814	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.575397968 CET	443	49814	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.643282890 CET	443	49756	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.643565893 CET	443	49756	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.643636942 CET	49756	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.643724918 CET	49756	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.643744946 CET	443	49756	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.643764019 CET	49756	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.643771887 CET	443	49756	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.647492886 CET	49815	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.647520065 CET	443	49815	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.647622108 CET	49815	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.648209095 CET	49815	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.648225069 CET	443	49815	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.658090115 CET	443	49779	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.658293962 CET	443	49779	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.658344984 CET	49779	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.658375978 CET	49779	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.658384085 CET	443	49779	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.658400059 CET	49779	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.658406019 CET	443	49779	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.669847012 CET	49816	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.669873953 CET	443	49816	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:15.669982910 CET	49816	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.670152903 CET	49816	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:15.670167923 CET	443	49816	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.113538980 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.148060083 CET	49792	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:16.148067951 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.150175095 CET	49792	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:16.150178909 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.150197983 CET	49792	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:16.150212049 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.271804094 CET	443	49812	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.301265955 CET	443	49813	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.310700893 CET	443	49814	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.330426931 CET	49812	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.346050024 CET	49813	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.361682892 CET	49814	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.392940044 CET	443	49815	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.394912958 CET	49815	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.394923925 CET	443	49815	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.395490885 CET	49815	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.395504951 CET	443	49815	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.405237913 CET	443	49816	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.406264067 CET	49816	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.406291962 CET	443	49816	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.406727076 CET	49816	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.406738043 CET	443	49816	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.428399086 CET	49812	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.428406954 CET	443	49812	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.428966999 CET	49812	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.428972960 CET	443	49812	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.429286957 CET	49813	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.429294109 CET	443	49813	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.429455042 CET	49814	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.429460049 CET	443	49814	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.429905891 CET	49813	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.429910898 CET	443	49813	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.429972887 CET	49814	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.429977894 CET	443	49814	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.524416924 CET	443	49815	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.524929047 CET	443	49815	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.525340080 CET	49815	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.525473118 CET	49815	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.525487900 CET	443	49815	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.529098988 CET	49817	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.529175997 CET	443	49817	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.529285908 CET	49817	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.529814005 CET	49817	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.529854059 CET	443	49817	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.539676905 CET	443	49816	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.540170908 CET	443	49816	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.540430069 CET	49816	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.540486097 CET	49816	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.540515900 CET	443	49816	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.540544987 CET	49816	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.540559053 CET	443	49816	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.543381929 CET	49818	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.543425083 CET	443	49818	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.543498039 CET	49818	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.543956995 CET	49818	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.543986082 CET	443	49818	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.554953098 CET	443	49812	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.555224895 CET	443	49812	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.555274010 CET	49812	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.555294037 CET	49812	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.555304050 CET	443	49812	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.555329084 CET	49812	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.555335045 CET	443	49812	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.556180954 CET	443	49814	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.556246042 CET	443	49814	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.556420088 CET	49814	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.556540966 CET	49814	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.556540966 CET	49814	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.556549072 CET	443	49814	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.556557894 CET	443	49814	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.558543921 CET	49819	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.558602095 CET	443	49819	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.558970928 CET	49819	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.559097052 CET	49819	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.559132099 CET	443	49819	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.559515953 CET	443	49813	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.559757948 CET	49820	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.559791088 CET	443	49820	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.559864998 CET	49820	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.559967041 CET	49820	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.559976101 CET	443	49820	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.560224056 CET	443	49813	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.561264038 CET	49813	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.561285019 CET	49813	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.561285019 CET	49813	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.561295986 CET	443	49813	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.561307907 CET	443	49813	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.563237906 CET	49821	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.563255072 CET	443	49821	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.563590050 CET	49821	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.564075947 CET	49821	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:16.564086914 CET	443	49821	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:16.719017982 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.719080925 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.719125032 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.719136953 CET	49792	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:16.719141006 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.719165087 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.719172001 CET	49792	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:16.719185114 CET	49792	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:16.719559908 CET	49792	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:16.719569921 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.719583035 CET	49792	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:16.719839096 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.719872952 CET	443	49792	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.720089912 CET	49792	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:16.863677979 CET	49822	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:16.863748074 CET	443	49822	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:16.863929987 CET	49822	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:16.864217997 CET	49822	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:16.864250898 CET	443	49822	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:17.270780087 CET	443	49818	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.270800114 CET	443	49817	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.271483898 CET	49818	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.271485090 CET	49817	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.271506071 CET	443	49817	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.271512032 CET	443	49818	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.272025108 CET	49817	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.272032976 CET	443	49817	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.272136927 CET	49818	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.272145987 CET	443	49818	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.290903091 CET	443	49819	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.294399023 CET	443	49820	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.294650078 CET	49819	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.294673920 CET	443	49819	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.294858932 CET	49820	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.294868946 CET	443	49820	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.295135975 CET	49819	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.295141935 CET	443	49819	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.295336008 CET	49820	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.295341015 CET	443	49820	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.297204971 CET	443	49821	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.297534943 CET	49821	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.297545910 CET	443	49821	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.297944069 CET	49821	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.297949076 CET	443	49821	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.402292013 CET	443	49817	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.402436972 CET	443	49817	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.402546883 CET	49817	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.402843952 CET	49817	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.402857065 CET	443	49817	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.402865887 CET	49817	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.402870893 CET	443	49817	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.407336950 CET	49823	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.407371998 CET	443	49823	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.407488108 CET	49823	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.408224106 CET	49823	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.408243895 CET	443	49823	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.411942005 CET	443	49818	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.412389994 CET	443	49818	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.412446022 CET	49818	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.416393995 CET	49818	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.416409969 CET	443	49818	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.416424990 CET	49818	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.416430950 CET	443	49818	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.421200037 CET	443	49819	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.421336889 CET	443	49819	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.421394110 CET	49819	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.423018932 CET	49819	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.423038960 CET	443	49819	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.423052073 CET	49819	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.423057079 CET	443	49819	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.425318956 CET	443	49820	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.425476074 CET	443	49820	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.425537109 CET	49820	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.426062107 CET	49820	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.426078081 CET	443	49820	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.426091909 CET	49820	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.426098108 CET	443	49820	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.428005934 CET	49824	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.428046942 CET	443	49824	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.428251028 CET	49824	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.428375006 CET	49824	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.428390026 CET	443	49824	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.429433107 CET	443	49821	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.429596901 CET	443	49821	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.429686069 CET	49821	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.432621956 CET	49821	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.432621956 CET	49821	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.432636023 CET	443	49821	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.432646036 CET	443	49821	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.433342934 CET	49825	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.433378935 CET	443	49825	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.433444023 CET	49825	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.433706045 CET	49825	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.433721066 CET	443	49825	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.435125113 CET	49826	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.435164928 CET	443	49826	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.435254097 CET	49826	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.435333967 CET	49827	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.435345888 CET	443	49827	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.435411930 CET	49827	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.435486078 CET	49826	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.435502052 CET	443	49826	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:17.435668945 CET	49827	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:17.435683012 CET	443	49827	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.014450073 CET	443	49822	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.015788078 CET	49822	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.015825033 CET	443	49822	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.016729116 CET	49822	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.016741991 CET	443	49822	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.016813040 CET	49822	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.016829014 CET	443	49822	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.147756100 CET	443	49823	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.148463964 CET	49823	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.148483992 CET	443	49823	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.148976088 CET	49823	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.148981094 CET	443	49823	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.174588919 CET	443	49824	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.174947977 CET	49824	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.174967051 CET	443	49824	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.175309896 CET	49824	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.175335884 CET	443	49824	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.177623034 CET	443	49827	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.177867889 CET	49827	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.177877903 CET	443	49827	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.178200006 CET	49827	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.178208113 CET	443	49827	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.181541920 CET	443	49825	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.181792021 CET	49825	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.181803942 CET	443	49825	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.182110071 CET	49825	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.182113886 CET	443	49825	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.201816082 CET	443	49826	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.202111006 CET	49826	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.202126026 CET	443	49826	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.202429056 CET	49826	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.202439070 CET	443	49826	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.276177883 CET	443	49823	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.276711941 CET	443	49823	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.276787043 CET	49823	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.276809931 CET	49823	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.276822090 CET	443	49823	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.276830912 CET	49823	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.276835918 CET	443	49823	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.280169010 CET	49828	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.280201912 CET	443	49828	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.280314922 CET	49828	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.280447960 CET	49828	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.280456066 CET	443	49828	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.313416958 CET	443	49824	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.313493013 CET	443	49824	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.313611984 CET	49824	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.313657999 CET	49824	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.313658953 CET	49824	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.313690901 CET	443	49824	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.313714027 CET	443	49824	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.315041065 CET	443	49827	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.315234900 CET	443	49827	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.315761089 CET	49829	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.315793037 CET	443	49829	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.315866947 CET	49827	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.315920115 CET	49827	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.315920115 CET	49827	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.315933943 CET	443	49827	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.315942049 CET	443	49827	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.315959930 CET	49829	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.316065073 CET	49829	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.316081047 CET	443	49829	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.317838907 CET	49830	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.317851067 CET	443	49830	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.317986012 CET	49830	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.318136930 CET	49830	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.318149090 CET	443	49830	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.324950933 CET	443	49825	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.325021982 CET	443	49825	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.325119019 CET	49825	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.325150967 CET	49825	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.325150967 CET	49825	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.325155973 CET	443	49825	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.325161934 CET	443	49825	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.327061892 CET	49831	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.327073097 CET	443	49831	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.327150106 CET	49831	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.327286959 CET	49831	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.327296972 CET	443	49831	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.338769913 CET	443	49826	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.338983059 CET	443	49826	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.339039087 CET	49826	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.339082003 CET	49826	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.339082956 CET	49826	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.339102983 CET	443	49826	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.339128017 CET	443	49826	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.340990067 CET	49832	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.341046095 CET	443	49832	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.341116905 CET	49832	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.341228008 CET	49832	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:18.341257095 CET	443	49832	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:18.431500912 CET	443	49822	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.431555986 CET	443	49822	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.431844950 CET	49822	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.431863070 CET	443	49822	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.432132959 CET	49822	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.432132959 CET	49822	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.432164907 CET	443	49822	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.432470083 CET	443	49822	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.432570934 CET	443	49822	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.433264017 CET	49822	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.448457003 CET	49833	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.448486090 CET	443	49833	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.448553085 CET	49833	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.449019909 CET	49833	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.449028969 CET	443	49833	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.455836058 CET	49834	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.455887079 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:18.455969095 CET	49834	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.456120968 CET	49834	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:18.456150055 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.029982090 CET	443	49828	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.030586958 CET	49828	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.030596972 CET	443	49828	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.031109095 CET	49828	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.031114101 CET	443	49828	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.065538883 CET	443	49830	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.066966057 CET	443	49829	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.077974081 CET	443	49832	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.080558062 CET	443	49831	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.088709116 CET	49831	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.088720083 CET	443	49831	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.089343071 CET	49831	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.089348078 CET	443	49831	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.091622114 CET	49830	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.091651917 CET	443	49830	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.091975927 CET	49830	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.091998100 CET	443	49830	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.098936081 CET	49829	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.098968983 CET	443	49829	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.099268913 CET	49829	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.099277020 CET	443	49829	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.099476099 CET	49832	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.099493980 CET	443	49832	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.099812984 CET	49832	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.099818945 CET	443	49832	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.164848089 CET	443	49828	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.165000916 CET	443	49828	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.165080070 CET	49828	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.165560961 CET	49828	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.165585995 CET	443	49828	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.165600061 CET	49828	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.165607929 CET	443	49828	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.169418097 CET	49835	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.169446945 CET	443	49835	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.169585943 CET	49835	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.170942068 CET	49835	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.170955896 CET	443	49835	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.221065998 CET	443	49830	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.221134901 CET	443	49830	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.221209049 CET	49830	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.222073078 CET	49830	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.222094059 CET	443	49830	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.222110987 CET	49830	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.222119093 CET	443	49830	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.223510981 CET	443	49831	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.223625898 CET	443	49831	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.223680019 CET	49831	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.229476929 CET	443	49832	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.229557037 CET	443	49832	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.231616974 CET	49832	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.232040882 CET	49832	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.232058048 CET	443	49832	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.232075930 CET	49832	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.232084036 CET	443	49832	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.235217094 CET	443	49829	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.235790014 CET	443	49829	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.236233950 CET	49829	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.237087011 CET	49829	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.237101078 CET	443	49829	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.237111092 CET	49829	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.237116098 CET	443	49829	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.243488073 CET	49831	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.243494987 CET	443	49831	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.243503094 CET	49831	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.243506908 CET	443	49831	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.342900991 CET	49836	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.342935085 CET	443	49836	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.343045950 CET	49836	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.345136881 CET	49837	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.345182896 CET	443	49837	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.345304012 CET	49837	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.348788977 CET	49838	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.348798037 CET	443	49838	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.351874113 CET	49838	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.354207039 CET	49836	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.354218960 CET	443	49836	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.500456095 CET	49837	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.500475883 CET	443	49837	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.501749992 CET	49839	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.501773119 CET	443	49839	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.501866102 CET	49839	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.502271891 CET	49839	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.502280951 CET	443	49839	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.538266897 CET	49838	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.538285017 CET	443	49838	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.557718992 CET	443	49833	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.557790041 CET	49833	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:19.609611988 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.610640049 CET	49833	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:19.610649109 CET	443	49833	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.611001015 CET	443	49833	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.612344980 CET	49833	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:19.612442017 CET	49833	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:19.612454891 CET	443	49833	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.617523909 CET	49834	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:19.617542982 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.619004965 CET	49834	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:19.619012117 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.619215965 CET	49834	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:19.619226933 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.921850920 CET	443	49835	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.922486067 CET	49835	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.922516108 CET	443	49835	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.922997952 CET	49835	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:19.923006058 CET	443	49835	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:19.959479094 CET	443	49833	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.959506989 CET	443	49833	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.959551096 CET	49833	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:19.959574938 CET	443	49833	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.960098028 CET	49833	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:19.960114956 CET	49833	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:19.960299969 CET	443	49833	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.960340977 CET	443	49833	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:19.960395098 CET	49833	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:20.057663918 CET	443	49835	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.057744980 CET	443	49835	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.058057070 CET	49835	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.058057070 CET	49835	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.058057070 CET	49835	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.061233997 CET	49840	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.061270952 CET	443	49840	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.061346054 CET	49840	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.061517954 CET	49840	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.061532021 CET	443	49840	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.108453035 CET	443	49836	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.112633944 CET	49836	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.112651110 CET	443	49836	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.113223076 CET	49836	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.113230944 CET	443	49836	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.233478069 CET	443	49837	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.233881950 CET	443	49839	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.234019995 CET	49837	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.234047890 CET	443	49837	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.234333992 CET	49839	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.234344006 CET	443	49839	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.234483957 CET	49837	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.234488964 CET	443	49837	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.234765053 CET	49839	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.234770060 CET	443	49839	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.243837118 CET	443	49836	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.244111061 CET	443	49836	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.244179010 CET	49836	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.244400024 CET	49836	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.244415998 CET	443	49836	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.244441986 CET	49836	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.244446993 CET	443	49836	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.247633934 CET	49841	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.247668028 CET	443	49841	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.247757912 CET	49841	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.247920036 CET	49841	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.247934103 CET	443	49841	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.289026022 CET	443	49838	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.289592981 CET	49838	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.289603949 CET	443	49838	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.290074110 CET	49838	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.290077925 CET	443	49838	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.361695051 CET	49835	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.361730099 CET	443	49835	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.365480900 CET	443	49837	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.365566015 CET	443	49837	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.365775108 CET	49837	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.365813017 CET	49837	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.365828991 CET	443	49837	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.365839005 CET	49837	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.365844965 CET	443	49837	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.367908001 CET	443	49839	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.368027925 CET	443	49839	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.368124008 CET	49839	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.368247986 CET	49839	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.368253946 CET	443	49839	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.368262053 CET	49839	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.368264914 CET	443	49839	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.369663000 CET	49842	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.369689941 CET	443	49842	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.369784117 CET	49842	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.369910002 CET	49842	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.369915009 CET	443	49842	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.370748997 CET	49843	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.370779991 CET	443	49843	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.370853901 CET	49843	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.370999098 CET	49843	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.371011972 CET	443	49843	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.450316906 CET	443	49838	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.450534105 CET	443	49838	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.450656891 CET	49838	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.450699091 CET	49838	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.450710058 CET	443	49838	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.450723886 CET	49838	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.450728893 CET	443	49838	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.453896999 CET	49844	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.453936100 CET	443	49844	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.454013109 CET	49844	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.454169035 CET	49844	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.454183102 CET	443	49844	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.679666042 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:20.679689884 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:20.679728031 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:20.679749012 CET	49834	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:20.679758072 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:20.679784060 CET	49834	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:20.680326939 CET	49834	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:20.680335999 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:20.680376053 CET	49834	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:20.680479050 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:20.680521011 CET	443	49834	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:20.680742979 CET	49834	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:20.731864929 CET	49845	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:20.731919050 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:20.732003927 CET	49845	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:20.732230902 CET	49845	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:20.732247114 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:20.809392929 CET	443	49840	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.810504913 CET	49840	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.810528040 CET	443	49840	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.811014891 CET	49840	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.811027050 CET	443	49840	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.944041967 CET	443	49840	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.944180012 CET	443	49840	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.944365025 CET	49840	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.944438934 CET	49840	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.944438934 CET	49840	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.944475889 CET	443	49840	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.944506884 CET	443	49840	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.947494984 CET	49846	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.947539091 CET	443	49846	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.947614908 CET	49846	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.947798014 CET	49846	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.947818995 CET	443	49846	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.996360064 CET	443	49841	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.996886015 CET	49841	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.996944904 CET	443	49841	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:20.997394085 CET	49841	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:20.997416973 CET	443	49841	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.095274925 CET	443	49843	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.095977068 CET	49843	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.095995903 CET	443	49843	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.096604109 CET	49843	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.096609116 CET	443	49843	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.113838911 CET	443	49842	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.114496946 CET	49842	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.114511967 CET	443	49842	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.114969969 CET	49842	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.114974976 CET	443	49842	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.144097090 CET	443	49841	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.144354105 CET	443	49841	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.144432068 CET	49841	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.144608974 CET	49841	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.144618034 CET	443	49841	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.144648075 CET	49841	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.144653082 CET	443	49841	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.147861958 CET	49847	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.147891998 CET	443	49847	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.147958040 CET	49847	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.148135900 CET	49847	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.148148060 CET	443	49847	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.197376966 CET	443	49844	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.197993040 CET	49844	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.198014021 CET	443	49844	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.198509932 CET	49844	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.198514938 CET	443	49844	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.225312948 CET	443	49843	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.225474119 CET	443	49843	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.225617886 CET	49843	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.225658894 CET	49843	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.225658894 CET	49843	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.225682020 CET	443	49843	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.225697041 CET	443	49843	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.228815079 CET	49848	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.228842020 CET	443	49848	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.229012966 CET	49848	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.229136944 CET	49848	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.229151964 CET	443	49848	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.249742031 CET	443	49842	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.249892950 CET	443	49842	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.249984980 CET	49842	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.250154972 CET	49842	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.250200987 CET	443	49842	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.250231028 CET	49842	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.250247955 CET	443	49842	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.253835917 CET	49849	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.253880978 CET	443	49849	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.254785061 CET	49849	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.254946947 CET	49849	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.254961967 CET	443	49849	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.328949928 CET	443	49844	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.329021931 CET	443	49844	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.329082966 CET	49844	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.329349041 CET	49844	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.329360962 CET	443	49844	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.329385042 CET	49844	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.329390049 CET	443	49844	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.333134890 CET	49850	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.333158016 CET	443	49850	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.333292007 CET	49850	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.333446026 CET	49850	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.333457947 CET	443	49850	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.816909075 CET	443	49846	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.817950964 CET	49846	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.817965031 CET	443	49846	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.818625927 CET	49846	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.818629026 CET	443	49846	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.890482903 CET	443	49847	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.891081095 CET	49847	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.891088963 CET	443	49847	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.891660929 CET	49847	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.891664982 CET	443	49847	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.935252905 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:21.939532995 CET	49845	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:21.939542055 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:21.941112041 CET	49845	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:21.941118956 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:21.941162109 CET	49845	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:21.941173077 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:21.946229935 CET	443	49846	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.946460962 CET	443	49846	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.946589947 CET	49846	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.946620941 CET	49846	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.946640015 CET	443	