Edit tour

Windows Analysis Report
Platinum Hall County, Georgia Proposal (16.6 KB).docx

Overview

General Information

Sample name:	Platinum Hall County, Georgia Proposal (16.6 KB).docx
Analysis ID:	1570224
MD5:	cc645920228b9ece5762ade90001d177
SHA1:	9de79eaf50b1c880cf6fa41d7af6bf8464df02f0
SHA256:	a3bf9762b1acf878b4ff2c40c6f39c462061e7d3c8a8a14e7887b93898752b11
Infos:

Detection

KnowBe4

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Yara detected KnowBe4 simulated phishing

AI detected landing page (webpage, office document or email)

Contains an external reference to another file

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Sigma detected: Suspicious Office Outbound Connections

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 7680 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 8004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5904 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2044,i,2785491444657298548,8132415658689016922,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 340 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://2fa.com-token-auth.com/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==?cid=2306703812" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author	Strings
1.0.pages.csv	JoeSecurity_KnowBe4	Yara detected KnowBe4 simulated phishing	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.4, DestinationIsIpv6: false, DestinationPort: 49742, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, Initiated: true, ProcessId: 7680, Protocol: tcp, SourceIp: 34.196.207.207, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 7680, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Yara detected KnowBe4 simulated phishing

Source: Yara match

File source: 1.0.pages.csv, type: HTML

AI detected landing page (webpage, office document or email)

Source: Office document	Joe Sandbox AI: Page contains button: 'View Document' Source: 'Office document'
Source: Office document	Joe Sandbox AI: Office document contains prominent button: 'view document'
Source: Screenshot id: 14	Joe Sandbox AI: Page contains button: 'View Document' Source: 'Screenshot id: 14'
Source: Screenshot id: 14	Joe Sandbox AI: Screenshot id: 14 contains prominent button: 'view document'
Source: Screenshot id: 15	Joe Sandbox AI: Page contains button: 'View Document' Source: 'Screenshot id: 15'
Source: Screenshot id: 15	Joe Sandbox AI: Screenshot id: 15 contains prominent button: 'view document'

Source: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==

HTTP Parser: No favicon

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 20.190.177.84:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.196.207.207:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49832 version: TLS 1.2

Source: winword.exe

Memory has grown: Private usage: 1MB later: 68MB

Source: Joe Sandbox View	IP Address: 185.15.58.240 185.15.58.240
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84

Source: global traffic	HTTP traffic detected: GET /XVDgwdGo3UEdyNUtJaForT3FEQm91N3hlOE9NcFZ6OENoV0hYTHlTZFhqYldkOU00M2xhU29RUk1iai9RTnpIZDZTdHZXNUR5VExPQmpBV1ZybEtJQnBUUVpsSEJwampiTmdVbXFoNTR6eEpkKzFGNXVzM2ZaakUxbllEbE5BPT0tLXdKcGVOUk5FQ3RGRnNHd1UtLVdJZXZzd2VpR1VQdittK1E4QWc2a0E9PQ==?cid=2306703812 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: 2fa.com-token-auth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=d3GAufgwYKWyRyo&MD=NwwuSXF6 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==?cid=2306703812 HTTP/1.1Host: 2fa.com-token-auth.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ== HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://2fa.com-token-auth.com/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==?cid=2306703812Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /png/113149-200.png HTTP/1.1Host: static.thenounproject.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1Host: secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/thumb/3/36/Chevron-down%2C_Web_Fundamentals.svg/10px-Chevron-down%2C_Web_Fundamentals.svg.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /png/113149-200.png HTTP/1.1Host: static.thenounproject.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1Host: secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secured-login.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wikipedia/commons/thumb/3/36/Chevron-down%2C_Web_Fundamentals.svg/10px-Chevron-down%2C_Web_Fundamentals.svg.png HTTP/1.1Host: upload.wikimedia.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=d3GAufgwYKWyRyo&MD=NwwuSXF6 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: secured-login.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /XVDgwdGo3UEdyNUtJaForT3FEQm91N3hlOE9NcFZ6OENoV0hYTHlTZFhqYldkOU00M2xhU29RUk1iai9RTnpIZDZTdHZXNUR5VExPQmpBV1ZybEtJQnBUUVpsSEJwampiTmdVbXFoNTR6eEpkKzFGNXVzM2ZaakUxbllEbE5BPT0tLXdKcGVOUk5FQ3RGRnNHd1UtLVdJZXZzd2VpR1VQdittK1E4QWc2a0E9PQ==?cid=2306703812 HTTP/1.1Accept: /User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16)Accept-Encoding: gzip, deflateHost: 2fa.com-token-auth.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: 2fa.com-token-auth.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: secured-login.net
Source: global traffic	DNS traffic detected: DNS query: www.hallcounty.org
Source: global traffic	DNS traffic detected: DNS query: static.thenounproject.com
Source: global traffic	DNS traffic detected: DNS query: upload.wikimedia.org