49846	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.946651936 CET	49846	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.946657896 CET	443	49846	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.950285912 CET	49851	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.950373888 CET	443	49851	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.950465918 CET	49851	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.950659037 CET	49851	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.950692892 CET	443	49851	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.975802898 CET	443	49848	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.976300955 CET	49848	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.976310015 CET	443	49848	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.976958990 CET	49848	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.976964951 CET	443	49848	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.992644072 CET	443	49849	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.993093967 CET	49849	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.993155956 CET	443	49849	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:21.993596077 CET	49849	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:21.993611097 CET	443	49849	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.022932053 CET	443	49847	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.023147106 CET	443	49847	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.023200035 CET	49847	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.023251057 CET	49847	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.023251057 CET	49847	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.023286104 CET	443	49847	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.023308992 CET	443	49847	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.026477098 CET	49852	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.026511908 CET	443	49852	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.026599884 CET	49852	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.026751041 CET	49852	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.026765108 CET	443	49852	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.060782909 CET	443	49850	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.061716080 CET	49850	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.061727047 CET	443	49850	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.062299967 CET	49850	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.062305927 CET	443	49850	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.110901117 CET	443	49848	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.111439943 CET	443	49848	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.111541033 CET	49848	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.111541033 CET	49848	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.111577988 CET	49848	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.111598015 CET	443	49848	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.115080118 CET	49853	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.115129948 CET	443	49853	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.115214109 CET	49853	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.115364075 CET	49853	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.115380049 CET	443	49853	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.150624990 CET	443	49849	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.150778055 CET	443	49849	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.150867939 CET	49849	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.151141882 CET	49849	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.151141882 CET	49849	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.151184082 CET	443	49849	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.151209116 CET	443	49849	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.154156923 CET	49854	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.154191017 CET	443	49854	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.154334068 CET	49854	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.154455900 CET	49854	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.154470921 CET	443	49854	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.192502975 CET	443	49850	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.192965984 CET	443	49850	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.193018913 CET	49850	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.193083048 CET	49850	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.193098068 CET	443	49850	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.193124056 CET	49850	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.193130970 CET	443	49850	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.196279049 CET	49855	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.196326017 CET	443	49855	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.196439028 CET	49855	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.196613073 CET	49855	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.196631908 CET	443	49855	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.362612009 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:22.362679005 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:22.362739086 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:22.362747908 CET	49845	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:22.362791061 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:22.362803936 CET	49845	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:22.363241911 CET	49845	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:22.363256931 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:22.363286972 CET	49845	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:22.363612890 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:22.363698006 CET	443	49845	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:22.363759995 CET	49845	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:22.418164015 CET	49856	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:22.418224096 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:22.418328047 CET	49856	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:22.418536901 CET	49856	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:22.418564081 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:22.690732002 CET	443	49851	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.691438913 CET	49851	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.691473007 CET	443	49851	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.691941023 CET	49851	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.691952944 CET	443	49851	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.763413906 CET	443	49852	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.764133930 CET	49852	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.764142036 CET	443	49852	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.764651060 CET	49852	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.764655113 CET	443	49852	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.821185112 CET	443	49851	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.821341038 CET	443	49851	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.821424961 CET	49851	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.821609974 CET	49851	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.821647882 CET	443	49851	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.821675062 CET	49851	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.821697950 CET	443	49851	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.825551033 CET	49857	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.825582981 CET	443	49857	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.825660944 CET	49857	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.826076984 CET	49857	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.826091051 CET	443	49857	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.865823984 CET	443	49853	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.866414070 CET	49853	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.866425037 CET	443	49853	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.867080927 CET	49853	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.867085934 CET	443	49853	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.894958019 CET	443	49852	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.895030022 CET	443	49852	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.895237923 CET	49852	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.895284891 CET	49852	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.895296097 CET	443	49852	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.895304918 CET	49852	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.895309925 CET	443	49852	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.898936987 CET	49858	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.898976088 CET	443	49858	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.899065018 CET	49858	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.899231911 CET	49858	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.899246931 CET	443	49858	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.925730944 CET	443	49854	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.927753925 CET	49854	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.927763939 CET	443	49854	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.928442955 CET	49854	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.928447962 CET	443	49854	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.939910889 CET	443	49855	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.942244053 CET	49855	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.942257881 CET	443	49855	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:22.942728043 CET	49855	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:22.942733049 CET	443	49855	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.019906044 CET	443	49853	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.020123959 CET	443	49853	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.020219088 CET	49853	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.020284891 CET	49853	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.020304918 CET	443	49853	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.020318031 CET	49853	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.020327091 CET	443	49853	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.023672104 CET	49859	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.023703098 CET	443	49859	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.023766994 CET	49859	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.023932934 CET	49859	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.023947954 CET	443	49859	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.062536001 CET	443	49854	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.063095093 CET	443	49854	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.063158989 CET	49854	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.063190937 CET	49854	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.063199043 CET	443	49854	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.063208103 CET	49854	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.063213110 CET	443	49854	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.065843105 CET	49860	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.065902948 CET	443	49860	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.066006899 CET	49860	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.066162109 CET	49860	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.066179037 CET	443	49860	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.077846050 CET	443	49855	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.078478098 CET	443	49855	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.078541040 CET	49855	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.078582048 CET	49855	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.078583002 CET	49855	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.078600883 CET	443	49855	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.078612089 CET	443	49855	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.081087112 CET	49861	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.081134081 CET	443	49861	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.081289053 CET	49861	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.081394911 CET	49861	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.081407070 CET	443	49861	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.541528940 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:23.544358015 CET	49856	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:23.544373035 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:23.545128107 CET	49856	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:23.545133114 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:23.545171022 CET	49856	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:23.545182943 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:23.612421036 CET	443	49857	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.613759995 CET	49857	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.613790035 CET	443	49857	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.614986897 CET	49857	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.614995003 CET	443	49857	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.648186922 CET	443	49858	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.656914949 CET	49858	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.656946898 CET	443	49858	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.658055067 CET	49858	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.658071041 CET	443	49858	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.750514030 CET	443	49857	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.750827074 CET	443	49857	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.750900984 CET	49857	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.750960112 CET	49857	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.750978947 CET	443	49857	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.750994921 CET	49857	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.751002073 CET	443	49857	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.754972935 CET	49862	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.755003929 CET	443	49862	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.755285978 CET	49862	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.755480051 CET	49862	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.755496979 CET	443	49862	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.773430109 CET	443	49859	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.774070024 CET	49859	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.774085045 CET	443	49859	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.774693012 CET	49859	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.774699926 CET	443	49859	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.787137032 CET	443	49858	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.788187981 CET	443	49858	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.788295031 CET	49858	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.788358927 CET	49858	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.788358927 CET	49858	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.788402081 CET	443	49858	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.788441896 CET	443	49858	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.791403055 CET	49863	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.791445971 CET	443	49863	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.791645050 CET	49863	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.791645050 CET	49863	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.791680098 CET	443	49863	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.799171925 CET	443	49860	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.799714088 CET	49860	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.799734116 CET	443	49860	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.800278902 CET	49860	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.800291061 CET	443	49860	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.818300009 CET	443	49861	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.818711042 CET	49861	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.818737030 CET	443	49861	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.819220066 CET	49861	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.819226027 CET	443	49861	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.906466961 CET	443	49859	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.906883001 CET	443	49859	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.906933069 CET	49859	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.907038927 CET	49859	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.907062054 CET	443	49859	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.907074928 CET	49859	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.907083035 CET	443	49859	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.910738945 CET	49864	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.910801888 CET	443	49864	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.910900116 CET	49864	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.911065102 CET	49864	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.911087036 CET	443	49864	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.928924084 CET	443	49860	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.929404020 CET	443	49860	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.929480076 CET	49860	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.929521084 CET	49860	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.929553032 CET	443	49860	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.929580927 CET	49860	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.929598093 CET	443	49860	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.933142900 CET	49865	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.933167934 CET	443	49865	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.933290005 CET	49865	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.933485985 CET	49865	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.933495045 CET	443	49865	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.950519085 CET	443	49861	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.951459885 CET	443	49861	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.951575041 CET	49861	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.951575041 CET	49861	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.951610088 CET	49861	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.951632023 CET	443	49861	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.955179930 CET	49866	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.955234051 CET	443	49866	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.955327034 CET	49866	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.957114935 CET	49866	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:23.957149029 CET	443	49866	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:23.977826118 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:23.977855921 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:23.977905989 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:23.977950096 CET	49856	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:23.977967024 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:23.977999926 CET	49856	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:23.978480101 CET	49856	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:23.978480101 CET	49856	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:23.978511095 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:23.978672028 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:23.978709936 CET	443	49856	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:23.979862928 CET	49856	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:24.058538914 CET	49867	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:24.058579922 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:24.058665037 CET	49867	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:24.058964014 CET	49867	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:24.058980942 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:24.516885042 CET	443	49862	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.518459082 CET	49862	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.518481970 CET	443	49862	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.519097090 CET	49862	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.519109964 CET	443	49862	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.531721115 CET	443	49863	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.532388926 CET	49863	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.532422066 CET	443	49863	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.533036947 CET	49863	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.533049107 CET	443	49863	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.647473097 CET	443	49862	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.647512913 CET	443	49862	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.647576094 CET	49862	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.647609949 CET	443	49862	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.647660971 CET	443	49862	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.647739887 CET	49862	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.647910118 CET	49862	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.647932053 CET	443	49862	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.647947073 CET	49862	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.647953987 CET	443	49862	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.652045012 CET	49868	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.652081013 CET	443	49868	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.652148008 CET	49868	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.652332067 CET	49868	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.652343988 CET	443	49868	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.663291931 CET	443	49864	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.663813114 CET	49864	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.663831949 CET	443	49864	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.664077997 CET	443	49863	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.664144993 CET	443	49863	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.664282084 CET	49863	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.664477110 CET	49863	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.664477110 CET	49863	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.664499044 CET	443	49863	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.664513111 CET	443	49863	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.664561033 CET	49864	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.664571047 CET	443	49864	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.668015957 CET	49869	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.668047905 CET	443	49869	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.668112993 CET	49869	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.668275118 CET	49869	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.668284893 CET	443	49869	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.683082104 CET	443	49866	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.683955908 CET	49866	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.683985949 CET	443	49866	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.685039997 CET	49866	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.685054064 CET	443	49866	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.776221991 CET	443	49865	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.777230024 CET	49865	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.777245998 CET	443	49865	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.778173923 CET	49865	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.778178930 CET	443	49865	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.904319048 CET	443	49864	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.904458046 CET	443	49864	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.904587984 CET	49864	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.904756069 CET	49864	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.904788017 CET	443	49864	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.904818058 CET	49864	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.904831886 CET	443	49864	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.906395912 CET	443	49866	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.906421900 CET	443	49866	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.906470060 CET	443	49866	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.906548023 CET	49866	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.906970024 CET	49866	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.906992912 CET	443	49866	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.907037020 CET	49866	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.907048941 CET	443	49866	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.910665035 CET	49870	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.910692930 CET	443	49870	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.910800934 CET	49870	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.912039042 CET	49870	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.912050009 CET	443	49870	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.913463116 CET	49871	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.913489103 CET	443	49871	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:24.913613081 CET	49871	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.913775921 CET	49871	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:24.913791895 CET	443	49871	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.027385950 CET	443	49865	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.027520895 CET	443	49865	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.027693033 CET	443	49865	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.027769089 CET	49865	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.031263113 CET	49865	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.031277895 CET	443	49865	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.031287909 CET	49865	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.031294107 CET	443	49865	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.035401106 CET	49872	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.035418987 CET	443	49872	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.035515070 CET	49872	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.035787106 CET	49872	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.035797119 CET	443	49872	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.167391062 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:25.168127060 CET	49867	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:25.168139935 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:25.169167995 CET	49867	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:25.169174910 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:25.169226885 CET	49867	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:25.169235945 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:25.399738073 CET	443	49868	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.400603056 CET	49868	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.400636911 CET	443	49868	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.401303053 CET	49868	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.401315928 CET	443	49868	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.409450054 CET	443	49869	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.409940004 CET	49869	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.409965992 CET	443	49869	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.410475016 CET	49869	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.410481930 CET	443	49869	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.531939983 CET	443	49868	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.531963110 CET	443	49868	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.532025099 CET	49868	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.532026052 CET	443	49868	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.532083035 CET	49868	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.532603025 CET	49868	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.532603025 CET	49868	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.532639027 CET	443	49868	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.532679081 CET	443	49868	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.536408901 CET	49873	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.536473036 CET	443	49873	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.536581039 CET	49873	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.536815882 CET	49873	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.536843061 CET	443	49873	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.544083118 CET	443	49869	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.544156075 CET	443	49869	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.544286966 CET	49869	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.544559002 CET	49869	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.544576883 CET	443	49869	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.544593096 CET	49869	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.544599056 CET	443	49869	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.547816038 CET	49874	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.547837019 CET	443	49874	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.547905922 CET	49874	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.548067093 CET	49874	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.548079014 CET	443	49874	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.554857969 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:25.554913044 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:25.554984093 CET	49867	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:25.554987907 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:25.555035114 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:25.555051088 CET	49867	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:25.555474043 CET	49867	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:25.555485010 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:25.555499077 CET	49867	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:25.555773020 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:25.555855036 CET	443	49867	40.126.32.74	192.168.2.5
Oct 28, 2024 21:02:25.555897951 CET	49867	443	192.168.2.5	40.126.32.74
Oct 28, 2024 21:02:25.646306992 CET	443	49870	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.647089958 CET	49870	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.647119045 CET	443	49870	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.647732973 CET	49870	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.647739887 CET	443	49870	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.666538954 CET	443	49871	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.667419910 CET	49871	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.667447090 CET	443	49871	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.668164968 CET	49871	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.668180943 CET	443	49871	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.777537107 CET	443	49870	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.777582884 CET	443	49870	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.777798891 CET	49870	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.778064966 CET	49870	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.778083086 CET	443	49870	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.778095007 CET	49870	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.778100967 CET	443	49870	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.781157017 CET	49875	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.781255007 CET	443	49875	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.783030987 CET	49875	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.783375025 CET	49875	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.783417940 CET	443	49875	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.797292948 CET	443	49871	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.797616005 CET	443	49871	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.797688961 CET	49871	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.797790051 CET	49871	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.797802925 CET	443	49871	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.797820091 CET	49871	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.797825098 CET	443	49871	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.801265001 CET	49876	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.801285028 CET	443	49876	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.801352978 CET	49876	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.801786900 CET	49876	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.801800966 CET	443	49876	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.813407898 CET	443	49872	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.813787937 CET	49872	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.813798904 CET	443	49872	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.814332008 CET	49872	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.814337015 CET	443	49872	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.952694893 CET	443	49872	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.952852964 CET	443	49872	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.952943087 CET	49872	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.953223944 CET	49872	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.953233004 CET	443	49872	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.953310966 CET	49872	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.953315973 CET	443	49872	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.960225105 CET	49877	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.960253000 CET	443	49877	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:25.960316896 CET	49877	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.960786104 CET	49877	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:25.960799932 CET	443	49877	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.277899981 CET	443	49874	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.288871050 CET	443	49873	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.312560081 CET	49874	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.312571049 CET	443	49874	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.313074112 CET	49874	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.313079119 CET	443	49874	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.315587044 CET	49873	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.315614939 CET	443	49873	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.316031933 CET	49873	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.316037893 CET	443	49873	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.438030005 CET	443	49874	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.438112974 CET	443	49874	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.438338041 CET	49874	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.438376904 CET	49874	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.438385963 CET	443	49874	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.438396931 CET	49874	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.438401937 CET	443	49874	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.441608906 CET	49878	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.441648006 CET	443	49878	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.441848993 CET	49878	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.442090988 CET	49878	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.442101955 CET	443	49878	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.445219994 CET	443	49873	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.445292950 CET	443	49873	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.445399046 CET	49873	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.445539951 CET	49873	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.445540905 CET	49873	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.445574999 CET	443	49873	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.445602894 CET	443	49873	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.448124886 CET	49879	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.448160887 CET	443	49879	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.448239088 CET	49879	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.448379040 CET	49879	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.448394060 CET	443	49879	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.507157087 CET	443	49875	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.507716894 CET	49875	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.507776976 CET	443	49875	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.508230925 CET	49875	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.508244991 CET	443	49875	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.551604986 CET	443	49876	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.552270889 CET	49876	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.552287102 CET	443	49876	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.552761078 CET	49876	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.552766085 CET	443	49876	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.637032032 CET	443	49875	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.637392044 CET	443	49875	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.637470961 CET	49875	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.637589931 CET	49875	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.637590885 CET	49875	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.637629032 CET	443	49875	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.637655973 CET	443	49875	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.640635967 CET	49880	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.640666962 CET	443	49880	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.640940905 CET	49880	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.641093969 CET	49880	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.641108990 CET	443	49880	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.683892012 CET	443	49876	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.684067965 CET	443	49876	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.684134007 CET	49876	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.684279919 CET	49876	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.684295893 CET	443	49876	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.684310913 CET	49876	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.684317112 CET	443	49876	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.687910080 CET	49881	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.687925100 CET	443	49881	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.688114882 CET	49881	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.688333988 CET	49881	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.688344002 CET	443	49881	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.699974060 CET	443	49877	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.700472116 CET	49877	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.700512886 CET	443	49877	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.701107025 CET	49877	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.701117992 CET	443	49877	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.831712008 CET	443	49877	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.832036018 CET	443	49877	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.835351944 CET	49877	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.835453987 CET	49877	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.835477114 CET	443	49877	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.835494041 CET	49877	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.835503101 CET	443	49877	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.838449955 CET	49882	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.838494062 CET	443	49882	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:26.838593960 CET	49882	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.838736057 CET	49882	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:26.838749886 CET	443	49882	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.184335947 CET	443	49879	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.185029030 CET	49879	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.185049057 CET	443	49879	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.185573101 CET	49879	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.185585022 CET	443	49879	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.191807032 CET	443	49878	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.194525003 CET	49878	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.194533110 CET	443	49878	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.194991112 CET	49878	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.194994926 CET	443	49878	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.321044922 CET	443	49879	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.321116924 CET	443	49879	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.321252108 CET	443	49879	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.321335077 CET	49879	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.321455956 CET	49879	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.321496010 CET	443	49879	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.321521997 CET	49879	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.321540117 CET	443	49879	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.325103998 CET	49883	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.325149059 CET	443	49883	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.325227022 CET	49883	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.325404882 CET	49883	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.325416088 CET	443	49883	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.329785109 CET	443	49878	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.329865932 CET	443	49878	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.330037117 CET	49878	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.330054998 CET	49878	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.330073118 CET	443	49878	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.330086946 CET	49878	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.330091953 CET	443	49878	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.332962036 CET	49884	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.332993984 CET	443	49884	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.333139896 CET	49884	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.333273888 CET	49884	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.333286047 CET	443	49884	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.414484978 CET	443	49880	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.416526079 CET	49880	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.416538000 CET	443	49880	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.417027950 CET	49880	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.417033911 CET	443	49880	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.418704987 CET	443	49881	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.419190884 CET	49881	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.419236898 CET	443	49881	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.419562101 CET	49881	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.419574976 CET	443	49881	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.547019958 CET	443	49881	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.547357082 CET	443	49881	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.547491074 CET	443	49881	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.547600985 CET	49881	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.547665119 CET	49881	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.547665119 CET	49881	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.547688007 CET	443	49881	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.547712088 CET	443	49881	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.551028967 CET	49885	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.551058054 CET	443	49885	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.551233053 CET	49885	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.551388979 CET	49885	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.551414013 CET	443	49885	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.555819035 CET	443	49880	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.555869102 CET	443	49880	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.556022882 CET	49880	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.556051970 CET	49880	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.556070089 CET	443	49880	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.556080103 CET	49880	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.556086063 CET	443	49880	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.558399916 CET	49886	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.558419943 CET	443	49886	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.558501005 CET	49886	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.558609009 CET	49886	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.558623075 CET	443	49886	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.616691113 CET	443	49882	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.617362976 CET	49882	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.617387056 CET	443	49882	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.617872953 CET	49882	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.617883921 CET	443	49882	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.755089998 CET	443	49882	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.755327940 CET	443	49882	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.755450010 CET	49882	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.759102106 CET	49882	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.759126902 CET	443	49882	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.763254881 CET	49887	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.763303995 CET	443	49887	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:27.763438940 CET	49887	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.763565063 CET	49887	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:27.763592958 CET	443	49887	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.057004929 CET	443	49884	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.057615995 CET	49884	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.057635069 CET	443	49884	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.058187008 CET	49884	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.058195114 CET	443	49884	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.079262972 CET	443	49883	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.079899073 