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940

Source: unknown	HTTPS traffic detected: 20.190.177.84:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.196.207.207:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49832 version: TLS 1.2

System Summary

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: screenshot	OCR: Enable editing' button in the top yellow bar, and then "Enable content". Or click the below button t
Source: screenshot	OCR: Enable content". Or click the below button to load content in browser View Document Platinum Hall C
Source: screenshot	OCR: Enable editing' button in the top yellow bar, and then "Enable content". Or click the below button t
Source: screenshot	OCR: Enable content". Or click the below button to load content in browser View Document Platinum Hall C
Source: screenshot	OCR: Enable editing' button in the top yellow bar, and then "Enable content". Or click the below button t
Source: screenshot	OCR: Enable content". Or click the below button to load content in browser View Document Platinum Hall C
Source: screenshot	OCR: Enable editing' button in the top yellow bar, and then "Enable content". Or click the below button t
Source: screenshot	OCR: Enable content". Or click the below button to load content in browser View Document Accessibility: I
Source: screenshot	OCR: Enable editing" &Jtton top bar, and Or click to in View Document rate: office 365 If 68 words Page I
Source: screenshot	OCR: Enable editing" &Jtton top bar, and Or click to in View Document rate: office 365 & Accessibility: I
Source: screenshot	OCR: Enable editing" &Jtton top bar, and Or click t' in View Document rate: c19ts not amti office 365 If

Source: gostname.xsl.0.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: gb.xsl.0.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.0.dr	OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.0.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.0.dr	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690.xsl.0.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.0.dr	OLE indicator, VBA macros: true

Source: ~WRF{EAA8276B-2E93-4C9C-8B2D-B9CD5E7CD592}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: harvardanglia2008officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal64.phis.evad.winDOCX@20/257@21/7

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{2D19354F-AE74-4435-90CA-88A30FB6DED6} - OProcSessId.dat

Jump to behavior

Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0002.tmp.0.dr	OLE indicator, Word Document stream: true

Source: ~WRF{EAA8276B-2E93-4C9C-8B2D-B9CD5E7CD592}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{EAA8276B-2E93-4C9C-8B2D-B9CD5E7CD592}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{EAA8276B-2E93-4C9C-8B2D-B9CD5E7CD592}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2044,i,2785491444657298548,8132415658689016922,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://2fa.com-token-auth.com/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==?cid=2306703812"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2044,i,2785491444657298548,8132415658689016922,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Platinum Hall County, Georgia Proposal (16.6 KB).LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\Platinum Hall County, Georgia Proposal (16.6 KB).docx
Source: Templates.LNK.0.dr	LNK file: ..\..\Templates

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0002.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr

Initial sample: OLE indicators vbamacros = False

Persistence and Installation Behavior

Contains an external reference to another file

Source: document.xml.rels

Extracted files from sample: https://2fa.com-token-auth.com/xvdgwdgo3uedynutjafort3feqm91n3hloe9ncfz6oenov0hythltzfhqyldkou00m2xhu29ruk1iai9rtnpizdztdhzxnur5vexpqmpbv1zybetjqnbuuvpssejwampitmdvbxfontr6eepkkzfgnxvzm2zaakuxbllebe5bpt0tlxdkcgvouk5fq3rgrnnhd1utlvdjzxzzd2vpr1vqdittk1e4qwc2a0e9pq==?cid=2306703812