CET	49883	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.079956055 CET	443	49883	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.080303907 CET	49883	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.080318928 CET	443	49883	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.192389965 CET	443	49884	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.192450047 CET	443	49884	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.192718029 CET	49884	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.192750931 CET	49884	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.192769051 CET	443	49884	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.192779064 CET	49884	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.192785025 CET	443	49884	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.196047068 CET	49888	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.196074009 CET	443	49888	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.196161985 CET	49888	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.196341038 CET	49888	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.196347952 CET	443	49888	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.295205116 CET	443	49885	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.295870066 CET	49885	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.295890093 CET	443	49885	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.296379089 CET	49885	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.296390057 CET	443	49885	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.307548046 CET	443	49886	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.307954073 CET	49886	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.307969093 CET	443	49886	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.308382988 CET	49886	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.308389902 CET	443	49886	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.415376902 CET	443	49883	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.415915966 CET	443	49883	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.415982008 CET	49883	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.416058064 CET	49883	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.416101933 CET	443	49883	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.416131973 CET	49883	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.416148901 CET	443	49883	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.420003891 CET	49889	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.420092106 CET	443	49889	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.420166016 CET	49889	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.420412064 CET	49889	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.420444965 CET	443	49889	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.427659035 CET	443	49885	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.427721977 CET	443	49885	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.427834034 CET	443	49885	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.427838087 CET	49885	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.427890062 CET	49885	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.428201914 CET	49885	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.428201914 CET	49885	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.428239107 CET	443	49885	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.428262949 CET	443	49885	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.434899092 CET	49890	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.434930086 CET	443	49890	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.435014009 CET	49890	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.435311079 CET	49890	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.435328007 CET	443	49890	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.442153931 CET	443	49886	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.442210913 CET	443	49886	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.442255974 CET	49886	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.443114042 CET	49886	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.443133116 CET	443	49886	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.443144083 CET	49886	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.443149090 CET	443	49886	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.449661016 CET	49891	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.449718952 CET	443	49891	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.449830055 CET	49891	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.450664997 CET	49891	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.450689077 CET	443	49891	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.501360893 CET	443	49887	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.501915932 CET	49887	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.501976013 CET	443	49887	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.502492905 CET	49887	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.502506971 CET	443	49887	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.631535053 CET	443	49887	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.631727934 CET	443	49887	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.631807089 CET	49887	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.631953955 CET	49887	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.631993055 CET	443	49887	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.632030010 CET	49887	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.632044077 CET	443	49887	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.635423899 CET	49892	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.635442019 CET	443	49892	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.635538101 CET	49892	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.635716915 CET	49892	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.635726929 CET	443	49892	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.942096949 CET	443	49888	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.942894936 CET	49888	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.942914963 CET	443	49888	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:28.943561077 CET	49888	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:28.943572044 CET	443	49888	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.074209929 CET	443	49888	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.074274063 CET	443	49888	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.074414968 CET	49888	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.075953007 CET	49888	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.075953007 CET	49888	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.075967073 CET	443	49888	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.075975895 CET	443	49888	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.079479933 CET	49893	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.079505920 CET	443	49893	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.079583883 CET	49893	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.079802036 CET	49893	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.079809904 CET	443	49893	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.172774076 CET	443	49889	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.173511982 CET	49889	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.173587084 CET	443	49889	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.174077034 CET	49889	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.174094915 CET	443	49889	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.185801983 CET	443	49891	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.186104059 CET	443	49890	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.186306000 CET	49891	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.186327934 CET	443	49891	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.186711073 CET	49890	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.186723948 CET	443	49890	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.186810017 CET	49891	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.186821938 CET	443	49891	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.187088966 CET	49890	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.187093019 CET	443	49890	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.307802916 CET	443	49889	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.307835102 CET	443	49889	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.307883978 CET	443	49889	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.307904959 CET	49889	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.307980061 CET	49889	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.308223009 CET	49889	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.308269024 CET	443	49889	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.308299065 CET	49889	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.308315039 CET	443	49889	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.311764956 CET	49894	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.311779022 CET	443	49894	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.311949015 CET	49894	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.312125921 CET	49894	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.312135935 CET	443	49894	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.318208933 CET	443	49891	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.318234921 CET	443	49891	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.318273067 CET	443	49891	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.318311930 CET	49891	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.318346024 CET	49891	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.318536043 CET	49891	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.318536043 CET	49891	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.318555117 CET	443	49891	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.318564892 CET	443	49891	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.320772886 CET	49895	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.320790052 CET	443	49895	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.321031094 CET	49895	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.321163893 CET	49895	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.321172953 CET	443	49895	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.323546886 CET	443	49890	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.323704004 CET	443	49890	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.323775053 CET	49890	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.323935986 CET	49890	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.323935986 CET	49890	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.323951960 CET	443	49890	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.323960066 CET	443	49890	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.325944901 CET	49896	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.325970888 CET	443	49896	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.326864958 CET	49896	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.326970100 CET	49896	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.326982021 CET	443	49896	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.388897896 CET	443	49892	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.390465975 CET	49892	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.390492916 CET	443	49892	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.391004086 CET	49892	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.391015053 CET	443	49892	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.523606062 CET	443	49892	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.523761988 CET	443	49892	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.526122093 CET	49892	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.526191950 CET	49892	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.526211023 CET	443	49892	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.526242971 CET	49892	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.526248932 CET	443	49892	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.529397964 CET	49897	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.529428005 CET	443	49897	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:29.529506922 CET	49897	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.529676914 CET	49897	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:29.529691935 CET	443	49897	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.175637960 CET	443	49893	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.176305056 CET	49893	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.176326036 CET	443	49893	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.176795006 CET	49893	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.176805019 CET	443	49893	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.321881056 CET	443	49894	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.322532892 CET	49894	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.322557926 CET	443	49894	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.322577000 CET	443	49895	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.323062897 CET	49894	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.323076010 CET	443	49894	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.323513985 CET	49895	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.323548079 CET	443	49895	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.323908091 CET	49895	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.323924065 CET	443	49895	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.331429005 CET	443	49896	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.331788063 CET	49896	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.331801891 CET	443	49896	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.332226038 CET	49896	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.332233906 CET	443	49896	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.334546089 CET	443	49897	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.338052988 CET	49897	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.338083982 CET	443	49897	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.338429928 CET	49897	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.338435888 CET	443	49897	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.341536999 CET	443	49893	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.341743946 CET	443	49893	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.341814041 CET	49893	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.344459057 CET	49893	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.344501972 CET	443	49893	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.452663898 CET	443	49894	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.452827930 CET	443	49894	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.452888012 CET	49894	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.455450058 CET	443	49895	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.455483913 CET	443	49895	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.455532074 CET	443	49895	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.455535889 CET	49895	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.455575943 CET	49895	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.459702015 CET	49898	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.459738016 CET	443	49898	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.459803104 CET	49898	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.466214895 CET	49894	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.466232061 CET	443	49894	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.466242075 CET	49894	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.466253996 CET	443	49894	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.467991114 CET	443	49896	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.468152046 CET	443	49896	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.468200922 CET	49896	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.468322992 CET	49896	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.468337059 CET	443	49896	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.468349934 CET	49896	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.468354940 CET	443	49896	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.472064972 CET	443	49897	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.472230911 CET	443	49897	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.472290993 CET	49897	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.472598076 CET	49897	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.472619057 CET	443	49897	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.472631931 CET	49897	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.472639084 CET	443	49897	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.474396944 CET	49895	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.474412918 CET	443	49895	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.474426985 CET	49895	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.474433899 CET	443	49895	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.474879026 CET	49898	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.474894047 CET	443	49898	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.479264021 CET	49899	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.479305029 CET	443	49899	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.479401112 CET	49899	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.479639053 CET	49899	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.479660034 CET	443	49899	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.485980034 CET	49900	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.486006021 CET	443	49900	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:30.486073971 CET	49900	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.595683098 CET	49900	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:30.595700026 CET	443	49900	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.070293903 CET	49901	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.070341110 CET	443	49901	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.070415020 CET	49901	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.085355997 CET	49902	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.085391998 CET	443	49902	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.085504055 CET	49902	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.179889917 CET	49901	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.179919004 CET	443	49901	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.223499060 CET	49902	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.223536015 CET	443	49902	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.227070093 CET	443	49898	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.227729082 CET	49898	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.227752924 CET	443	49898	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.228208065 CET	49898	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.228214025 CET	443	49898	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.269339085 CET	443	49899	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.314841032 CET	49899	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.336114883 CET	49899	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.336172104 CET	443	49899	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.336682081 CET	49899	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.336694956 CET	443	49899	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.341597080 CET	443	49900	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.343907118 CET	49900	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.343925953 CET	443	49900	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.344315052 CET	49900	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.344321012 CET	443	49900	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.361506939 CET	443	49898	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.361578941 CET	443	49898	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.361695051 CET	49898	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.383548975 CET	49898	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.383565903 CET	443	49898	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.383652925 CET	49898	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.383660078 CET	443	49898	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.461925030 CET	443	49899	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.461987019 CET	443	49899	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.462095022 CET	443	49899	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.462100029 CET	49899	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.462160110 CET	49899	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.499234915 CET	443	49900	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.501991987 CET	443	49900	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.502837896 CET	49900	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.526045084 CET	49899	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.526094913 CET	443	49899	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.526129961 CET	49899	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.526145935 CET	443	49899	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.550267935 CET	49900	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.550267935 CET	49900	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.550292015 CET	443	49900	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.550297976 CET	443	49900	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.640081882 CET	49903	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.640120029 CET	443	49903	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.640234947 CET	49903	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.713294983 CET	49903	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.713318110 CET	443	49903	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.714415073 CET	49904	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.714517117 CET	443	49904	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.714587927 CET	49904	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.714998007 CET	49904	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.715034008 CET	443	49904	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.763655901 CET	49908	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.763689995 CET	443	49908	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.763766050 CET	49908	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.803641081 CET	49908	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.803670883 CET	443	49908	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.953540087 CET	443	49901	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.953999996 CET	49901	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.954032898 CET	443	49901	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.954483986 CET	49901	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.954492092 CET	443	49901	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.959068060 CET	443	49902	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.959412098 CET	49902	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.959428072 CET	443	49902	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:31.959813118 CET	49902	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:31.959820032 CET	443	49902	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.088537931 CET	443	49902	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.088690996 CET	443	49902	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.088757038 CET	49902	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.088965893 CET	49902	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.088985920 CET	443	49902	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.089001894 CET	49902	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.089009047 CET	443	49902	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.092037916 CET	443	49901	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.092150927 CET	443	49901	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.092205048 CET	49901	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.092303038 CET	49901	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.092320919 CET	443	49901	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.092334986 CET	49901	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.092341900 CET	443	49901	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.093183994 CET	49909	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.093206882 CET	443	49909	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.093502045 CET	49909	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.093853951 CET	49909	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.093869925 CET	443	49909	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.095110893 CET	49910	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.095138073 CET	443	49910	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.095201015 CET	49910	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.095350981 CET	49910	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.095367908 CET	443	49910	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.463090897 CET	443	49904	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.464257002 CET	49904	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.464273930 CET	443	49904	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.464708090 CET	49904	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.464710951 CET	443	49904	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.483472109 CET	443	49903	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.483792067 CET	49903	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.483827114 CET	443	49903	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.484308004 CET	49903	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.484314919 CET	443	49903	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.550374031 CET	443	49908	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.550751925 CET	49908	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.550779104 CET	443	49908	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.551162958 CET	49908	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.551170111 CET	443	49908	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.593471050 CET	443	49904	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.593646049 CET	443	49904	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.593805075 CET	49904	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.593858004 CET	49904	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.593864918 CET	443	49904	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.593875885 CET	49904	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.593880892 CET	443	49904	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.596828938 CET	49911	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.596858978 CET	443	49911	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.596925020 CET	49911	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.597037077 CET	49911	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.597049952 CET	443	49911	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.620662928 CET	443	49903	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.620693922 CET	443	49903	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.620739937 CET	443	49903	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.620753050 CET	49903	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.620793104 CET	49903	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.621061087 CET	49903	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.621078968 CET	443	49903	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.621090889 CET	49903	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.621099949 CET	443	49903	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.624455929 CET	49912	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.624496937 CET	443	49912	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.624576092 CET	49912	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.624717951 CET	49912	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.624733925 CET	443	49912	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.716835022 CET	443	49908	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.716898918 CET	443	49908	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.716968060 CET	49908	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.717237949 CET	49908	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.717255116 CET	443	49908	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.717269897 CET	49908	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.717277050 CET	443	49908	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.720640898 CET	49913	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.720685005 CET	443	49913	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.720916986 CET	49913	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.720917940 CET	49913	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.720953941 CET	443	49913	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.828078032 CET	443	49909	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.828687906 CET	49909	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.828702927 CET	443	49909	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.829166889 CET	49909	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.829173088 CET	443	49909	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.859764099 CET	443	49910	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.860116005 CET	49910	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.860136986 CET	443	49910	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.860498905 CET	49910	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.860505104 CET	443	49910	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.961343050 CET	443	49909	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.961554050 CET	443	49909	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.961635113 CET	49909	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.962270021 CET	49909	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.962291002 CET	443	49909	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.962305069 CET	49909	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.962311029 CET	443	49909	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.964967012 CET	49914	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.965044975 CET	443	49914	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.965176105 CET	49914	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.965312958 CET	49914	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.965367079 CET	443	49914	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.995037079 CET	443	49910	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.995104074 CET	443	49910	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.995157003 CET	49910	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.995170116 CET	443	49910	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.995213985 CET	443	49910	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.995613098 CET	49910	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.997520924 CET	49910	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.997534037 CET	443	49910	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:32.997560024 CET	49910	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:32.997565985 CET	443	49910	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.002304077 CET	49915	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.002325058 CET	443	49915	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.002405882 CET	49915	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.002511978 CET	49915	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.002526999 CET	443	49915	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.323462963 CET	443	49911	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.336301088 CET	49911	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.336312056 CET	443	49911	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.336821079 CET	49911	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.336826086 CET	443	49911	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.401793003 CET	443	49912	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.441277981 CET	49912	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.447604895 CET	443	49913	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.463815928 CET	443	49911	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.464754105 CET	443	49911	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.464843988 CET	49911	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.496716022 CET	49913	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.553002119 CET	49913	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.553011894 CET	443	49913	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.553078890 CET	49912	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.553112030 CET	443	49912	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.553575993 CET	49913	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.553582907 CET	443	49913	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.553677082 CET	49912	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.553690910 CET	443	49912	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.553744078 CET	49911	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.553766012 CET	443	49911	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.553777933 CET	49911	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.553785086 CET	443	49911	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.557830095 CET	49918	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.557852030 CET	443	49918	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.557909012 CET	49918	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.558188915 CET	49918	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.558202028 CET	443	49918	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.678467989 CET	443	49913	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.678548098 CET	443	49913	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.678610086 CET	49913	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.678915024 CET	49913	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.678915977 CET	49913	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.678930044 CET	443	49913	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.678941965 CET	443	49913	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.682180882 CET	49919	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.682207108 CET	443	49919	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.682290077 CET	49919	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.682471037 CET	49919	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.682485104 CET	443	49919	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.685420990 CET	443	49912	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.685451031 CET	443	49912	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.685496092 CET	443	49912	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.685520887 CET	49912	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.685548067 CET	49912	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.690490961 CET	49912	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.690510035 CET	443	49912	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.690525055 CET	49912	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.690531969 CET	443	49912	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.693522930 CET	49920	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.693572998 CET	443	49920	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.693660975 CET	49920	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.693805933 CET	49920	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.693837881 CET	443	49920	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.706988096 CET	443	49914	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.707447052 CET	49914	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.707465887 CET	443	49914	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.707993984 CET	49914	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.707998991 CET	443	49914	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.740870953 CET	443	49915	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.742295027 CET	49915	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.742315054 CET	443	49915	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.744029045 CET	49915	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.744036913 CET	443	49915	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.837905884 CET	443	49914	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.838251114 CET	443	49914	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.838289022 CET	443	49914	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.838320017 CET	49914	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.838362932 CET	49914	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.838454962 CET	49914	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.838454962 CET	49914	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.838484049 CET	443	49914	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.838507891 CET	443	49914	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.849787951 CET	49921	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.849811077 CET	443	49921	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.849908113 CET	49921	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.850662947 CET	49921	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.850677013 CET	443	49921	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.872720957 CET	443	49915	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.872888088 CET	443	49915	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.872958899 CET	49915	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.874342918 CET	49915	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.874356985 CET	443	49915	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.882982016 CET	49922	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.883004904 CET	443	49922	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:33.883069038 CET	49922	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.883261919 CET	49922	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:33.883275986 CET	443	49922	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.285516977 CET	443	49918	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.286546946 CET	49918	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.286583900 CET	443	49918	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.287208080 CET	49918	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.287220001 CET	443	49918	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.416745901 CET	443	49918	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.416776896 CET	443	49918	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.416821003 CET	443	49918	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.416882992 CET	49918	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.417126894 CET	49918	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.417126894 CET	49918	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.417151928 CET	443	49918	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.417175055 CET	443	49918	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.420686960 CET	49924	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.420720100 CET	443	49924	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.420803070 CET	49924	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.421224117 CET	49924	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.421238899 CET	443	49924	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.431500912 CET	443	49920	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.432008028 CET	49920	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.432049036 CET	443	49920	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.432483912 CET	49920	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.432495117 CET	443	49920	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.459616899 CET	443	49919	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.460112095 CET	49919	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.460130930 CET	443	49919	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.460591078 CET	49919	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.460596085 CET	443	49919	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.562820911 CET	443	49920	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.562978983 CET	443	49920	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.563026905 CET	443	49920	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.563097954 CET	49920	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.563222885 CET	49920	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.563237906 CET	443	49920	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.563250065 CET	49920	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.563257933 CET	443	49920	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.566621065 CET	49925	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.566653967 CET	443	49925	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.566754103 CET	49925	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.566939116 CET	49925	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.566953897 CET	443	49925	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.592302084 CET	443	49921	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.594501972 CET	49921	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.594521046 CET	443	49921	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.595082045 CET	49921	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.595088005 CET	443	49921	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.597418070 CET	443	49919	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.597584009 CET	443	49919	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.597681999 CET	49919	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.597714901 CET	49919	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.597732067 CET	443	49919	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.597740889 CET	49919	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.597747087 CET	443	49919	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.600903988 CET	49926	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.600934982 CET	443	49926	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.601057053 CET	49926	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.601221085 CET	49926	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.601232052 CET	443	49926	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.622590065 CET	443	49922	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.627265930 CET	49922	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.627299070 CET	443	49922	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.627784014 CET	49922	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.627794981 CET	443	49922	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.724261045 CET	443	49921	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.724369049 CET	443	49921	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.724433899 CET	49921	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.724662066 CET	49921	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.724683046 CET	443	49921	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.724705935 CET	49921	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.724714041 CET	443	49921	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.728163004 CET	49927	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.728198051 CET	443	49927	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.728261948 CET	49927	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.728466034 CET	49927	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.728480101 CET	443	49927	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.753029108 CET	443	49922	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.753310919 CET	443	49922	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.753417015 CET	49922	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.753484011 CET	49922	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.753493071 CET	443	49922	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.753528118 CET	49922	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.753532887 CET	443	49922	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.756557941 CET	49928	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.756645918 CET	443	49928	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:34.756735086 CET	49928	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.756957054 CET	49928	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:34.756990910 CET	443	49928	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.154055119 CET	443	49924	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.155785084 CET	49924	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.155812025 CET	443	49924	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.158905029 CET	49924	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.158912897 CET	443	49924	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.287431955 CET	443	49924	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.287787914 CET	443	49924	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.287894011 CET	49924	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.299763918 CET	443	49925	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.326767921 CET	49924	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.326802969 CET	443	49924	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.326819897 CET	49924	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.326828957 CET	443	49924	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.328634977 CET	49925	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.328659058 CET	443	49925	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.329315901 CET	49925	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.329323053 CET	443	49925	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.333358049 CET	49929	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.333391905 CET	443	49929	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.333477974 CET	49929	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.333616018 CET	49929	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.333659887 CET	443	49929	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.387204885 CET	443	49926	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.388782024 CET	49926	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.388813019 CET	443	49926	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.389450073 CET	49926	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.389456034 CET	443	49926	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.397346973 CET	49930	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:02:35.397403002 CET	443	49930	142.250.184.196	192.168.2.5
Oct 28, 2024 21:02:35.397471905 CET	49930	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:02:35.397674084 CET	49930	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:02:35.397689104 CET	443	49930	142.250.184.196	192.168.2.5
Oct 28, 2024 21:02:35.458108902 CET	443	49925	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.458548069 CET	443	49925	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.458620071 CET	443	49925	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.458647966 CET	49925	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.458679914 CET	49925	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.458972931 CET	49925	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.458997011 CET	443	49925	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.459007025 CET	49925	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.459013939 CET	443	49925	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.472414017 CET	49931	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.472460985 CET	443	49931	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.472557068 CET	49931	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.472790956 CET	49931	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.472799063 CET	443	49931	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.475419044 CET	443	49927	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.476274014 CET	49927	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.476294994 CET	443	49927	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.476886034 CET	49927	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.476891994 CET	443	49927	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.512809038 CET	443	49928	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.513375998 CET	49928	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.513417006 CET	443	49928	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.513875008 CET	49928	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.513883114 CET	443	49928	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.524895906 CET	443	49926	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.525058031 CET	443	49926	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.525247097 CET	49926	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.525286913 CET	49926	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.525286913 CET	49926	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.525306940 CET	443	49926	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.525317907 CET	443	49926	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.528639078 CET	49932	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.528703928 CET	443	49932	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.528862000 CET	49932	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.529042006 CET	49932	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.529076099 CET	443	49932	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.609152079 CET	443	49927	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.609322071 CET	443	49927	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.609364033 CET	443	49927	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.609431982 CET	49927	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.609447956 CET	49927	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.609612942 CET	49927	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.609612942 CET	49927	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.609630108 CET	443	49927	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.609639883 CET	443	49927	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.612477064 CET	49933	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.612509012 CET	443	49933	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.612607002 CET	49933	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.612726927 CET	49933	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.612741947 CET	443	49933	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.644290924 CET	443	49928	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.645275116 CET	443	49928	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.645360947 CET	49928	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.653455019 CET	49928	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.653471947 CET	443	49928	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.653606892 CET	49928	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.653614044 CET	443	49928	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.660001040 CET	49935	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.660032034 CET	443	49935	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:35.660536051 CET	49935	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.663216114 CET	49935	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:35.663230896 CET	443	49935	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.079552889 CET	443	49929	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.137502909 CET	49929	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.171004057 CET	49929	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.171011925 CET	443	49929	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.171475887 CET	49929	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.171483040 CET	443	49929	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.219690084 CET	443	49931	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.222153902 CET	49931	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.222172976 CET	443	49931	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.222637892 CET	49931	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.222645044 CET	443	49931	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.274905920 CET	443	49932	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.276654959 CET	49932	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.276676893 CET	443	49932	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.277091026 CET	49932	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.277103901 CET	443	49932	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.297477961 CET	443	49930	142.250.184.196	192.168.2.5
Oct 28, 2024 21:02:36.299952030 CET	49930	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:02:36.300004959 CET	443	49930	142.250.184.196	192.168.2.5
Oct 28, 2024 21:02:36.301115036 CET	443	49930	142.250.184.196	192.168.2.5
Oct 28, 2024 21:02:36.301172972 CET	49930	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:02:36.302937984 CET	443	49929	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.302963018 CET	49930	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:02:36.303066015 CET	443	49930	142.250.184.196	192.168.2.5
Oct 28, 2024 21:02:36.303095102 CET	443	49929	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.303174973 CET	49929	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.303900957 CET	49929	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.303915024 CET	443	49929	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.303935051 CET	49929	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.303944111 CET	443	49929	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.307554007 CET	49936	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.307574034 CET	443	49936	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.307673931 CET	49936	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.308469057 CET	49936	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.308482885 CET	443	49936	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.344971895 CET	49930	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:02:36.344996929 CET	443	49930	142.250.184.196	192.168.2.5
Oct 28, 2024 21:02:36.352653980 CET	443	49931	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.352771997 CET	443	49931	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.352842093 CET	49931	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.354624987 CET	49931	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.354624987 CET	49931	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.354638100 CET	443	49931	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.354649067 CET	443	49931	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.356287003 CET	443	49933	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.356970072 CET	49933	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.356981993 CET	443	49933	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.357428074 CET	49933	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.357433081 CET	443	49933	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.358741999 CET	49938	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.358760118 CET	443	49938	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.358829975 CET	49938	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.359009981 CET	49938	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.359019041 CET	443	49938	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.387284994 CET	49930	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:02:36.405641079 CET	443	49932	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.405705929 CET	443	49932	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.405766010 CET	49932	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.405772924 CET	443	49932	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.405826092 CET	443	49932	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.405877113 CET	49932	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.409043074 CET	49932	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.409050941 CET	443	49932	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.409063101 CET	49932	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.409069061 CET	443	49932	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.409208059 CET	443	49935	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.411007881 CET	49935	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.411025047 CET	443	49935	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.411537886 CET	49935	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.411542892 CET	443	49935	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.413459063 CET	49939	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.413511992 CET	443	49939	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.413589954 CET	49939	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.413738966 CET	49939	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.413767099 CET	443	49939	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.487955093 CET	443	49933	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.488327980 CET	443	49933	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.488403082 CET	49933	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.488445997 CET	49933	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.488464117 CET	443	49933	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.488473892 CET	49933	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.488478899 CET	443	49933	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.491874933 CET	49940	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.491894960 CET	443	49940	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.491966963 CET	49940	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.492229939 CET	49940	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.492244005 CET	443	49940	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.548026085 CET	443	49935	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.548110008 CET	443	49935	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.548202991 CET	49935	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.548207998 CET	443	49935	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.548264027 CET	49935	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.548913002 CET	49935	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.548919916 CET	443	49935	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.548932076 CET	49935	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.548935890 CET	443	49935	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.551445961 CET	49941	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.551466942 CET	443	49941	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:36.551541090 CET	49941	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.551717997 CET	49941	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:36.551728964 CET	443	49941	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.030739069 CET	443	49936	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.031631947 CET	49936	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.031653881 CET	443	49936	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.032598019 CET	49936	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.032605886 CET	443	49936	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.147092104 CET	443	49938	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.147595882 CET	49938	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.147610903 CET	443	49938	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.148539066 CET	49938	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.148545980 CET	443	49938	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.155389071 CET	443	49939	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.159329891 CET	443	49936	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.159727097 CET	443	49936	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.159826040 CET	49936	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.162719011 CET	49939	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.162755966 CET	443	49939	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.163361073 CET	49939	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.163372993 CET	443	49939	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.164316893 CET	49936	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.164316893 CET	49936	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.164330959 CET	443	49936	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.164340973 CET	443	49936	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.168018103 CET	49942	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.168028116 CET	443	49942	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.168085098 CET	49942	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.168719053 CET	49942	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.168731928 CET	443	49942	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.241099119 CET	443	49940	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.241542101 CET	49940	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.241549969 CET	443	49940	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.241997957 CET	49940	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.242002964 CET	443	49940	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.285708904 CET	443	49938	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.285772085 CET	443	49938	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.285873890 CET	49938	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.287553072 CET	49938	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.287553072 CET	49938	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.287564993 CET	443	49938	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.287570000 CET	443	49938	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.290673971 CET	49943	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.290724993 CET	443	49943	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.290860891 CET	49943	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.291074991 CET	49943	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.291101933 CET	443	49943	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.296749115 CET	443	49939	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.296890974 CET	443	49939	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.297077894 CET	49939	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.297326088 CET	49939	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.297326088 CET	49939	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.297358036 CET	443	49939	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.297384977 CET	443	49939	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.299293995 CET	49944	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.299318075 CET	443	49944	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.299508095 CET	49944	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.299684048 CET	49944	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.299698114 CET	443	49944	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.308181047 CET	443	49941	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.308794975 CET	49941	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.308831930 CET	443	49941	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.309492111 CET	49941	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.309504986 CET	443	49941	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.372807026 CET	443	49940	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.372855902 CET	443	49940	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.373097897 CET	49940	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.376621008 CET	49940	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.376631021 CET	443	49940	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.376857996 CET	49940	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.376863956 CET	443	49940	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.380795002 CET	49945	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.380810022 CET	443	49945	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.381510019 CET	49945	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.404313087 CET	49945	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.404325962 CET	443	49945	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.440216064 CET	443	49941	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.440285921 CET	443	49941	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.440535069 CET	49941	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.440824032 CET	49941	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.440851927 CET	443	49941	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.441160917 CET	49941	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.441174984 CET	443	49941	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.444556952 CET	49946	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.444595098 CET	443	49946	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.444952011 CET	49946	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.445280075 CET	49946	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.445297003 CET	443	49946	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.908544064 CET	443	49942	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.910689116 CET	49942	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.910712004 CET	443	49942	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:37.911359072 CET	49942	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:37.911365032 CET	443	49942	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.030735970 CET	443	49943	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.033226013 CET	49943	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.033277035 CET	443	49943	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.033736944 CET	49943	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.033749104 CET	443	49943	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.038918018 CET	443	49942	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.038990974 CET	443	49942	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.039052010 CET	49942	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.039294004 CET	49942	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.039309025 CET	443	49942	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.039329052 CET	49942	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.039334059 CET	443	49942	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.042715073 CET	49947	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.042737007 CET	443	49947	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.043032885 CET	49947	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.043193102 CET	49947	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.043205023 CET	443	49947	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.154249907 CET	443	49945	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.154974937 CET	49945	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.154983044 CET	443	49945	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.155668974 CET	49945	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.155673981 CET	443	49945	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.161505938 CET	443	49943	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.161710978 CET	443	49943	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.161796093 CET	49943	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.161928892 CET	49943	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.161938906 CET	443	49943	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.161948919 CET	49943	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.161952972 CET	443	49943	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.165002108 CET	49948	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.165035963 CET	443	49948	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.165380001 CET	49948	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.165565968 CET	49948	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.165580034 CET	443	49948	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.198025942 CET	443	49946	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.198590994 CET	49946	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.198607922 CET	443	49946	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.201050997 CET	49946	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.201056957 CET	443	49946	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.262187958 CET	443	49944	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.263325930 CET	49944	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.263339043 CET	443	49944	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.264240980 CET	49944	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.264245987 CET	443	49944	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.286148071 CET	443	49945	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.286335945 CET	443	49945	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.286401987 CET	49945	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.286741018 CET	49945	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.286751032 CET	443	49945	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.286763906 CET	49945	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.286771059 CET	443	49945	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.291857004 CET	49949	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.291882038 CET	443	49949	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.292236090 CET	49949	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.292486906 CET	49949	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.292496920 CET	443	49949	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.332017899 CET	443	49946	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.332161903 CET	443	49946	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.332227945 CET	49946	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.332420111 CET	49946	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.332432032 CET	443	49946	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.332459927 CET	49946	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.332480907 CET	443	49946	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.336349964 CET	49950	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.336375952 CET	443	49950	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.336486101 CET	49950	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.336698055 CET	49950	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.336710930 CET	443	49950	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.395960093 CET	443	49944	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.396051884 CET	443	49944	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.396167040 CET	443	49944	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.396229029 CET	49944	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.417140007 CET	49944	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.417140007 CET	49944	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.417154074 CET	443	49944	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.417162895 CET	443	49944	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.691193104 CET	49951	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.691220999 CET	443	49951	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.691297054 CET	49951	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.715657949 CET	49951	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.715673923 CET	443	49951	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.815586090 CET	49703	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:38.815696001 CET	49703	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:38.816284895 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:38.816344023 CET	443	49952	23.1.237.91	192.168.2.5
Oct 28, 2024 21:02:38.816518068 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:38.816930056 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:38.816945076 CET	443	49952	23.1.237.91	192.168.2.5
Oct 28, 2024 21:02:38.852097034 CET	443	49703	23.1.237.91	192.168.2.5
Oct 28, 2024 21:02:38.852114916 CET	443	49703	23.1.237.91	192.168.2.5
Oct 28, 2024 21:02:38.971009970 CET	443	49947	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.973155022 CET	49947	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.973187923 CET	443	49947	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.974076033 CET	49947	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.974087954 CET	443	49947	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.979294062 CET	443	49948	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.979834080 CET	49948	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.979850054 CET	443	49948	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:38.980312109 CET	49948	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:38.980317116 CET	443	49948	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.032656908 CET	443	49949	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.033221960 CET	49949	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.033238888 CET	443	49949	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.033765078 CET	49949	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.033771992 CET	443	49949	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.107088089 CET	443	49947	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.107153893 CET	443	49947	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.107372046 CET	49947	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.107426882 CET	49947	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.107439995 CET	443	49947	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.107471943 CET	49947	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.107481003 CET	443	49947	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.109803915 CET	443	49950	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.110178947 CET	49953	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.110228062 CET	443	49953	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.110471964 CET	49953	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.110676050 CET	49953	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.110708952 CET	443	49953	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.110923052 CET	49950	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.110948086 CET	443	49950	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.111452103 CET	49950	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.111458063 CET	443	49950	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.114690065 CET	443	49948	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.114717007 CET	443	49948	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.114768982 CET	49948	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.114778042 CET	443	49948	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.114789963 CET	443	49948	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.114839077 CET	49948	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.114989996 CET	49948	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.114989996 CET	49948	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.115005016 CET	443	49948	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.115014076 CET	443	49948	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.117000103 CET	49954	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.117032051 CET	443	49954	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.117229939 CET	49954	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.117441893 CET	49954	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.117451906 CET	443	49954	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.171269894 CET	443	49949	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.171380043 CET	443	49949	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.171435118 CET	443	49949	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.171484947 CET	49949	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.171525002 CET	49949	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.171732903 CET	49949	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.171746969 CET	443	49949	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.175945044 CET	49955	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.175992012 CET	443	49955	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.176208973 CET	49955	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.176755905 CET	49955	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.176784039 CET	443	49955	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.253365040 CET	443	49950	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.253427029 CET	443	49950	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.253500938 CET	49950	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.253514051 CET	443	49950	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.253642082 CET	443	49950	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.253751993 CET	49950	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.253803968 CET	49950	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.253815889 CET	443	49950	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.253828049 CET	49950	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.253833055 CET	443	49950	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.256838083 CET	49956	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.256867886 CET	443	49956	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.257072926 CET	49956	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.257232904 CET	49956	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.257247925 CET	443	49956	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.536842108 CET	443	49952	23.1.237.91	192.168.2.5
Oct 28, 2024 21:02:39.536915064 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:39.586724997 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:39.586746931 CET	443	49952	23.1.237.91	192.168.2.5
Oct 28, 2024 21:02:39.588118076 CET	443	49952	23.1.237.91	192.168.2.5
Oct 28, 2024 21:02:39.588191986 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:39.589313984 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:39.589370966 CET	443	49952	23.1.237.91	192.168.2.5
Oct 28, 2024 21:02:39.589728117 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:39.589740038 CET	443	49952	23.1.237.91	192.168.2.5
Oct 28, 2024 21:02:39.594822884 CET	443	49951	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.595273018 CET	49951	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.595294952 CET	443	49951	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.596014023 CET	49951	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.596019983 CET	443	49951	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.728568077 CET	443	49951	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.728646040 CET	443	49951	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.728737116 CET	49951	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.728914976 CET	49951	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.728931904 CET	443	49951	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.728945971 CET	49951	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.728952885 CET	443	49951	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.731957912 CET	49957	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.732009888 CET	443	49957	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.732093096 CET	49957	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.732256889 CET	49957	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.732285976 CET	443	49957	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.798007011 CET	443	49952	23.1.237.91	192.168.2.5
Oct 28, 2024 21:02:39.798074961 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:39.798847914 CET	443	49952	23.1.237.91	192.168.2.5
Oct 28, 2024 21:02:39.798922062 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:39.798953056 CET	443	49952	23.1.237.91	192.168.2.5
Oct 28, 2024 21:02:39.799031973 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:02:39.849742889 CET	443	49953	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.850315094 CET	49953	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.850325108 CET	443	49953	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.850855112 CET	49953	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.850860119 CET	443	49953	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.855413914 CET	443	49954	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.855851889 CET	49954	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.855875015 CET	443	49954	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.856686115 CET	49954	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.856693029 CET	443	49954	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.927100897 CET	443	49955	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.927738905 CET	49955	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.927756071 CET	443	49955	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.928366899 CET	49955	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.928378105 CET	443	49955	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.983372927 CET	443	49953	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.984337091 CET	443	49953	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.984395981 CET	49953	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.984411955 CET	443	49953	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.984440088 CET	443	49953	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.984509945 CET	49953	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.984574080 CET	49953	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.984574080 CET	49953	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.984601974 CET	443	49953	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.984630108 CET	443	49953	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.986568928 CET	443	49954	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.986671925 CET	443	49954	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.986737967 CET	49954	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.986880064 CET	49954	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.986890078 CET	443	49954	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.986984015 CET	49954	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.986990929 CET	443	49954	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.987623930 CET	49958	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.987665892 CET	443	49958	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.987943888 CET	49958	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.988214970 CET	49958	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.988229990 CET	443	49958	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.989554882 CET	49959	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.989582062 CET	443	49959	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:39.989655018 CET	49959	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.989764929 CET	49959	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:39.989778042 CET	443	49959	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.026387930 CET	443	49956	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.026787996 CET	49956	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.026807070 CET	443	49956	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.027230978 CET	49956	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.027235985 CET	443	49956	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.060446024 CET	443	49955	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.060468912 CET	443	49955	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.060524940 CET	443	49955	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.060524940 CET	49955	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.060620070 CET	49955	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.060801983 CET	49955	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.060811043 CET	443	49955	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.060866117 CET	49955	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.060872078 CET	443	49955	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.063458920 CET	49960	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.063491106 CET	443	49960	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.063558102 CET	49960	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.063747883 CET	49960	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.063765049 CET	443	49960	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.172715902 CET	443	49956	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.172775984 CET	443	49956	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.172840118 CET	49956	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.172904015 CET	443	49956	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.172986031 CET	49956	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.173285961 CET	49956	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.173305988 CET	443	49956	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.173317909 CET	49956	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.173324108 CET	443	49956	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.176872969 CET	49961	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.176894903 CET	443	49961	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.176966906 CET	49961	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.177138090 CET	49961	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.177145958 CET	443	49961	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.460777998 CET	443	49957	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.461355925 CET	49957	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.461371899 CET	443	49957	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.461971998 CET	49957	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.461977005 CET	443	49957	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.589906931 CET	443	49957	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.589972973 CET	443	49957	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.590059996 CET	49957	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.590068102 CET	443	49957	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.590094090 CET	443	49957	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.590153933 CET	49957	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.590296984 CET	49957	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.590307951 CET	443	49957	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.590318918 CET	49957	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.590325117 CET	443	49957	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.594250917 CET	49962	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.594301939 CET	443	49962	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.595892906 CET	49962	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.599435091 CET	49962	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.599452019 CET	443	49962	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.756244898 CET	443	49959	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.756819010 CET	49959	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.756827116 CET	443	49959	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.757723093 CET	49959	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.757729053 CET	443	49959	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.759656906 CET	443	49958	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.760042906 CET	49958	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.760059118 CET	443	49958	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.760689974 CET	49958	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.760696888 CET	443	49958	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.835798025 CET	443	49960	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.836549044 CET	49960	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.836572886 CET	443	49960	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.837189913 CET	49960	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.837196112 CET	443	49960	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.890410900 CET	443	49959	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.891042948 CET	443	49959	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.891149044 CET	49959	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.891469955 CET	49959	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.891479015 CET	443	49959	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.891491890 CET	49959	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.891498089 CET	443	49959	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.894422054 CET	443	49958	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.894484997 CET	443	49958	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.894651890 CET	49958	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.894779921 CET	49963	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.894789934 CET	443	49963	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.894860983 CET	49963	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.895490885 CET	49958	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.895510912 CET	443	49958	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.895520926 CET	49958	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.895526886 CET	443	49958	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.896560907 CET	49963	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.896570921 CET	443	49963	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.898107052 CET	49964	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.898142099 CET	443	49964	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.898400068 CET	49964	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.898509026 CET	49964	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.898521900 CET	443	49964	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.915709019 CET	443	49961	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.916187048 CET	49961	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.916198015 CET	443	49961	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.916755915 CET	49961	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.916759968 CET	443	49961	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.969661951 CET	443	49960	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.969808102 CET	443	49960	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.971898079 CET	49960	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.988426924 CET	49960	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.988454103 CET	443	49960	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:40.988562107 CET	49960	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:40.988581896 CET	443	49960	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.013451099 CET	49965	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.013473988 CET	443	49965	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.013561010 CET	49965	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.015609026 CET	49965	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.015624046 CET	443	49965	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.045911074 CET	443	49961	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.046003103 CET	443	49961	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.046102047 CET	443	49961	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.047872066 CET	49961	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.049225092 CET	49961	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.049233913 CET	443	49961	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.049242020 CET	49961	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.049247980 CET	443	49961	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.144932032 CET	49966	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.144958973 CET	443	49966	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.145056009 CET	49966	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.166096926 CET	49966	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.166111946 CET	443	49966	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.343298912 CET	443	49962	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.343851089 CET	49962	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.343863010 CET	443	49962	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.344357014 CET	49962	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.344362974 CET	443	49962	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.476495028 CET	443	49962	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.476757050 CET	443	49962	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.476819038 CET	49962	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.476862907 CET	49962	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.476877928 CET	443	49962	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.476898909 CET	49962	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.476906061 CET	443	49962	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.479819059 CET	49967	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.479849100 CET	443	49967	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.479916096 CET	49967	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.480112076 CET	49967	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.480127096 CET	443	49967	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.621217966 CET	443	49964	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.622240067 CET	49964	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.622252941 CET	443	49964	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.623209000 CET	49964	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.623214960 CET	443	49964	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.640947104 CET	443	49963	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.641438961 CET	49963	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.641448975 CET	443	49963	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.641985893 CET	49963	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.641988993 CET	443	49963	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.751104116 CET	443	49964	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.751303911 CET	443	49964	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.751394033 CET	49964	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.751471996 CET	49964	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.751486063 CET	443	49964	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.751522064 CET	49964	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.751527071 CET	443	49964	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.755103111 CET	49968	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.755121946 CET	443	49968	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.755189896 CET	49968	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.755354881 CET	49968	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.755362034 CET	443	49968	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.764345884 CET	443	49965	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.764750957 CET	49965	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.764759064 CET	443	49965	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.765243053 CET	49965	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.765247107 CET	443	49965	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.775131941 CET	