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Extra Window Memory Injection	1 Disable or Modify Tools	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Extra Window Memory Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
static.thenounproject.com	18.66.161.97	true	false	high
www.google.com	142.250.181.68	true	false	high
upload.wikimedia.org	185.15.58.240	true	false	high
secured-login.net	52.205.74.90	true	false	high
landing.training.knowbe4.com	34.196.207.207	true	false	high
2fa.com-token-auth.com	unknown	unknown	false	high
www.hallcounty.org	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://secured-login.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css	false	high
https://static.thenounproject.com/png/113149-200.png	false	high
https://upload.wikimedia.org/wikipedia/commons/thumb/3/36/Chevron-down%2C_Web_Fundamentals.svg/10px-Chevron-down%2C_Web_Fundamentals.svg.png	false	high
https://secured-login.net/favicon.ico	false	high
https://secured-login.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css	false	high
https://secured-login.net/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png	false	high
https://secured-login.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.15.58.240	upload.wikimedia.org	Netherlands	14907	WIKIMEDIAUS	false
52.205.74.90	secured-login.net	United States	14618	AMAZON-AESUS	false
34.196.207.207	landing.training.knowbe4.com	United States	14618	AMAZON-AESUS	false
18.66.161.97	static.thenounproject.com	United States	3	MIT-GATEWAYSUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570224
Start date and time:	2024-12-06 17:15:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Platinum Hall County, Georgia Proposal (16.6 KB).docx
Detection:	MAL
Classification:	mal64.phis.evad.winDOCX@20/257@21/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .docx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://2fa.com-token-auth.com/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==?cid=2306703812 Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 2.18.84.141, 52.113.194.132, 212.229.88.21, 52.111.252.16, 52.111.252.18, 52.111.252.15, 52.111.252.17, 192.229.221.95, 20.189.173.6, 2.20.68.85, 2.20.68.72, 2.20.68.212, 2.20.68.209, 172.217.21.35, 173.194.222.84, 142.250.203.238, 172.217.17.78, 104.18.43.10, 172.64.144.246, 52.109.68.129, 142.251.37.174, 52.109.28.47, 172.217.17.35, 52.109.76.243, 142.251.37.46, 172.217.18.238, 142.250.200.206
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, a1847.dscg2.akamai.net, clients2.google.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, update.googleapis.com, frc-azsc-000.roaming.officeapps.live.com, officeclient.microsoft.com, ecs.office.com, fs.microsoft.com, prod-inc-resolver.naturallanguageeditorservice.osi.office.net.akadns.net, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, nleditor.osi.office.net, uks-azsc-000.roaming.officeapps.live.com, edgedl.me.gvt1.com, s-0005.s-msedge.net, osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com, metadata.templates.cdn.office.net, ecs.office.trafficmanager.net, clients.l.google.com, europe.configsvc1.live.com.akadns.net, onedscolprdwus05.westus.cloudapp.azure.com, binaries.templates.cdn.office.net.edgesuite.net, templatesmetadata.office.net.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Platinum Hall County, Georgia Proposal (16.6 KB).docx