443	49963	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.775520086 CET	443	49963	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.775573015 CET	443	49963	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.775590897 CET	49963	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.775625944 CET	49963	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.775680065 CET	49963	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.775680065 CET	49963	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.775698900 CET	443	49963	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.775708914 CET	443	49963	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.778383017 CET	49969	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.778409004 CET	443	49969	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.778558969 CET	49969	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.779196024 CET	49969	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.779216051 CET	443	49969	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.899530888 CET	443	49965	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.899555922 CET	443	49965	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.899596930 CET	443	49965	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.899615049 CET	49965	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.899652958 CET	49965	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.899898052 CET	49965	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.899909973 CET	443	49965	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.899918079 CET	49965	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.899921894 CET	443	49965	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.903047085 CET	49970	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.903057098 CET	443	49970	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.903127909 CET	49970	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.903305054 CET	49970	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.903318882 CET	443	49970	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.908268929 CET	443	49966	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.908732891 CET	49966	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.908750057 CET	443	49966	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:41.909252882 CET	49966	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:41.909257889 CET	443	49966	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.039515018 CET	443	49966	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.040069103 CET	443	49966	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.040144920 CET	49966	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.040359020 CET	49966	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.040373087 CET	443	49966	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.040381908 CET	49966	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.040388107 CET	443	49966	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.043296099 CET	49971	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.043339968 CET	443	49971	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.043412924 CET	49971	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.043555975 CET	49971	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.043575048 CET	443	49971	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.217608929 CET	443	49967	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.218127012 CET	49967	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.218144894 CET	443	49967	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.218684912 CET	49967	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.218691111 CET	443	49967	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.350342989 CET	443	49967	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.351396084 CET	443	49967	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.351455927 CET	49967	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.351516008 CET	49967	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.351530075 CET	443	49967	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.351537943 CET	49967	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.351542950 CET	443	49967	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.354516029 CET	49972	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.354533911 CET	443	49972	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.354641914 CET	49972	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.354792118 CET	49972	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.354801893 CET	443	49972	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.500895977 CET	443	49969	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.501354933 CET	49969	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.501384020 CET	443	49969	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.501828909 CET	49969	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.501835108 CET	443	49969	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.503256083 CET	443	49968	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.503583908 CET	49968	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.503597975 CET	443	49968	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.504071951 CET	49968	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.504076004 CET	443	49968	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.631179094 CET	443	49969	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.631383896 CET	443	49969	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.631501913 CET	49969	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.631655931 CET	49969	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.631674051 CET	443	49969	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.631685972 CET	49969	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.631700993 CET	443	49969	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.631889105 CET	443	49968	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.631968975 CET	443	49968	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.633955956 CET	49968	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.634784937 CET	49973	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.634816885 CET	443	49973	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.634823084 CET	49968	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.634835005 CET	443	49968	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.634846926 CET	49968	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.634851933 CET	443	49968	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.634891033 CET	49973	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.635592937 CET	49973	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.635611057 CET	443	49973	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.636852026 CET	49974	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.636893034 CET	443	49974	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.638113022 CET	49974	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.638222933 CET	49974	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.638236046 CET	443	49974	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.643847942 CET	443	49970	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.646173000 CET	49970	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.646214962 CET	443	49970	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.646605015 CET	49970	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.646610975 CET	443	49970	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.776576996 CET	443	49970	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.776774883 CET	443	49970	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.777746916 CET	49970	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.778574944 CET	49970	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.778589964 CET	443	49970	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.778603077 CET	49970	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.778609037 CET	443	49970	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.783132076 CET	49975	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.783163071 CET	443	49975	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.783225060 CET	49975	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.783448935 CET	49975	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.783464909 CET	443	49975	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.798367023 CET	443	49971	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.799043894 CET	49971	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.799058914 CET	443	49971	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.799642086 CET	49971	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.799649954 CET	443	49971	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.940237045 CET	443	49971	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.940306902 CET	443	49971	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.940411091 CET	443	49971	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.940560102 CET	49971	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.940618038 CET	49971	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.940637112 CET	443	49971	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.940650940 CET	49971	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.940655947 CET	443	49971	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.944013119 CET	49976	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.944051027 CET	443	49976	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:42.944129944 CET	49976	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.944302082 CET	49976	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:42.944312096 CET	443	49976	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.106177092 CET	443	49972	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.106765032 CET	49972	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.106782913 CET	443	49972	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.107278109 CET	49972	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.107284069 CET	443	49972	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.239974976 CET	443	49972	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.240128040 CET	443	49972	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.240277052 CET	49972	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.240303040 CET	49972	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.240317106 CET	443	49972	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.240325928 CET	49972	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.240331888 CET	443	49972	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.243334055 CET	49977	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.243362904 CET	443	49977	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.243449926 CET	49977	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.243627071 CET	49977	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.243640900 CET	443	49977	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.424222946 CET	443	49974	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.424829960 CET	443	49973	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.446382046 CET	49974	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.446403027 CET	443	49974	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.446903944 CET	49974	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.446908951 CET	443	49974	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.447145939 CET	49973	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.447170019 CET	443	49973	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.447494984 CET	49973	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.447500944 CET	443	49973	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.557926893 CET	443	49975	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.562644958 CET	49975	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.562668085 CET	443	49975	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.566339970 CET	49975	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.566350937 CET	443	49975	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.573061943 CET	443	49974	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.573254108 CET	443	49974	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.573323011 CET	49974	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.574127913 CET	49974	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.574141979 CET	443	49974	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.574151993 CET	49974	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.574156046 CET	443	49974	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.575761080 CET	443	49973	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.575866938 CET	443	49973	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.575917006 CET	443	49973	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.575965881 CET	49973	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.578464985 CET	49973	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.578481913 CET	443	49973	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.578491926 CET	49973	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.578496933 CET	443	49973	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.689950943 CET	443	49976	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.707103014 CET	443	49975	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.707178116 CET	443	49975	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.707209110 CET	443	49975	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.707253933 CET	49975	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.707293987 CET	49975	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.727284908 CET	49976	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.727299929 CET	443	49976	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.727792025 CET	49976	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.727797985 CET	443	49976	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.728241920 CET	49975	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.728261948 CET	443	49975	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.728274107 CET	49975	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.728279114 CET	443	49975	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.733210087 CET	49978	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.733237028 CET	443	49978	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.733303070 CET	49978	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.733438969 CET	49978	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.733453035 CET	443	49978	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.735117912 CET	49979	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.735136032 CET	443	49979	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.735198021 CET	49979	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.735697985 CET	49980	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.735713005 CET	443	49980	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.735868931 CET	49980	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.735929966 CET	49979	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.735940933 CET	443	49979	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.736064911 CET	49980	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.736078024 CET	443	49980	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.859225035 CET	443	49976	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.859296083 CET	443	49976	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.859579086 CET	49976	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.859579086 CET	49976	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.859579086 CET	49976	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.862206936 CET	49981	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.862236977 CET	443	49981	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.862301111 CET	49981	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.862436056 CET	49981	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.862449884 CET	443	49981	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.974227905 CET	443	49977	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.974916935 CET	49977	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.974925041 CET	443	49977	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:43.975442886 CET	49977	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:43.975446939 CET	443	49977	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.107003927 CET	443	49977	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.107552052 CET	443	49977	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.107599020 CET	443	49977	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.107618093 CET	49977	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.107666016 CET	49977	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.107717037 CET	49977	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.107727051 CET	443	49977	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.107738018 CET	49977	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.107743025 CET	443	49977	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.110591888 CET	49982	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.110620975 CET	443	49982	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.110698938 CET	49982	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.110842943 CET	49982	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.110857964 CET	443	49982	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.168076038 CET	49976	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.168092966 CET	443	49976	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.456080914 CET	443	49980	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.456574917 CET	49980	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.456593990 CET	443	49980	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.457082987 CET	49980	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.457088947 CET	443	49980	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.467645884 CET	443	49979	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.468338013 CET	49979	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.468353987 CET	443	49979	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.468852043 CET	49979	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.468857050 CET	443	49979	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.469985962 CET	443	49978	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.470287085 CET	49978	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.470307112 CET	443	49978	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.470702887 CET	49978	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.470712900 CET	443	49978	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.584003925 CET	443	49980	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.584026098 CET	443	49980	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.584080935 CET	443	49980	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.584114075 CET	49980	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.584182024 CET	49980	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.584527016 CET	49980	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.584541082 CET	443	49980	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.584554911 CET	49980	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.584559917 CET	443	49980	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.587656975 CET	49983	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.587693930 CET	443	49983	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.587773085 CET	49983	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.587939978 CET	49983	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.587954998 CET	443	49983	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.594990015 CET	443	49981	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.595340967 CET	49981	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.595357895 CET	443	49981	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.595746994 CET	49981	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.595752001 CET	443	49981	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.599085093 CET	443	49979	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.599102020 CET	443	49979	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.599155903 CET	443	49979	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.599155903 CET	49979	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.599201918 CET	49979	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.599347115 CET	49979	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.599359035 CET	443	49979	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.599390030 CET	49979	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.599395037 CET	443	49979	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.601550102 CET	49984	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.601568937 CET	443	49984	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.601639032 CET	49984	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.601782084 CET	49984	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.601809978 CET	443	49984	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.602180958 CET	443	49978	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.602446079 CET	443	49978	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.602499962 CET	49978	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.602541924 CET	49978	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.602562904 CET	443	49978	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.602581978 CET	49978	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.602587938 CET	443	49978	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.604696989 CET	49985	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.604731083 CET	443	49985	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.604809999 CET	49985	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.604953051 CET	49985	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.604974031 CET	443	49985	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.726454020 CET	443	49981	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.726485968 CET	443	49981	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.726541996 CET	443	49981	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.726557970 CET	49981	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.726591110 CET	49981	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.726789951 CET	49981	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.726805925 CET	443	49981	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.726819038 CET	49981	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.726824999 CET	443	49981	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.729685068 CET	49986	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.729716063 CET	443	49986	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.729803085 CET	49986	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.729938030 CET	49986	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.729954958 CET	443	49986	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.834968090 CET	443	49982	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.835541964 CET	49982	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.835565090 CET	443	49982	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.836071968 CET	49982	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.836083889 CET	443	49982	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.965212107 CET	443	49982	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.965837002 CET	443	49982	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.965935946 CET	49982	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.966568947 CET	49982	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.966586113 CET	443	49982	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.966598034 CET	49982	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.966605902 CET	443	49982	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.969790936 CET	49987	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.969810963 CET	443	49987	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:44.969887018 CET	49987	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.970035076 CET	49987	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:44.970047951 CET	443	49987	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.320076942 CET	443	49983	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.322707891 CET	49983	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.322719097 CET	443	49983	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.323235035 CET	49983	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.323240042 CET	443	49983	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.374232054 CET	443	49984	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.376437902 CET	49984	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.376451969 CET	443	49984	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.376951933 CET	443	49985	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.377094984 CET	49984	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.377103090 CET	443	49984	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.377317905 CET	49985	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.377350092 CET	443	49985	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.377799034 CET	49985	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.377810001 CET	443	49985	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.451539040 CET	443	49983	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.451585054 CET	443	49983	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.451649904 CET	443	49983	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.451659918 CET	49983	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.451689005 CET	49983	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.452017069 CET	49983	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.452033997 CET	443	49983	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.452043056 CET	49983	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.452048063 CET	443	49983	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.455430984 CET	49988	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.455466986 CET	443	49988	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.455552101 CET	49988	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.455713987 CET	49988	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.455724955 CET	443	49988	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.469803095 CET	443	49986	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.470187902 CET	49986	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.470197916 CET	443	49986	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.470648050 CET	49986	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.470653057 CET	443	49986	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.505232096 CET	443	49984	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.505393028 CET	443	49984	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.505481958 CET	49984	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.505616903 CET	49984	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.505625010 CET	443	49984	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.505640030 CET	49984	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.505644083 CET	443	49984	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.507832050 CET	49989	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.507874012 CET	443	49989	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.511887074 CET	49989	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.512010098 CET	49989	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.512023926 CET	443	49989	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.515913010 CET	443	49985	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.515933990 CET	443	49985	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.515974998 CET	443	49985	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.516009092 CET	49985	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.516042948 CET	49985	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.516191959 CET	49985	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.516222000 CET	443	49985	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.516247034 CET	49985	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.516261101 CET	443	49985	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.518052101 CET	49990	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.518069029 CET	443	49990	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.519851923 CET	49990	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.520006895 CET	49990	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.520019054 CET	443	49990	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.599858999 CET	443	49986	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.600138903 CET	443	49986	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.600205898 CET	49986	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.600383043 CET	49986	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.600399017 CET	443	49986	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.600409031 CET	49986	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.600414038 CET	443	49986	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.602751970 CET	49991	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.602798939 CET	443	49991	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.602870941 CET	49991	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.603012085 CET	49991	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.603028059 CET	443	49991	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.706726074 CET	443	49987	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.708473921 CET	49987	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.708508015 CET	443	49987	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.708976030 CET	49987	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.708990097 CET	443	49987	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.839076996 CET	443	49987	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.839138031 CET	443	49987	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.839204073 CET	49987	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.839221001 CET	443	49987	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.839307070 CET	443	49987	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.839380026 CET	49987	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.850476980 CET	49987	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.850493908 CET	443	49987	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.880399942 CET	49992	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.880439997 CET	443	49992	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:45.880522966 CET	49992	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.881696939 CET	49992	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:45.881710052 CET	443	49992	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.189040899 CET	443	49988	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.246572971 CET	49988	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.280081987 CET	443	49990	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.280503035 CET	443	49989	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.283495903 CET	49988	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.283508062 CET	443	49988	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.283997059 CET	49988	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.284001112 CET	443	49988	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.296976089 CET	49990	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.296994925 CET	443	49990	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.297437906 CET	49990	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.297451019 CET	443	49990	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.297739029 CET	49989	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.297754049 CET	443	49989	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.299763918 CET	443	49930	142.250.184.196	192.168.2.5
Oct 28, 2024 21:02:46.299832106 CET	443	49930	142.250.184.196	192.168.2.5
Oct 28, 2024 21:02:46.299879074 CET	49930	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:02:46.307301044 CET	49989	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.307310104 CET	443	49989	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.360800028 CET	443	49991	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.366077900 CET	49991	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.366102934 CET	443	49991	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.366612911 CET	49991	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.366621017 CET	443	49991	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.642669916 CET	443	49988	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.642772913 CET	443	49988	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.642826080 CET	49988	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.643023014 CET	49988	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.643037081 CET	443	49988	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.643047094 CET	49988	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.643052101 CET	443	49988	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.644053936 CET	443	49990	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.644108057 CET	443	49990	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.644155025 CET	49990	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.644340038 CET	49990	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.644345045 CET	443	49990	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.644354105 CET	49990	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.644357920 CET	443	49990	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.645021915 CET	443	49989	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.645814896 CET	443	49989	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.645865917 CET	443	49989	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.645881891 CET	49989	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.645917892 CET	49989	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.646200895 CET	49989	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.646220922 CET	443	49989	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.646235943 CET	49989	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.646243095 CET	443	49989	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.646486998 CET	49994	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.646534920 CET	49995	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.646538019 CET	443	49994	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.646567106 CET	443	49995	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.646631002 CET	49995	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.646635056 CET	49994	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.646799088 CET	49994	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.646815062 CET	443	49994	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.646846056 CET	49995	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.646861076 CET	443	49995	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.648422003 CET	49996	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.648457050 CET	443	49996	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.648520947 CET	49996	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.648648024 CET	49996	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.648658991 CET	443	49996	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.664213896 CET	443	49991	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.664351940 CET	443	49991	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.664406061 CET	49991	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.664482117 CET	49991	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.664491892 CET	443	49991	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.664506912 CET	49991	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.664511919 CET	443	49991	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.666692019 CET	49997	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.666752100 CET	443	49997	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.666830063 CET	49997	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.666973114 CET	49997	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.667002916 CET	443	49997	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.669126034 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:46.669147968 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:46.669260979 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:46.669581890 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:46.669594049 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:46.784981012 CET	443	49992	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.786952972 CET	49992	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.786984921 CET	443	49992	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.787492037 CET	49992	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.787497997 CET	443	49992	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.913547993 CET	443	49992	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.913614035 CET	443	49992	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.913705111 CET	49992	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.913707018 CET	443	49992	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.913788080 CET	49992	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.913996935 CET	49992	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.913996935 CET	49992	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.914017916 CET	443	49992	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.914028883 CET	443	49992	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.917467117 CET	49999	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.917512894 CET	443	49999	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:46.917608976 CET	49999	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.917927027 CET	49999	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:46.917965889 CET	443	49999	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.392846107 CET	443	49994	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.393554926 CET	49994	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.393568993 CET	443	49994	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.394056082 CET	49994	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.394071102 CET	443	49994	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.397998095 CET	443	49995	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.398313046 CET	49995	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.398336887 CET	443	49995	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.398694038 CET	49995	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.398699999 CET	443	49995	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.406898022 CET	443	49996	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.410355091 CET	49996	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.410373926 CET	443	49996	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.410789967 CET	49996	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.410794973 CET	443	49996	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.411386967 CET	443	49997	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.414387941 CET	49997	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.414417982 CET	443	49997	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.414730072 CET	49997	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.414737940 CET	443	49997	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.428040028 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.428112030 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:47.429439068 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:47.429445028 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.429672956 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.430928946 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:47.475334883 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.528631926 CET	443	49994	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.528923035 CET	443	49994	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.529007912 CET	49994	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.529110909 CET	49994	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.529110909 CET	49994	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.529181004 CET	443	49994	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.529211044 CET	443	49994	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.529742002 CET	443	49995	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.529797077 CET	443	49995	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.529860020 CET	49995	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.530066967 CET	49995	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.530088902 CET	443	49995	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.530103922 CET	49995	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.530112982 CET	443	49995	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.532155991 CET	50000	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.532181025 CET	443	50000	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.532284021 CET	50000	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.532414913 CET	50000	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.532427073 CET	50001	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.532429934 CET	443	50000	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.532479048 CET	443	50001	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.532541037 CET	50001	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.532712936 CET	50001	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.532746077 CET	443	50001	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.541369915 CET	443	49996	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.541403055 CET	443	49996	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.541452885 CET	443	49996	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.541465998 CET	49996	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.541627884 CET	49996	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.541646004 CET	443	49996	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.541660070 CET	49996	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.541666985 CET	443	49996	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.541676044 CET	49996	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.541680098 CET	443	49996	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.543498039 CET	443	49997	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.543654919 CET	443	49997	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.543739080 CET	49997	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.543884039 CET	49997	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.543914080 CET	443	49997	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.543931961 CET	49997	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.543940067 CET	443	49997	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.544028997 CET	50002	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.544047117 CET	443	50002	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.544118881 CET	50002	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.544224977 CET	50002	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.544234991 CET	443	50002	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.546226978 CET	50003	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.546236992 CET	443	50003	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.546308041 CET	50003	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.546427011 CET	50003	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.546439886 CET	443	50003	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.652899027 CET	443	49999	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.653511047 CET	49999	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.653547049 CET	443	49999	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.653990030 CET	49999	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.654004097 CET	443	49999	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.683919907 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.683947086 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.683964014 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.684029102 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:47.684045076 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.684056997 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:47.684089899 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:47.788372993 CET	443	49999	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.788734913 CET	443	49999	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.788780928 CET	443	49999	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.788861990 CET	49999	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.789371014 CET	49999	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.789371014 CET	49999	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.789417982 CET	443	49999	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.789446115 CET	443	49999	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.792623997 CET	50004	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.792675972 CET	443	50004	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.792768002 CET	50004	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.792941093 CET	50004	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:47.792970896 CET	443	50004	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:47.802666903 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.802725077 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.802742958 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:47.802769899 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.802784920 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:47.803020954 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.803174019 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:47.820420980 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:47.820436954 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:47.820461988 CET	49998	443	192.168.2.5	172.202.163.200
Oct 28, 2024 21:02:47.820467949 CET	443	49998	172.202.163.200	192.168.2.5
Oct 28, 2024 21:02:48.080395937 CET	49930	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:02:48.080405951 CET	443	49930	142.250.184.196	192.168.2.5
Oct 28, 2024 21:02:48.277363062 CET	443	50002	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.277446032 CET	443	50000	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.278012037 CET	50002	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.278050900 CET	443	50002	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.278320074 CET	50000	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.278326035 CET	443	50000	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.278487921 CET	50002	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.278491974 CET	443	50002	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.278750896 CET	50000	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.278754950 CET	443	50000	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.289041042 CET	443	50001	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.289395094 CET	50001	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.289429903 CET	443	50001	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.289813042 CET	50001	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.289819002 CET	443	50001	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.292568922 CET	443	50003	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.292959929 CET	50003	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.292973042 CET	443	50003	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.293456078 CET	50003	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.293462992 CET	443	50003	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.408046961 CET	443	50002	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.408085108 CET	443	50002	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.408143044 CET	443	50002	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.408171892 CET	50002	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.408190012 CET	50002	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.408456087 CET	50002	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.408468962 CET	443	50002	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.408478975 CET	50002	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.408483982 CET	443	50002	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.411495924 CET	50005	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.411539078 CET	443	50005	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.411627054 CET	50005	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.411770105 CET	50005	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.411786079 CET	443	50005	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.412087917 CET	443	50000	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.412147999 CET	443	50000	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.412201881 CET	50000	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.412312984 CET	50000	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.412319899 CET	443	50000	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.412328005 CET	50000	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.412333012 CET	443	50000	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.414303064 CET	50006	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.414346933 CET	443	50006	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.414407969 CET	50006	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.414511919 CET	50006	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.414529085 CET	443	50006	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.421652079 CET	443	50001	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.421755075 CET	443	50001	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.423887014 CET	50001	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.424180984 CET	50001	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.424180984 CET	50001	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.424199104 CET	443	50001	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.424211025 CET	443	50001	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.431404114 CET	443	50003	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.431546926 CET	443	50003	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.431619883 CET	50003	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.431864977 CET	50003	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.431874990 CET	443	50003	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.431906939 CET	50003	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.431912899 CET	443	50003	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.455777884 CET	50007	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.455816984 CET	443	50007	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.455894947 CET	50007	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.456067085 CET	50007	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.456080914 CET	443	50007	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.457071066 CET	50008	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.457097054 CET	443	50008	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.459995985 CET	50008	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.460139990 CET	50008	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.460150957 CET	443	50008	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.541778088 CET	443	50004	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.548832893 CET	50004	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.548850060 CET	443	50004	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.549469948 CET	50004	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.549480915 CET	443	50004	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.679037094 CET	443	50004	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.679110050 CET	443	50004	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.679881096 CET	50004	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.690231085 CET	50004	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.690263987 CET	443	50004	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.690280914 CET	50004	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.690289974 CET	443	50004	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.753947973 CET	50009	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.753988981 CET	443	50009	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:48.754082918 CET	50009	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.762182951 CET	50009	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:48.762198925 CET	443	50009	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.158267975 CET	443	50006	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.158958912 CET	50006	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.158987045 CET	443	50006	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.159460068 CET	50006	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.159466982 CET	443	50006	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.190859079 CET	443	50007	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.191611052 CET	50007	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.191632986 CET	443	50007	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.192084074 CET	50007	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.192090034 CET	443	50007	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.204926014 CET	443	50008	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.205400944 CET	50008	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.205410004 CET	443	50008	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.205775976 CET	50008	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.205780983 CET	443	50008	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.209716082 CET	443	50005	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.210084915 CET	50005	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.210095882 CET	443	50005	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.210403919 CET	50005	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.210407972 CET	443	50005	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.684345007 CET	443	50006	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.684416056 CET	443	50006	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.684467077 CET	50006	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.684748888 CET	50006	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.684772015 CET	443	50006	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.684794903 CET	50006	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.684803963 CET	443	50006	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.687120914 CET	443	50007	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.687153101 CET	443	50007	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.687201977 CET	443	50007	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.687223911 CET	50007	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.687273026 CET	50007	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.687453985 CET	50007	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.687453985 CET	50007	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.687474012 CET	443	50007	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.687483072 CET	443	50007	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.687973022 CET	50010	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.688033104 CET	443	50010	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.688138008 CET	50010	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.688448906 CET	50010	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.688478947 CET	443	50010	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.689244032 CET	443	50005	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.689246893 CET	443	50008	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.689316988 CET	443	50005	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.689382076 CET	50005	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.689393044 CET	443	50005	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.689405918 CET	443	50008	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.689456940 CET	443	50005	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.689461946 CET	50008	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.689496040 CET	50005	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.689496040 CET	50005	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.689507008 CET	443	50005	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.689529896 CET	50005	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.689537048 CET	443	50005	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.689543962 CET	50008	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.689568996 CET	443	50008	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.689594030 CET	50008	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.689606905 CET	443	50008	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.690366983 CET	50011	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.690398932 CET	443	50011	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.690458059 CET	50011	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.690896988 CET	50011	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.690911055 CET	443	50011	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.691682100 CET	50012	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.691715956 CET	443	50012	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.691807985 CET	50012	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.692116976 CET	50013	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.692132950 CET	443	50013	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.692152023 CET	50012	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.692162991 CET	443	50012	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.692192078 CET	50013	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.692341089 CET	50013	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.692352057 CET	443	50013	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.825550079 CET	443	50009	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.826224089 CET	50009	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.826241970 CET	443	50009	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.826966047 CET	50009	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.826972961 CET	443	50009	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.966306925 CET	443	50009	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.966471910 CET	443	50009	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.966562033 CET	50009	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.966772079 CET	50009	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.966787100 CET	443	50009	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.966810942 CET	50009	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.966819048 CET	443	50009	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.970695972 CET	50014	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.970729113 CET	443	50014	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:49.970825911 CET	50014	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.970962048 CET	50014	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:49.970973969 CET	443	50014	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.424253941 CET	443	50011	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.428582907 CET	50011	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.428596973 CET	443	50011	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.429089069 CET	50011	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.429096937 CET	443	50011	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.431269884 CET	443	50012	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.434385061 CET	50012	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.434415102 CET	443	50012	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.434976101 CET	50012	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.434982061 CET	443	50012	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.449592113 CET	443	50010	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.449975014 CET	50010	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.449981928 CET	443	50010	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.450541019 CET	50010	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.450545073 CET	443	50010	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.452789068 CET	443	50013	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.453666925 CET	50013	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.453695059 CET	443	50013	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.454391003 CET	50013	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.454397917 CET	443	50013	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.554325104 CET	443	50011	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.554481983 CET	443	50011	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.554543972 CET	443	50011	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.554639101 CET	50011	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.554816008 CET	50011	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.554837942 CET	443	50011	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.554851055 CET	50011	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.554858923 CET	443	50011	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.558286905 CET	50015	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.558336020 CET	443	50015	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.558433056 CET	50015	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.558729887 CET	50015	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.558743000 CET	443	50015	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.563077927 CET	443	50012	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.563342094 CET	443	50012	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.563899040 CET	50012	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.563930988 CET	50012	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.563930988 CET	50012	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.563950062 CET	443	50012	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.563958883 CET	443	50012	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.567047119 CET	50016	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.567074060 CET	443	50016	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.567163944 CET	50016	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.567334890 CET	50016	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.567343950 CET	443	50016	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.579139948 CET	443	50010	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.579767942 CET	443	50010	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.579941034 CET	50010	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.580461979 CET	50010	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.580476999 CET	443	50010	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.580512047 CET	50010	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.580519915 CET	443	50010	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.584687948 CET	443	50013	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.585025072 CET	443	50013	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.585078001 CET	443	50013	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.585160971 CET	50013	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.588654995 CET	50013	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.588665962 CET	443	50013	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.588680029 CET	50013	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.588686943 CET	443	50013	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.596303940 CET	50017	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.596348047 CET	443	50017	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.596462965 CET	50017	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.596873045 CET	50018	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.596885920 CET	443	50018	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.596901894 CET	50017	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.596918106 CET	443	50017	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.596971989 CET	50018	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.597044945 CET	50018	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.597049952 CET	443	50018	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.713737011 CET	443	50014	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.714576006 CET	50014	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.714607000 CET	443	50014	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.715342045 CET	50014	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.715347052 CET	443	50014	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.846342087 CET	443	50014	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.846513033 CET	443	50014	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.846587896 CET	50014	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.846884012 CET	50014	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.846904039 CET	443	50014	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.846915007 CET	50014	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.846920967 CET	443	50014	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.851277113 CET	50019	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.851320028 CET	443	50019	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:50.851671934 CET	50019	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.851850986 CET	50019	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:50.851866961 CET	443	50019	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.292737961 CET	443	50015	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.296380043 CET	50015	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.296391010 CET	443	50015	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.296880960 CET	50015	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.296886921 CET	443	50015	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.332685947 CET	443	50017	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.333210945 CET	50017	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.333223104 CET	443	50017	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.333687067 CET	50017	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.333698988 CET	443	50017	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.339601994 CET	443	50016	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.339915991 CET	50016	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.339926004 CET	443	50016	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.340364933 CET	50016	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.340368986 CET	443	50016	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.343930960 CET	443	50018	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.344374895 CET	50018	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.344381094 CET	443	50018	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.344775915 CET	50018	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.344779015 CET	443	50018	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.426925898 CET	443	50015	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.427396059 CET	443	50015	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.427453995 CET	50015	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.427473068 CET	443	50015	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.427552938 CET	443	50015	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.427560091 CET	50015	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.427571058 CET	50015	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.427599907 CET	443	50015	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.427607059 CET	50015	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.427622080 CET	443	50015	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.430610895 CET	50020	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.430636883 CET	443	50020	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.430717945 CET	50020	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.430867910 CET	50020	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.430880070 CET	443	50020	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.464699984 CET	443	50017	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.464970112 CET	443	50017	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.465039015 CET	50017	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.465162992 CET	50017	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.465181112 CET	443	50017	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.465193033 CET	50017	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.465199947 CET	443	50017	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.468389034 CET	50021	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.468422890 CET	443	50021	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.468514919 CET	50021	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.468669891 CET	50021	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.468682051 CET	443	50021	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.474622965 CET	443	50018	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.474880934 CET	443	50018	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.474944115 CET	50018	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.474987984 CET	50018	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.475001097 CET	443	50018	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.475018024 CET	50018	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.475023985 CET	443	50018	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.476797104 CET	443	50016	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.476898909 CET	443	50016	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.477027893 CET	50016	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.477332115 CET	50016	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.477339029 CET	443	50016	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.477358103 CET	50016	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.477365971 CET	443	50016	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.477823019 CET	50022	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.477854967 CET	443	50022	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.477936029 CET	50022	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.478044987 CET	50022	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.478056908 CET	443	50022	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.479510069 CET	50023	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.479538918 CET	443	50023	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.479595900 CET	50023	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.479712963 CET	50023	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.479724884 CET	443	50023	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.591090918 CET	443	50019	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.592320919 CET	50019	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.592336893 CET	443	50019	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.592870951 CET	50019	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.592878103 CET	443	50019	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.726716995 CET	443	50019	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.726794958 CET	443	50019	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.726866961 CET	443	50019	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.726891994 CET	50019	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.726923943 CET	50019	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.727138996 CET	50019	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.727158070 CET	443	50019	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.727185011 CET	50019	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.727190971 CET	443	50019	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.730449915 CET	50024	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.730504036 CET	443	50024	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:51.730587006 CET	50024	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.730743885 CET	50024	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:51.730761051 CET	443	50024	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.443727970 CET	443	50021	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.444413900 CET	50021	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.444432020 CET	443	50021	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.444967985 CET	50021	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.444974899 CET	443	50021	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.446122885 CET	443	50022	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.448158026 CET	50022	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.448165894 CET	443	50022	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.448961973 CET	50022	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.448966980 CET	443	50022	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.572046995 CET	443	50024	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.572623014 CET	50024	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.572658062 CET	443	50024	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.573123932 CET	50024	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.573137045 CET	443	50024	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.582199097 CET	443	50021	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.582264900 CET	443	50022	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.582271099 CET	443	50021	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.582333088 CET	50021	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.582346916 CET	443	50022	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.582402945 CET	50022	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.582642078 CET	50021	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.582659960 CET	443	50021	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.582673073 CET	50021	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.582679033 CET	443	50021	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.582845926 CET	50022	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.582866907 CET	443	50022	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.582876921 CET	50022	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.582882881 CET	443	50022	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.590797901 CET	50025	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.590837002 CET	443	50025	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.590914011 CET	50025	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.598870039 CET	50025	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.598889112 CET	443	50025	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.600114107 CET	50026	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.600174904 CET	443	50026	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.600266933 CET	50026	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.600431919 CET	50026	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.600460052 CET	443	50026	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.702430010 CET	443	50024	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.702579975 CET	443	50024	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.702645063 CET	50024	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.705888987 CET	50024	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.705916882 CET	443	50024	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.705941916 CET	50024	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.705955982 CET	443	50024	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.709292889 CET	50027	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.709323883 CET	443	50027	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:52.709408045 CET	50027	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.709568977 CET	50027	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:52.709583044 CET	443	50027	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:53.321366072 CET	443	50026	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:53.329596043 CET	443	50025	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:53.371288061 CET	50025	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:53.371287107 CET	50026	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:53.448740959 CET	50026	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:53.448751926 CET	443	50026	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:53.449796915 CET	443	50027	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:53.469280005 CET	50026	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:53.469294071 CET	443	50026	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:53.479337931 CET	50025	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:53.479348898 CET	443	50025	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:53.481451988 CET	50025	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:53.481457949 CET	443	50025	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:53.485732079 CET	50027	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:53.485739946 CET	443	50027	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:53.486160040 CET	50027	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:53.486166000 CET	443	50027	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.033958912 CET	443	50026	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.034044981 CET	443	50026	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.034431934 CET	50026	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.034837008 CET	50026	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.034883976 CET	443	50026	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.034914970 CET	50026	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.034930944 CET	443	50026	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.035190105 CET	443	50025	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.035279989 CET	443	50025	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.035761118 CET	443	50027	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.035835981 CET	50025	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.035847902 CET	443	50027	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.035906076 CET	50025	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.035926104 CET	443	50025	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.035936117 CET	50027	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.035948038 CET	443	50027	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.035959005 CET	50025	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.035964966 CET	443	50025	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.035973072 CET	443	50027	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.036010027 CET	50027	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.036847115 CET	50027	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.036853075 CET	443	50027	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.036860943 CET	50027	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.036865950 CET	443	50027	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.038851023 CET	50028	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.038887978 CET	443	50028	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.038959026 CET	50028	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.039628983 CET	50029	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.039668083 CET	443	50029	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.039786100 CET	50028	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.039798975 CET	443	50028	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.039813995 CET	50029	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.040061951 CET	50030	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.040071011 CET	443	50030	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.040122986 CET	50029	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.040138960 CET	443	50029	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.040139914 CET	50030	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.040255070 CET	50030	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.040265083 CET	443	50030	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.782160997 CET	443	50030	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.782830000 CET	443	50029	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.783128023 CET	50030	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.783153057 CET	443	50030	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.783670902 CET	50030	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.783677101 CET	443	50030	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.783905983 CET	50029	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.783931971 CET	443	50029	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.784269094 CET	50029	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.784276962 CET	443	50029	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.785073042 CET	443	50028	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.785315037 CET	50028	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.785325050 CET	443	50028	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.785685062 CET	50028	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.785691023 CET	443	50028	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.916197062 CET	443	50030	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.916579962 CET	443	50030	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.916661024 CET	50030	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.916683912 CET	443	50030	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.916716099 CET	443	50030	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.916806936 CET	443	50029	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.916874886 CET	50030	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.916874886 CET	50030	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.916898012 CET	443	50030	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.916930914 CET	50030	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.916939020 CET	443	50030	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.916965961 CET	443	50029	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.917102098 CET	443	50028	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.917165041 CET	50029	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.917186975 CET	443	50028	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.917314053 CET	50029	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.917324066 CET	443	50029	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.917335987 CET	50028	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.917385101 CET	50028	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.917385101 CET	50028	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.917392969 CET	443	50028	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.917403936 CET	443	50028	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.920303106 CET	50031	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.920315027 CET	443	50031	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.920353889 CET	50032	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.920393944 CET	50031	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.920413971 CET	443	50032	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.920475960 CET	50032	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.920631886 CET	50031	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.920646906 CET	443	50031	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.920739889 CET	50032	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.920766115 CET	443	50032	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.921487093 CET	50033	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.921545029 CET	443	50033	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:54.921619892 CET	50033	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.921753883 CET	50033	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:54.921782970 CET	443	50033	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.654860020 CET	443	50031	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.656162977 CET	443	50033	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.662673950 CET	443	50032	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.678977013 CET	50032	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.678999901 CET	443	50032	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.679471016 CET	50032	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.679477930 CET	443	50032	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.679873943 CET	50031	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.679883957 CET	443	50031	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.680226088 CET	50031	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.680229902 CET	443	50031	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.680409908 CET	50033	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.680433989 CET	443	50033	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.680736065 CET	50033	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.680747986 CET	443	50033	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.810791016 CET	443	50031	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.810960054 CET	443	50031	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.811043978 CET	50031	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.814994097 CET	443	50033	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.815300941 CET	443	50033	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.815457106 CET	50033	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.818403006 CET	443	50032	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.818458080 CET	443	50032	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.818516016 CET	50032	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.818536043 CET	443	50032	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.818599939 CET	443	50032	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.818655968 CET	50032	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.823466063 CET	50031	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.823481083 CET	443	50031	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.823492050 CET	50031	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.823497057 CET	443	50031	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.835863113 CET	50033	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.835880041 CET	443	50033	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.835894108 CET	50033	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.835900068 CET	443	50033	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.848004103 CET	50032	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.848032951 CET	443	50032	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.848061085 CET	50032	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.848077059 CET	443	50032	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.989470959 CET	50034	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.989504099 CET	443	50034	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.989573002 CET	50034	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.990684986 CET	50035	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.990722895 CET	443	50035	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.990776062 CET	50035	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.991750002 CET	50036	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.991781950 CET	443	50036	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.991830111 CET	50036	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.992207050 CET	50034	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.992223024 CET	443	50034	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.992353916 CET	50035	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.992371082 CET	443	50035	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:55.993057966 CET	50036	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:55.993068933 CET	443	50036	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.744029999 CET	443	50034	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.744752884 CET	50034	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.744770050 CET	443	50034	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.745263100 CET	50034	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.745273113 CET	443	50034	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.769036055 CET	443	50035	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.769622087 CET	50035	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.769633055 CET	443	50035	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.770395994 CET	50035	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.770401001 CET	443	50035	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.781691074 CET	443	50036	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.782155991 CET	50036	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.782167912 CET	443	50036	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.782576084 CET	50036	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.782579899 CET	443	50036	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.876411915 CET	443	50034	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.877274990 CET	443	50034	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.879920006 CET	50034	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.879956007 CET	50034	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.879966021 CET	443	50034	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.879977942 CET	50034	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.879982948 CET	443	50034	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.883315086 CET	50037	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.883373022 CET	443	50037	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.883477926 CET	50037	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.883685112 CET	50037	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.883714914 CET	443	50037	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.912801027 CET	443	50035	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.912863970 CET	443	50035	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.912945032 CET	50035	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.912961960 CET	443	50035	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.912995100 CET	443	50035	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.913058043 CET	50035	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.915822029 CET	50035	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.915855885 CET	443	50035	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.919564962 CET	443	50036	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.919987917 CET	50038	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.920012951 CET	443	50038	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.920083046 CET	50038	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.920331955 CET	50038	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.920341969 CET	443	50038	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.920430899 CET	443	50036	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.920501947 CET	50036	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.920558929 CET	50036	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.920569897 CET	443	50036	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.920581102 CET	50036	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.920584917 CET	443	50036	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.922945023 CET	50039	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.922960043 CET	443	50039	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:56.923090935 CET	50039	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.923259974 CET	50039	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:56.923269987 CET	443	50039	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.664397001 CET	443	50037	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.665051937 CET	50037	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.665081978 CET	443	50037	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.665570974 CET	50037	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.665576935 CET	443	50037	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.671516895 CET	443	50038	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.671909094 CET	50038	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.671921968 CET	443	50038	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.672307968 CET	50038	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.672312975 CET	443	50038	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.682687998 CET	443	50039	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.683059931 CET	50039	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.683068037 CET	443	50039	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.683408976 CET	50039	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.683413982 CET	443	50039	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.798191071 CET	443	50037	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.799052000 CET	443	50037	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.799117088 CET	50037	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.799160957 CET	50037	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.799180984 CET	443	50037	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.799196005 CET	50037	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.799202919 CET	443	50037	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.802335978 CET	443	50038	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.802359104 CET	443	50038	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.802423954 CET	50038	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.802445889 CET	443	50038	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.802541971 CET	50040	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.802562952 CET	443	50038	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.802577972 CET	443	50040	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.802609921 CET	50038	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.802660942 CET	50040	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.802723885 CET	50038	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.802743912 CET	443	50038	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.802755117 CET	50038	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.802759886 CET	443	50038	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.802803040 CET	50040	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.802813053 CET	443	50040	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.805274963 CET	50041	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.805308104 CET	443	50041	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.805376053 CET	50041	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.805514097 CET	50041	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.805527925 CET	443	50041	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.854981899 CET	443	50039	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.855180025 CET	443	50039	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.855236053 CET	50039	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.855303049 CET	50039	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.855321884 CET	443	50039	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.855338097 CET	50039	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.855345011 CET	443	50039	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.859056950 CET	50042	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.859076977 CET	443	50042	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:57.859154940 CET	50042	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.859335899 CET	50042	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:57.859349966 CET	443	50042	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.308455944 CET	443	50023	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.322904110 CET	443	50020	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.356229067 CET	50023	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.371757984 CET	50020	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.424854994 CET	50023	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.424861908 CET	443	50023	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.425374985 CET	50023	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.425379992 CET	443	50023	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.426129103 CET	50020	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.426146984 CET	443	50020	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.426507950 CET	50020	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.426515102 CET	443	50020	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.541337013 CET	443	50040	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.557070017 CET	443	50020	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.557226896 CET	443	50020	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.557310104 CET	50020	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.557537079 CET	443	50023	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.557704926 CET	443	50023	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.557715893 CET	443	50041	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.557770014 CET	50023	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.590521097 CET	50040	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.606137037 CET	50041	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.694575071 CET	50040	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.694581032 CET	443	50040	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.695054054 CET	50040	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.695058107 CET	443	50040	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.695251942 CET	50020	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.695281029 CET	443	50020	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.695297003 CET	50020	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.695306063 CET	443	50020	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.696588993 CET	50023	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.696588993 CET	50023	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.696614027 CET	443	50023	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.696625948 CET	443	50023	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.697603941 CET	50041	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.697612047 CET	443	50041	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.698020935 CET	50041	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.698026896 CET	443	50041	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.711139917 CET	50043	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.711167097 CET	443	50043	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.711260080 CET	50043	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.711385012 CET	50043	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.711397886 CET	443	50043	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.712059021 CET	50044	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.712090969 CET	443	50044	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.713315964 CET	50044	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.713530064 CET	50044	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.713546038 CET	443	50044	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.823416948 CET	443	50040	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.823468924 CET	443	50040	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.823628902 CET	443	50040	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.823692083 CET	50040	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.823793888 CET	50040	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.823806047 CET	443	50040	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.823820114 CET	50040	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.823824883 CET	443	50040	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.827014923 CET	50045	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.827049971 CET	443	50045	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.827137947 CET	50045	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.827311039 CET	50045	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.827332973 CET	443	50045	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.840801001 CET	443	50041	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.840848923 CET	443	50041	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.840919018 CET	50041	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.840929031 CET	443	50041	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.840981960 CET	443	50041	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.841176033 CET	50041	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.841193914 CET	443	50041	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.841207981 CET	50041	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.841214895 CET	443	50041	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.841284037 CET	50041	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.841289043 CET	443	50041	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.843394995 CET	50046	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.843421936 CET	443	50046	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.843514919 CET	50046	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.843641043 CET	50046	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.843655109 CET	443	50046	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.936588049 CET	443	50042	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.937119007 CET	50042	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.937134027 CET	443	50042	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:58.937861919 CET	50042	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:58.937866926 CET	443	50042	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.067368984 CET	443	50042	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.067433119 CET	443	50042	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.067715883 CET	50042	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.067727089 CET	443	50042	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.067810059 CET	50042	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.067823887 CET	443	50042	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.067831039 CET	50042	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.068141937 CET	443	50042	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.068217039 CET	443	50042	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.070220947 CET	50042	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.070775986 CET	50047	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.070816994 CET	443	50047	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.070885897 CET	50047	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.071043968 CET	50047	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.071059942 CET	443	50047	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.453088999 CET	443	50043	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.453674078 CET	50043	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.453700066 CET	443	50043	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.454164028 CET	50043	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.454169989 CET	443	50043	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.469249010 CET	443	50044	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.469594002 CET	50044	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.469604969 CET	443	50044	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.469993114 CET	50044	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.470000029 CET	443	50044	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.949374914 CET	443	50043	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.949425936 CET	443	50043	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.949481010 CET	50043	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.949502945 CET	443	50043	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.949588060 CET	443	50043	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.949647903 CET	50043	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.949836016 CET	50043	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.949873924 CET	443	50043	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.949913025 CET	50043	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.949928045 CET	443	50043	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.953308105 CET	443	50045	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.953375101 CET	50048	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.953408003 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.953474998 CET	50048	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.953672886 CET	50048	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.953679085 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.953747988 CET	50045	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.953790903 CET	443	50045	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.953929901 CET	443	50046	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.954301119 CET	50045	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.954309940 CET	443	50045	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.954328060 CET	50046	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.954343081 CET	443	50046	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.954801083 CET	50046	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.954807997 CET	443	50046	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.971409082 CET	443	50044	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.971564054 CET	443	50044	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.971647978 CET	50044	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.971735001 CET	50044	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.971749067 CET	443	50044	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.971757889 CET	50044	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.971764088 CET	443	50044	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.974078894 CET	50049	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.974128962 CET	443	50049	13.107.246.45	192.168.2.5
Oct 28, 2024 21:02:59.974203110 CET	50049	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.974356890 CET	50049	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:02:59.974381924 CET	443	50049	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.093291998 CET	443	50047	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.093861103 CET	50047	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.093887091 CET	443	50047	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.094357967 CET	50047	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.094366074 CET	443	50047	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.110274076 CET	443	50046	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.110419989 CET	443	50046	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.110497952 CET	50046	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.110601902 CET	50046	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.110615969 CET	443	50046	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.110625982 CET	50046	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.110631943 CET	443	50046	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.110670090 CET	443	50045	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.110841990 CET	443	50045	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.110902071 CET	50045	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.110932112 CET	50045	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.110932112 CET	50045	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.110946894 CET	443	50045	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.110960007 CET	443	50045	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.114034891 CET	50050	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.114062071 CET	443	50050	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.114088058 CET	50051	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.114120007 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.114130020 CET	50050	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.114181042 CET	50051	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.114265919 CET	50050	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.114279985 CET	443	50050	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.114325047 CET	50051	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.114351988 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.224495888 CET	443	50047	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.224642038 CET	443	50047	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.224704981 CET	50047	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.224880934 CET	50047	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.224894047 CET	443	50047	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.224905014 CET	50047	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.224912882 CET	443	50047	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.227924109 CET	50052	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.227951050 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.228022099 CET	50052	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.228171110 CET	50052	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.228183031 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.705270052 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.705863953 CET	50048	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.705876112 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.706397057 CET	50048	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.706401110 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.729872942 CET	443	50049	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.753396988 CET	50049	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.753418922 CET	443	50049	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.753880024 CET	50049	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.753891945 CET	443	50049	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.835151911 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.835205078 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.835273981 CET	50048	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.835285902 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.835351944 CET	50048	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.835397005 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.835505009 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.835581064 CET	50048	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.835597038 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.835607052 CET	50048	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.835613966 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.835619926 CET	50048	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.835623980 CET	443	50048	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.838855982 CET	50053	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.838893890 CET	443	50053	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.839106083 CET	50053	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.839296103 CET	50053	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.839308977 CET	443	50053	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.853856087 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.854091883 CET	443	50050	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.854559898 CET	50051	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.854583979 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.855046034 CET	50051	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.855056047 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.855331898 CET	50050	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.855340004 CET	443	50050	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.855760098 CET	50050	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.855766058 CET	443	50050	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.883136988 CET	443	50049	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.883166075 CET	443	50049	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.883230925 CET	443	50049	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.883238077 CET	50049	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.883915901 CET	50049	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.883984089 CET	50049	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.883984089 CET	50049	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.884037018 CET	443	50049	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.884059906 CET	443	50049	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.887994051 CET	50054	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.888025045 CET	443	50054	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.888098955 CET	50054	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.888254881 CET	50054	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.888273954 CET	443	50054	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.986222029 CET	443	50050	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.986283064 CET	443	50050	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.986409903 CET	443	50050	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.986496925 CET	50050	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.986665010 CET	50050	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.986665010 CET	50050	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.986681938 CET	443	50050	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.986691952 CET	443	50050	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.989782095 CET	50055	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.989815950 CET	443	50055	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.989902020 CET	50055	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.990098953 CET	50055	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.990112066 CET	443	50055	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.996771097 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.997232914 CET	50052	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.997246981 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:00.997740984 CET	50052	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:00.997746944 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.104635954 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.104720116 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.104773998 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.104793072 CET	50051	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.104825020 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.104847908 CET	50051	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.104876995 CET	50051	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.104937077 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.105003119 CET	50051	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.105010033 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.105103970 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.105155945 CET	50051	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.105257988 CET	50051	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.105279922 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.105293989 CET	50051	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.105299950 CET	443	50051	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.108699083 CET	50056	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.108767033 CET	443	50056	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.108844042 CET	50056	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.108984947 CET	50056	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.109016895 CET	443	50056	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.349667072 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.349683046 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.349704027 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.349752903 CET	50052	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.349764109 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.349797010 CET	50052	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.349813938 CET	50052	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.469470978 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.469563961 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.469574928 CET	50052	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.469628096 CET	50052	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.469806910 CET	50052	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.469820976 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.469835043 CET	50052	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.469841957 CET	443	50052	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.473289013 CET	50057	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.473345041 CET	443	50057	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.473450899 CET	50057	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.473627090 CET	50057	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.473655939 CET	443	50057	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.574951887 CET	443	50053	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.575618982 CET	50053	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.575634956 CET	443	50053	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.576065063 CET	50053	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.576070070 CET	443	50053	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.621309996 CET	443	50054	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.621877909 CET	50054	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.621896982 CET	443	50054	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.622289896 CET	50054	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.622297049 CET	443	50054	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.707349062 CET	443	50053	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.707407951 CET	443	50053	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.707465887 CET	50053	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.707480907 CET	443	50053	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.707519054 CET	50053	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.707539082 CET	443	50053	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.707585096 CET	50053	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.707683086 CET	50053	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.707698107 CET	443	50053	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.707707882 CET	50053	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.707714081 CET	443	50053	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.710623980 CET	50058	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.710690975 CET	443	50058	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.710782051 CET	50058	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.710932970 CET	50058	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.710964918 CET	443	50058	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.743144989 CET	443	50055	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.743587971 CET	50055	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.743602991 CET	443	50055	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.744049072 CET	50055	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.744055986 CET	443	50055	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.750679016 CET	443	50054	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.750704050 CET	443	50054	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.750777006 CET	50054	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.750804901 CET	443	50054	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.750823021 CET	443	50054	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.750873089 CET	50054	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.752643108 CET	50054	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.752669096 CET	443	50054	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.752684116 CET	50054	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.752692938 CET	443	50054	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.759552956 CET	50059	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.759609938 CET	443	50059	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.759713888 CET	50059	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.759850025 CET	50059	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.759880066 CET	443	50059	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.835764885 CET	443	50056	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.836244106 CET	50056	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.836278915 CET	443	50056	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.836731911 CET	50056	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.836745977 CET	443	50056	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.892414093 CET	443	50055	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.892852068 CET	443	50055	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.892930984 CET	50055	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.892976999 CET	50055	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.892988920 CET	443	50055	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.893002033 CET	50055	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.893006086 CET	443	50055	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.896090031 CET	50060	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.896110058 CET	443	50060	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.896186113 CET	50060	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.896348953 CET	50060	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.896359921 CET	443	50060	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.966028929 CET	443	50056	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.966181040 CET	443	50056	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.966243982 CET	50056	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.966415882 CET	50056	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.966415882 CET	50056	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.966454983 CET	443	50056	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.966483116 CET	443	50056	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.969470024 CET	50061	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.969516993 CET	443	50061	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:01.969607115 CET	50061	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.969782114 CET	50061	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:01.969804049 CET	443	50061	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.220725060 CET	443	50057	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.221286058 CET	50057	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.221318960 CET	443	50057	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.221807003 CET	50057	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.221817970 CET	443	50057	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.357784033 CET	443	50057	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.357872009 CET	443	50057	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.358159065 CET	50057	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.358215094 CET	50057	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.358247042 CET	443	50057	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.358274937 CET	50057	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.358290911 CET	443	50057	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.361587048 CET	50062	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.361612082 CET	443	50062	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.361691952 CET	50062	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.361861944 CET	50062	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.361871004 CET	443	50062	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.446384907 CET	443	50058	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.447058916 CET	50058	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.447067022 CET	443	50058	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.447680950 CET	50058	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.447686911 CET	443	50058	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.512320995 CET	443	50059	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.512921095 CET	50059	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.512929916 CET	443	50059	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.513581038 CET	50059	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.513586044 CET	443	50059	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.579349995 CET	443	50058	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.579621077 CET	443	50058	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.579751968 CET	50058	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.579752922 CET	50058	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.579838991 CET	50058	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.579879045 CET	443	50058	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.583127022 CET	50063	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.583190918 CET	443	50063	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.583275080 CET	50063	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.583401918 CET	50063	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.583425045 CET	443	50063	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.637428999 CET	443	50060	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.637916088 CET	50060	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.637933016 CET	443	50060	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.638565063 CET	50060	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.638571024 CET	443	50060	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.644153118 CET	443	50059	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.644184113 CET	443	50059	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.644224882 CET	443	50059	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.644294024 CET	50059	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.644422054 CET	50059	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.644422054 CET	50059	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.644450903 CET	443	50059	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.644473076 CET	443	50059	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.706526995 CET	443	50061	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.707072020 CET	50061	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.707088947 CET	443	50061	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.707683086 CET	50061	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.707689047 CET	443	50061	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.767941952 CET	443	50060	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.768080950 CET	443	50060	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.768214941 CET	50060	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.768382072 CET	50060	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.768382072 CET	50060	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.768393993 CET	443	50060	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.768402100 CET	443	50060	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.836966038 CET	443	50061	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.837121964 CET	443	50061	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.837192059 CET	50061	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.837446928 CET	50061	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.837469101 CET	443	50061	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:02.837486982 CET	50061	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:02.837493896 CET	443	50061	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.095438957 CET	443	50062	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.096146107 CET	50062	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:03.096157074 CET	443	50062	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.096616030 CET	50062	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:03.096621037 CET	443	50062	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.230791092 CET	443	50062	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.230932951 CET	443	50062	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.231045008 CET	50062	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:03.231868029 CET	50062	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:03.231868029 CET	50062	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:03.231880903 CET	443	50062	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.231889963 CET	443	50062	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.321074963 CET	443	50063	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.321662903 CET	50063	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:03.321696997 CET	443	50063	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.322177887 CET	50063	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:03.322191000 CET	443	50063	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.453947067 CET	443	50063	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.454102993 CET	443	50063	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.454206944 CET	50063	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:03.454406977 CET	50063	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:03.454425097 CET	443	50063	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:03.454435110 CET	50063	443	192.168.2.5	13.107.246.45
Oct 28, 2024 21:03:03.454441071 CET	443	50063	13.107.246.45	192.168.2.5
Oct 28, 2024 21:03:08.687237978 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:03:08.687333107 CET	443	49952	23.1.237.91	192.168.2.5
Oct 28, 2024 21:03:08.687369108 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:03:08.687407970 CET	49952	443	192.168.2.5	23.1.237.91
Oct 28, 2024 21:03:35.451719999 CET	50067	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:03:35.451826096 CET	443	50067	142.250.184.196	192.168.2.5
Oct 28, 2024 21:03:35.451986074 CET	50067	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:03:35.452227116 CET	50067	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:03:35.452255964 CET	443	50067	142.250.184.196	192.168.2.5
Oct 28, 2024 21:03:36.736104965 CET	443	50067	142.250.184.196	192.168.2.5
Oct 28, 2024 21:03:36.736608982 CET	50067	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:03:36.736628056 CET	443	50067	142.250.184.196	192.168.2.5
Oct 28, 2024 21:03:36.737883091 CET	443	50067	142.250.184.196	192.168.2.5
Oct 28, 2024 21:03:36.738203049 CET	50067	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:03:36.738408089 CET	443	50067	142.250.184.196	192.168.2.5
Oct 28, 2024 21:03:36.793246984 CET	50067	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:03:46.646725893 CET	443	50067	142.250.184.196	192.168.2.5
Oct 28, 2024 21:03:46.646866083 CET	443	50067	142.250.184.196	192.168.2.5
Oct 28, 2024 21:03:46.646934032 CET	50067	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:03:48.076325893 CET	50067	443	192.168.2.5	142.250.184.196
Oct 28, 2024 21:03:48.076370001 CET	443	50067	142.250.184.196	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 21:02:31.680037022 CET	53	64836	1.1.1.1	192.168.2.5
Oct 28, 2024 21:02:31.749113083 CET	53	63797	1.1.1.1	192.168.2.5
Oct 28, 2024 21:02:33.007395983 CET	53	63959	1.1.1.1	192.168.2.5
Oct 28, 2024 21:02:33.074234962 CET	63049	53	192.168.2.5	1.1.1.1
Oct 28, 2024 21:02:33.074403048 CET	57402	53	192.168.2.5	1.1.1.1
Oct 28, 2024 21:02:35.388185978 CET	54500	53	192.168.2.5	1.1.1.1
Oct 28, 2024 21:02:35.388443947 CET	62693	53	192.168.2.5	1.1.1.1
Oct 28, 2024 21:02:35.395705938 CET	53	54500	1.1.1.1	192.168.2.5
Oct 28, 2024 21:02:35.396631956 CET	53	62693	1.1.1.1	192.168.2.5
Oct 28, 2024 21:02:35.597013950 CET	56105	53	192.168.2.5	1.1.1.1
Oct 28, 2024 21:02:35.597155094 CET	62750	53	192.168.2.5	1.1.1.1
Oct 28, 2024 21:02:50.177476883 CET	53	62090	1.1.1.1	192.168.2.5
Oct 28, 2024 21:03:08.918654919 CET	53	50864	1.1.1.1	192.168.2.5
Oct 28, 2024 21:03:31.195338964 CET	53	53070	1.1.1.1	192.168.2.5
Oct 28, 2024 21:03:31.865334988 CET	53	59043	1.1.1.1	192.168.2.5
Oct 28, 2024 21:03:59.054012060 CET	53	59937	1.1.1.1	192.168.2.5
Oct 28, 2024 21:04:46.677175045 CET	53	58344	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 21:02:33.074234962 CET	192.168.2.5	1.1.1.1	0x6087	Standard query (0)	resources.finalsite.net	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:02:33.074403048 CET	192.168.2.5	1.1.1.1	0x48ed	Standard query (0)	resources.finalsite.net	65	IN (0x0001)	false
Oct 28, 2024 21:02:35.388185978 CET	192.168.2.5	1.1.1.1	0xd83	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:02:35.388443947 CET	192.168.2.5	1.1.1.1	0xbcb9	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 28, 2024 21:02:35.597013950 CET	192.168.2.5	1.1.1.1	0x60d5	Standard query (0)	resources.finalsite.net	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:02:35.597155094 CET	192.168.2.5	1.1.1.1	0x778b	Standard query (0)	resources.finalsite.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 21:02:13.566690922 CET	1.1.1.1	192.168.2.5	0x4526	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 21:02:33.083894014 CET	1.1.1.1	192.168.2.5	0x48ed	No error (0)	resources.finalsite.net	finalsite-res.cloudinary.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 21:02:33.083894014 CET	1.1.1.1	192.168.2.5	0x48ed	No error (0)	finalsite-res.cloudinary.com	san-ion.cloudinary.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 21:02:33.095427036 CET	1.1.1.1	192.168.2.5	0x6087	No error (0)	resources.finalsite.net	finalsite-res.cloudinary.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 21:02:33.095427036 CET	1.1.1.1	192.168.2.5	0x6087	No error (0)	finalsite-res.cloudinary.com	san-ion.cloudinary.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 21:02:35.395705938 CET	1.1.1.1	192.168.2.5	0xd83	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Oct 28, 2024 21:02:35.396631956 CET	1.1.1.1	192.168.2.5	0xbcb9	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 28, 2024 21:02:35.622526884 CET	1.1.1.1	192.168.2.5	0x778b	No error (0)	resources.finalsite.net	finalsite-res.cloudinary.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 21:02:35.622526884 CET	1.1.1.1	192.168.2.5	0x778b	No error (0)	finalsite-res.cloudinary.com	san-ion.cloudinary.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 21:02:35.633498907 CET	1.1.1.1	192.168.2.5	0x60d5	No error (0)	resources.finalsite.net	finalsite-res.cloudinary.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 21:02:35.633498907 CET	1.1.1.1	192.168.2.5	0x60d5	No error (0)	finalsite-res.cloudinary.com	san-ion.cloudinary.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

slscr.update.microsoft.com

https:

www.bing.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49715	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-28 20:02:05 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 20:02:06 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 20:01:05 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 57e0b13b-3513-40e4-b3d9-ab1f4521bf22 PPServer: PPV: 30 H: SN1PEPF0002F021 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 20:02:05 GMT Connection: close Content-Length: 1276
2024-10-28 20:02:06 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49718	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:07 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-28 20:02:07 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 20:02:07 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 20:01:07 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 767733ef-9242-43c2-836c-88ac5e268def PPServer: PPV: 30 H: PH1PEPF0001B78B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 20:02:07 GMT Connection: close Content-Length: 1276
2024-10-28 20:02:07 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49719	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:07 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-28 20:02:07 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 78 75 71 69 73 6d 6e 66 63 78 66 74 61 65 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 67 4d 37 5a 3d 2f 52 75 48 45 42 54 48 64 71 2b 54 4e 61 38 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02xuqismnfcxftae</Membername><Password>gM7Z=/RuHEBTHdq+TNa8</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-10-28 20:02:12 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Mon, 28 Oct 2024 20:01:07 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: 586b7c66-e788-46d7-a547-3a16e26c440e PPServer: PPV: 30 H: PH1PEPF00018BF7 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 20:02:12 GMT Connection: close Content-Length: 17166
2024-10-28 20:02:12 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 46 44 44 42 35 30 36 41 37 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 61 34 32 33 66 33 36 31 2d 37 61 32 61 2d 34 66 31 62 2d 38 38 33 35 2d 34 61 33 66 30 33 64 32 33 38 33 39 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00FDDB506A7</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="a423f361-7a2a-4f1b-8835-4a3f03d23839" LicenseID="3252b20c-d425-4711
2024-10-28 20:02:12 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.5	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:09 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:09 UTC	540	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:09 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Sun, 27 Oct 2024 10:35:44 GMT ETag: "0x8DCF6731CF80310" x-ms-request-id: 89d6c6b8-201e-0033-2798-28b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200209Z-15b8d89586f5s5nz3ffrgxn5ac000000063g00000000e78c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:09 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-28 20:02:09 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-28 20:02:09 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-28 20:02:09 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-28 20:02:09 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-28 20:02:09 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-28 20:02:09 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-28 20:02:09 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-28 20:02:09 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-28 20:02:09 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49724	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:09 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=C7TSSAT5eghaF1F&MD=WpvOBMLF HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-28 20:02:09 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f397d1fa-ac6b-4f93-9fcb-7b808428119e MS-RequestId: a95c4c54-84e9-43f8-a0ef-8363ddc5c7d6 MS-CV: ztu4+WC7JUGqlpy+.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 28 Oct 2024 20:02:09 GMT Connection: close Content-Length: 24490
2024-10-28 20:02:09 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-28 20:02:09 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.5	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:10 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:11 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:11 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5d69bbb7-d01e-008e-6d6a-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200211Z-r197bdfb6b4jlq9hppzrdwabps00000000sg000000001ygb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:11 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:11 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:11 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:11 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200211Z-16849878b78x6gn56mgecg60qc000000079g00000000fqtf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:11 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:11 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:11 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:11 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: e9f225b3-c01e-0014-22e8-27a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200211Z-r197bdfb6b46kmj4701qkq602400000004mg000000006hgs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:11 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:11 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:11 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:11 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200211Z-16849878b787bfsh7zgp804my4000000046g00000000svhe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:11 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:11 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:11 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:11 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fc6998d3-101e-008d-52ad-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200211Z-16849878b78hh85qc40uyr8sc800000005rg00000000mmbk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:11 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:11 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:11 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: df0b1010-b01e-0021-3b24-28cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200211Z-r197bdfb6b48pl4k4a912hk2g400000004pg00000000cgsb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:11 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:12 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:11 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200211Z-16849878b78zqkvcwgr6h55x9n0000000510000000003g7h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:11 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:12 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:11 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 32193d61-901e-0015-09ca-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200211Z-r197bdfb6b4bq7nf8dgr5rzeq400000000tg00000000a5a6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:11 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:12 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:12 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 91249574-801e-0078-3dc7-27bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200212Z-17c5cb586f6w4mfs5xcmnrny6n000000079g000000001f25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:12 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:12 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:12 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:12 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: bebabdad-901e-0029-5d45-28274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200212Z-r197bdfb6b4jlq9hppzrdwabps00000000n000000000dq17 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:12 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:12 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:12 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 359c92e3-901e-0064-7ce8-28e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200212Z-17c5cb586f6g6g2sa7kg5c0gg000000000ug000000008a54 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:12 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:12 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:12 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 4ec88854-201e-0033-236a-27b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200212Z-17c5cb586f6r59nt869u8w8xt800000004d000000000e5w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:12 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:12 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:12 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: cb18986a-b01e-0053-40f0-27cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200212Z-r197bdfb6b4mcssrvu34xzqc5400000005m000000000bne6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:12 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:12 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:12 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:12 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: b80877bf-b01e-0084-28e3-26d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200212Z-17c5cb586f6f8m6jnehy0z65x400000004q000000000fy06 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:12 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:12 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:13 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:12 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: abb1733e-f01e-005d-6a3c-2813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200212Z-15b8d89586fwzdd8urmg0p1ebs0000000g0g000000008d2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:13 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:13 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:13 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 2fd6bd5d-d01e-007a-394f-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200213Z-16849878b78x6gn56mgecg60qc000000077000000000u1bd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:13 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:13 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:13 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:13 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200213Z-16849878b786lft2mu9uftf3y400000006sg00000000crvv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:13 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:13 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:13 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200213Z-16849878b78km6fmmkbenhx76n00000004tg00000000msgz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:13 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:13 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:13 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200213Z-16849878b78j5kdg3dndgqw0vg000000075000000000nnmv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:13 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:13 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:13 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: f981d888-e01e-0099-4d18-26da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200213Z-r197bdfb6b4mcssrvu34xzqc5400000005ng000000006vxd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:13 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49741	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:13 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-28 20:02:13 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 20:02:14 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 20:01:14 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C556_BAY x-ms-request-id: 5f8c6eaa-7be1-4464-97e9-a86f6421a6fd PPServer: PPV: 30 H: PH1PEPF0001B735 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 20:02:14 GMT Connection: close Content-Length: 11392
2024-10-28 20:02:14 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:14 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:14 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 47f8d5d2-401e-005b-1e67-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200214Z-16849878b78qfbkc5yywmsbg0c000000056000000000czqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:14 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:14 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 5074b8ce-701e-005c-627a-25bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200214Z-15b8d89586f42m673h1quuee4s00000009fg00000000fknn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:14 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:14 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:14 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 864201cb-901e-0015-2b18-26b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200214Z-16849878b786fl7gm2qg4r5y7000000005w0000000001g98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:14 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:14 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200214Z-16849878b78j5kdg3dndgqw0vg0000000780000000008nq5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:14 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:14 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ef4969e5-401e-002a-2c3c-28c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200214Z-15b8d89586fmc8ck21zz2rtg1w00000002kg00000000kb51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:14 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:15 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:15 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200215Z-16849878b787wpl5wqkt5731b4000000064000000000wggk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:15 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:15 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:15 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 546431bf-201e-0085-0b72-2734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200215Z-15b8d89586fwzdd8urmg0p1ebs0000000g0g000000008d7m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:15 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:15 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:15 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: deaa19c2-701e-006f-33de-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200215Z-17c5cb586f6mhqqby1dwph2kzs00000000s000000000ebtm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:15 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:15 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: fb99dfde-101e-0065-28dd-264088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200215Z-17c5cb586f6mhqqby1dwph2kzs00000000t000000000cfc2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:15 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:15 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:15 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200215Z-16849878b78wv88bk51myq5vxc00000005q000000000wkq1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:15 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49792	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:16 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-28 20:02:16 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 20:02:16 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 20:01:16 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C556_BAY x-ms-request-id: d99d9c51-4a40-4c2a-9a33-0c06881a5e97 PPServer: PPV: 30 H: PH1PEPF00011FE3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 20:02:16 GMT Connection: close Content-Length: 11392
2024-10-28 20:02:16 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:16 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:16 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200216Z-16849878b78qf2gleqhwczd21s00000005s00000000072d9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:16 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:16 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:16 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 214f201b-c01e-00ad-7c26-28a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200216Z-17c5cb586f6vcw6vtg5eymp4u800000003q0000000004h56 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:16 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:16 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:16 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200216Z-16849878b786jv8w2kpaf5zkqs000000049000000000te8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:16 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:16 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 25321125-401e-0047-18d5-288597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200216Z-r197bdfb6b46krmwag4tzr9x7c000000056g00000000hnva x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:16 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:16 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200216Z-15b8d89586fmc8ck21zz2rtg1w00000002pg00000000b6ee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:16 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:17 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:17 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 11ec9ee4-a01e-0053-158c-268603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200217Z-r197bdfb6b4hsj5bywyqk9r2xw00000006ug00000000fhsv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:17 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:17 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:17 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:17 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 5e2f3c3f-901e-0048-1b49-28b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200217Z-17c5cb586f6fqqst87nqkbsx1c00000003ug00000000fcs9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:17 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:17 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:17 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0ce3105a-501e-0029-7cd2-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200217Z-16849878b78fhxrnedubv5byks00000003sg00000000q8db x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:17 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:17 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:17 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200217Z-16849878b78x6gn56mgecg60qc000000075g00000000zmda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:17 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:17 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:17 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:17 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200217Z-16849878b78qg9mlz11wgn0wcc00000004zg00000000t5z4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:17 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49822	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:18 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-28 20:02:18 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 20:02:18 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 20:01:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: c560190a-d0e5-4c42-94d0-01d00e9ea687 PPServer: PPV: 30 H: PH1PEPF00011FF5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 20:02:17 GMT Connection: close Content-Length: 1918
2024-10-28 20:02:18 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:18 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:18 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200218Z-16849878b786jv8w2kpaf5zkqs00000004c000000000erv9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:18 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:18 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:18 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200218Z-16849878b78fhxrnedubv5byks00000003rg00000000tfxg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:18 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:18 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:18 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200218Z-16849878b78fssff8btnns3b1400000005q000000000scmc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:18 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:18 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:18 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200218Z-16849878b78tg5n42kspfr0x4800000005gg00000000fe0g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:18 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:18 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:18 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200218Z-16849878b78wv88bk51myq5vxc00000005r000000000prt2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:18 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:19 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:19 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 18fe904c-c01e-00a1-4257-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200219Z-16849878b78fkwcjkpn19c5dsn00000004fg00000000hvpu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:19 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200219Z-16849878b78fkwcjkpn19c5dsn00000004k00000000083ba x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:19 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200219Z-16849878b786jv8w2kpaf5zkqs00000004eg000000004afw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:19 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 3802ff33-701e-0001-4310-28b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200219Z-17c5cb586f6wnfhvhw6gvetfh40000000510000000001wfz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:19 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:19 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200219Z-15b8d89586flzzksdx5d6q7g1000000000rg000000002qfb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:19 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49833	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:19 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-28 20:02:19 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 20:02:19 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 20:01:19 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 710c88b2-9912-4a9b-96ef-1de15f884d30 PPServer: PPV: 30 H: BL02EPF0001DA47 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 20:02:19 GMT Connection: close Content-Length: 1918
2024-10-28 20:02:19 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49834	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:19 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-28 20:02:19 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 20:02:20 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 20:01:20 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C556_BAY x-ms-request-id: 108d6312-c205-4a23-9a92-37a67236c5dc PPServer: PPV: 30 H: PH1PEPF00011FE8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 20:02:19 GMT Connection: close Content-Length: 11412
2024-10-28 20:02:20 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:19 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 07599615-001e-0082-48f6-265880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200219Z-17c5cb586f6wmhkn5q6fu8c5ss00000004wg00000000841g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:20 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:20 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2cfbf663-801e-0083-68dc-26f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200220Z-r197bdfb6b4bq7nf8dgr5rzeq400000000rg00000000f5mh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:20 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:20 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 14980f11-e01e-00aa-5d14-29ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200220Z-r197bdfb6b48v72xb403uy6hns000000061g00000000f5wy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:20 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:20 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200220Z-16849878b78fkwcjkpn19c5dsn00000004eg00000000q949 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:20 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:20 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200220Z-16849878b78p8hrf1se7fucxk800000006d000000000a025 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:20 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:20 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:20 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200220Z-16849878b78hh85qc40uyr8sc800000005t000000000edvq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:20 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:20 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:21 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 923d4e42-a01e-003d-2e31-2798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200221Z-r197bdfb6b4bq7nf8dgr5rzeq400000000u0000000008tn9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:21 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:21 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: a342e9ea-d01e-0066-419c-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200221Z-16849878b78bjkl8dpep89pbgg0000000490000000003tcd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:21 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:21 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 4a7dd446-f01e-0096-5b9b-2710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200221Z-r197bdfb6b4qbfppwgs4nqza80000000046g000000002wtc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:21 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:21 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:21 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200221Z-16849878b78tg5n42kspfr0x4800000005fg00000000masv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:21 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:21 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 3281a84b-401e-0029-700c-289b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200221Z-r197bdfb6b46kmj4701qkq602400000004ng00000000452e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:21 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200221Z-16849878b7828dsgct3vrzta7000000003y000000000bh8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49845	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:21 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-28 20:02:21 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 20:02:22 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 20:01:22 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C556_BAY x-ms-request-id: bccb2bf7-d952-46b3-b7c6-1ec46bf11aa2 PPServer: PPV: 30 H: PH1PEPF00011F32 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 20:02:21 GMT Connection: close Content-Length: 11412
2024-10-28 20:02:22 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:21 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:22 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: b357c660-c01e-008e-6e16-297381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200222Z-15b8d89586ff5l62aha9080wv000000006u0000000008x20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:22 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:21 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:22 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 16c434fb-a01e-0032-1c41-281949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200222Z-17c5cb586f6vcw6vtg5eymp4u800000003n000000000acb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:22 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:22 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:22 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200222Z-15b8d89586flspj6y6m5fk442w0000000be000000000058a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:22 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:22 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 1e165ab9-d01e-007a-4b95-27f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200222Z-r197bdfb6b4bq7nf8dgr5rzeq400000000u0000000008tps x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:22 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:22 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200222Z-16849878b78p49s6zkwt11bbkn000000055g00000000csdt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:22 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:22 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:22 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 53c53d4f-801e-008c-1772-287130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200222Z-15b8d89586ffsjj9qb0gmb1stn00000009u0000000000pa8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:23 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:22 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200222Z-16849878b787bfsh7zgp804my4000000049g00000000d99m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:22 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:23 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 952379c8-801e-0083-0604-25f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200223Z-15b8d89586fwzdd8urmg0p1ebs0000000fxg00000000fbaa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49856	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:23 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-28 20:02:23 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 20:02:23 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 20:01:23 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C556_BAY x-ms-request-id: 287297dd-4ae8-4295-9c30-0628ff0c3287 PPServer: PPV: 30 H: PH1PEPF0001B82D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 20:02:23 GMT Connection: close Content-Length: 11412
2024-10-28 20:02:23 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:23 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 44c43cee-601e-003e-459c-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200223Z-15b8d89586f4zwgbgswvrvz4vs00000006rg00000000defq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:23 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dbd91de3-001e-002b-2827-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200223Z-17c5cb586f6lxnvg801rcb3n8n000000059000000000by00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:23 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:23 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200223Z-16849878b78nx5sne3fztmu6xc00000006dg00000000mkvn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:23 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:23 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: fd0e08e6-201e-0085-5f27-2634e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200223Z-r197bdfb6b4hsj5bywyqk9r2xw0000000710000000001fz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:23 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:23 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200223Z-16849878b7867ttgfbpnfxt44s00000005cg00000000c0vb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:23 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:24 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:24 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:24 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 860c7068-701e-0053-78c7-273a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200224Z-r197bdfb6b46kdskt78qagqq1c00000005hg00000000m32s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:24 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:24 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:24 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200224Z-16849878b787wpl5wqkt5731b400000006b0000000003bs9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:24 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:24 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:24 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200224Z-16849878b78g2m84h2v9sta29000000004d000000000gdpq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:24 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:24 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:24 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:24 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200224Z-16849878b78bjkl8dpep89pbgg000000049g000000001w95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:24 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:24 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:25 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:24 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 6768b437-a01e-00ab-174d-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200224Z-16849878b78hh85qc40uyr8sc800000005r000000000q7gk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:25 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49867	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:25 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4762 Host: login.live.com
2024-10-28 20:02:25 UTC	4762	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 20:02:25 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 20:01:25 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C556_SN1 x-ms-request-id: 49ca38ce-8b0a-43cc-9220-7e07c783e417 PPServer: PPV: 30 H: SN1PEPF0002FA63 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 20:02:24 GMT Connection: close Content-Length: 10197
2024-10-28 20:02:25 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:25 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:25 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:25 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a1443afe-101e-00a2-13ee-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200225Z-15b8d89586ff5l62aha9080wv000000006x0000000000yed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:25 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:25 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:25 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:25 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200225Z-16849878b786jv8w2kpaf5zkqs00000004ag00000000nwth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:25 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:25 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:25 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:25 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: f60f2227-501e-0064-5d90-271f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200225Z-15b8d89586f5s5nz3ffrgxn5ac0000000690000000001zmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:25 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:25 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:25 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:25 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 7902e772-301e-0000-2ff3-24eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200225Z-15b8d89586fwzdd8urmg0p1ebs0000000g3g000000000nmv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:25 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:25 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:25 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:25 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200225Z-16849878b78smng4k6nq15r6s4000000073g000000001y7k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:25 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:26 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:26 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:26 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: e6296ddc-301e-0052-0828-2665d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200226Z-r197bdfb6b46kdskt78qagqq1c00000005rg00000000335m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:26 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:26 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:26 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:26 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200226Z-15b8d89586f8nxpt6ys645x5v000000006s0000000008uce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:26 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:26 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:26 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:26 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200226Z-16849878b78p8hrf1se7fucxk800000006bg00000000fw5r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:26 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:26 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:26 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:26 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200226Z-16849878b78qg9mlz11wgn0wcc00000005500000000047m9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:26 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:26 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:26 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:26 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 9bc6d014-801e-008f-4946-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200226Z-r197bdfb6b4wmcgqdschtyp7yg00000005e000000000bpfk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:26 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:27 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:27 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:27 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2e8006eb-901e-0083-471c-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200227Z-16849878b78z2wx67pvzz63kdg0000000470000000000777 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:27 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:27 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:27 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:27 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 174e4ed1-f01e-0052-3d1b-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200227Z-16849878b78bjkl8dpep89pbgg00000004a00000000001ub x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:27 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:27 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:27 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:27 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: d9e5b04b-c01e-0066-80fb-27a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200227Z-r197bdfb6b48pl4k4a912hk2g400000004kg00000000kt73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:27 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:27 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:27 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:27 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d0af8e75-601e-0050-7953-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200227Z-r197bdfb6b46kdskt78qagqq1c00000005ng00000000bv0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:27 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:27 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:27 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:27 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: af778f23-101e-007a-027e-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200227Z-17c5cb586f6mhqqby1dwph2kzs00000000rg00000000fbxf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:27 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:28 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:28 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:28 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200228Z-16849878b787wpl5wqkt5731b4000000068000000000fa4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:28 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:28 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:28 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:28 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: fae3f4c7-d01e-0017-0559-27b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200228Z-15b8d89586fwzdd8urmg0p1ebs0000000fwg00000000ebdd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:28 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:28 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:28 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:28 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200228Z-16849878b78wc6ln1zsrz6q9w8000000054000000000p2ux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:28 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:28 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:28 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:28 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: cd644fad-f01e-0071-6ce7-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200228Z-r197bdfb6b47gqdjvmbpfaf2d000000000t00000000050ch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:28 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:28 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:28 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:28 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200228Z-16849878b78j5kdg3dndgqw0vg000000075g00000000kz83 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:28 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:28 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:29 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:29 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 927d9f3b-101e-0034-1176-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200229Z-17c5cb586f6w4mfs5xcmnrny6n000000076g000000007zd5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:29 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:29 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:29 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:29 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200229Z-16849878b78p8hrf1se7fucxk800000006b000000000hr25 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:29 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:29 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:29 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:29 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200229Z-16849878b78hh85qc40uyr8sc800000005tg00000000bvb9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:29 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:29 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:29 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:29 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 903d1aff-701e-0050-019c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200229Z-16849878b78bjkl8dpep89pbgg000000046g00000000fga3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:29 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:29 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:29 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:29 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2f6e7a45-901e-0083-466a-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200229Z-16849878b78x6gn56mgecg60qc000000076g00000000v3vw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:29 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:30 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:30 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:30 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200230Z-16849878b7867ttgfbpnfxt44s00000005c000000000d69s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:30 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:30 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:30 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:30 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: a7868e79-001e-0049-77f2-245bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200230Z-r197bdfb6b4wmcgqdschtyp7yg00000005dg00000000bf8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:30 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:30 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:30 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:30 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 19d379a2-b01e-0084-4b5b-28d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200230Z-15b8d89586fxdh48qknu9dqk2g00000009gg000000007cw3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:30 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:30 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:30 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:30 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 141f8a5a-601e-000d-3b74-272618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200230Z-16849878b78hh85qc40uyr8sc800000005rg00000000mnwh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:30 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:30 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:30 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:30 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: ff0e8b8f-401e-008c-1c9c-2786c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200230Z-17c5cb586f6wmhkn5q6fu8c5ss00000004xg000000005e9v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:30 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:31 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:31 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:31 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: f493011a-501e-008f-5f2c-289054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200231Z-15b8d89586flzzksdx5d6q7g1000000000q0000000006dz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:31 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:31 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:31 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:31 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 19ae2231-801e-007b-0d9c-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200231Z-16849878b7828dsgct3vrzta700000000400000000003cuv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:31 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:31 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:31 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:31 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 9800c975-801e-008c-0e2c-267130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200231Z-17c5cb586f65j4snvy39m6qus400000000t000000000ek7c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:31 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:31 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:32 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:32 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200232Z-16849878b787wpl5wqkt5731b4000000064000000000whfz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:32 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:31 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:32 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:32 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: bfa31533-301e-0020-4b7f-256299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200232Z-15b8d89586fst84k5f3z220tec0000000pbg00000000b2dq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:32 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:32 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:32 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: a3881376-a01e-000d-19f4-27d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200232Z-17c5cb586f6gkqkwd0x1ge8t0400000005y0000000007abr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:32 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:32 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:32 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:32 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 9b485842-301e-0096-2f9c-27e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200232Z-15b8d89586f8l5961kfst8fpb00000000g1g00000000bn5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:32 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:32 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:32 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:32 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200232Z-16849878b78wc6ln1zsrz6q9w8000000054g00000000kqp5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:32 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:32 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:32 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:32 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a91e6534-e01e-0020-5f90-27de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200232Z-17c5cb586f6sqz6fff89etrx0800000005900000000054g0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:32 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:32 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:32 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:32 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 2cda3f02-b01e-0021-7c8c-27cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200232Z-r197bdfb6b4wmcgqdschtyp7yg00000005hg00000000037t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:32 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:33 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:33 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:33 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 2264d41c-e01e-000c-05b3-278e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200233Z-17c5cb586f6gkqkwd0x1ge8t0400000005yg000000006y2h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:33 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:33 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:33 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:33 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: c032846d-701e-005c-2d58-27bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200233Z-16849878b78nx5sne3fztmu6xc00000006e000000000kars x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:33 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:33 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:33 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:33 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 2ea78088-901e-0083-5428-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200233Z-15b8d89586ffsjj9qb0gmb1stn00000009kg00000000k0v7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:33 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:33 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:33 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:33 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 3cf1e449-401e-00a3-55d5-288b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200233Z-15b8d89586fdmfsg1u7xrpfws000000009tg0000000076hb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:33 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:33 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:33 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:33 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 48a66efd-001e-00a2-625d-26d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200233Z-r197bdfb6b46krmwag4tzr9x7c000000059000000000bdq1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:33 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:34 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:34 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:34 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 050769f5-001e-0082-1f98-285880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200234Z-r197bdfb6b4qbfppwgs4nqza80000000040000000000hufd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:34 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:34 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:34 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:34 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 5278af64-001e-0034-3fad-26dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200234Z-16849878b78tg5n42kspfr0x4800000005k0000000007c7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:34 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:34 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:34 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:34 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: c49cf7be-b01e-0002-3880-271b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200234Z-16849878b78zqkvcwgr6h55x9n00000004w000000000r1rc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 20:02:34 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:34 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:34 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:34 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200234Z-16849878b787bfsh7zgp804my4000000049g00000000dade x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:34 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:34 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:34 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:34 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: b4130024-d01e-0082-10a3-26e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200234Z-16849878b78p8hrf1se7fucxk800000006d000000000a0yg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:34 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:35 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:35 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:35 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 44b69168-a01e-0098-3739-288556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200235Z-15b8d89586f8nxpt6ys645x5v000000006p000000000ev0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:35 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:35 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:35 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:35 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200235Z-16849878b78hh85qc40uyr8sc800000005t000000000ef7z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:35 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:35 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:35 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:35 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: a08c3447-701e-0098-6ef3-24395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200235Z-r197bdfb6b4hsj5bywyqk9r2xw00000006tg00000000ka43 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:35 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:35 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:35 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:35 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 897ec3ad-201e-005d-0167-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200235Z-16849878b78bcpfn2qf7sm6hsn000000070000000000uucm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:35 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:35 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:35 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:35 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 27f7fbdb-301e-0096-2237-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200235Z-16849878b7898p5f6vryaqvp5800000006d0000000003shz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:35 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49929	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:36 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:36 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:36 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 3452001d-001e-0065-12df-250b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200236Z-16849878b78tg5n42kspfr0x4800000005eg00000000phqa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:36 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 20:02:36 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 20:02:36 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 20:02:36 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e9bbe3b2-401e-005b-3496-259c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T200236Z-16849878b78fkwcjkpn19c5dsn00000004m0000000004026 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 20:02:36 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Target ID:	0
Start time:	16:01:54
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x2d0000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:02:29
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:02:29
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 --field-trial-handle=2292,i,13749190250805873838,5698468448711482657,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:02:32
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://resources.finalsite.net/images/v1716560654/lwsdorg/o4vxkncseuoqphvgnvy1/HSDayReport-05-23-2024.pdf"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:04:31
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x2d0000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Superintendent Dr.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\DengXian\43258772542.ttf

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\DengXian\54497409372.ttf

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Fira Sans\21487488679.ttf

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectbronze.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectgalaxy.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectgold.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectlava.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectocean.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectrainbowglitter.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectrosegold.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectsilver.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\oart.json

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1363E464.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1440037A.png

Windows Analysis Report
Superintendent Dr.docx