Input	Output
URL: Office document Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "View Document", "prominent_button_name": "View Document", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Office document Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office 365" ] }
	{ "brands": [ "Microsoft Office 365" ] }
URL: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Oops! You clicked on a simulated phishing test.", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://secured-login.net Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": true, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://secured-login.net
URL: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q Model: Joe Sandbox AI	{ "brands": [ "Hall County" ] }
	{ "brands": [ "Hall County" ] }
URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "To view or edit this document, please click \"Enable editing\" button in the top yellow bar, and then \"Enable content\".", "prominent_button_name": "View Document", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 15 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "To view or edit this document, please click \"Enable editing\" button in the top yellow bar, and then \"Enable content\".", "prominent_button_name": "View Document", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office 365" ] }
	{ "brands": [ "Microsoft Office 365" ] }
URL: Screenshot id: 15 Model: Joe Sandbox AI	{ "brands": [ "Microsoft Office 365" ] }
	{ "brands": [ "Microsoft Office 365" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.15.58.240	https://buyiceply.live/?utm_campaign=INccHxHRWrew3TQsLBbfNnbGFYUZobMqxXT9Zrw5FhI1&t=main9other	Get hash	malicious	GRQ Scam	Browse	upload.wikimedia.org/wikipedia/commons/6/65/Lock-green.svg
185.15.58.240	https://www.google.com/url?rct=j&sa=t&url=https://fischer-baupro.de/south-state-bank-locations.html&ct=ga&cd=CAEYASoTMjAxNTMxNTQ2Njc0Mjk3OTUyNDIaYTBmZWVhZTA3M2MyMDJhMDpjb206ZW46VVM&usg=AOvVaw3lhiJJ-nclIGfQxEWGuu5s	Get hash	malicious	GRQ Scam	Browse	upload.wikimedia.org/wikipedia/commons/6/65/Lock-green.svg
18.66.161.97	https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-09584045BD498740V%2FU-7AK40048SY131414Y%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq&id=UJ8cMtNtnR8osXBu987dZoV1KMO8Kn.CKcv6ZA&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-09584045BD498740V%2FU-7AK40048SY131414Y%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3DUJ8cMtNtnR8osXBu987dZoV1KMO8Kn.CKcv6ZA%22%7D%7D&flowContextData=k3KkNbgd2F3whUTyipi2CMJLh_A_-ZYRjnLUkRjoT_j0HNsy89M3Jq9pftpBPMtxKyazfBl41ygLF6L-3nSQM3yKD_1JSLMZUnm3gJtmC_GW6MtRMZgxxLdzhM2UidzudErvOhqzUKOKhl1Uolhas5WHE4v4p4McejHNxcZVkLh-Y4orpy9guCt5hhIB4GnzEz4SubWTdzvc3cAY2OwiaKLLHK8NR5mzXmQp5fVf3iIsNKSvq_9V0izgPURkU3T8RWrY5gGBkFdWln_xY5pl8zRv8lmUI-keUYe0DqQBvKVK8GwV8qiU_5p8qjPHJVW9i-G3ZBZuZum2FKJqczC5erDfF4QBe8JLLYzKBGyYHnHI7fFyBoEDubHGzh8R01uh4xAe-iAkcUj76XG_hnIoA0TzvY15PrfT8E9VdnaJhGuNJ5c8GhmekMGGnVwrlvOcZBIva0&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=3bf303f1-b31d-11ef-81c6-bffe125023d8&ppid=RT000186&cnac=US&rsta=en_US%28en-US%29&unptid=3bf303f1-b31d-11ef-81c6-bffe125023d8&calc=f7859995fbf4b&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.294.0&tenant_name=&xt=145585%2C150948%2C104038&link_ref=www.paypal.com_signin	Get hash	malicious	Unknown	Browse
	https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-73L43097YS920471H%2FU-21916088VG929353V%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq&id=oSTQ2KyhBfzKABJBD3SmDi49NoivW60lzQASFQ&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-73L43097YS920471H%2FU-21916088VG929353V%3FclassicUrl%3D%2FUS%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3DoSTQ2KyhBfzKABJBD3SmDi49NoivW60lzQASFQ%22%7D%7D&flowContextData=RDl_AZcF1sl5Rb_6LCOad8Ablnu-W7AxB_i5FzkmY9ljbd6ElIlIteG0y31awgymrSFY-NEhR9oodKgi2Jr_54nHRHUI22A5btXBAz58pUBlVy_icxhdiCyvbxtKkJbyvPwAFXZm9Hu-TuP8fUbi3kD9SI3uQE-nXU-1T6hk9yNEcfLwmQ9q2oXw0Nu89DKUwRZZ-hEgdjZhl4tqKDQiASbkdXigxUyjHWAPt-vOaJzbzisp0scQXF4UF-J1Rto6RYCxskkLambqbUPNkjVq_ZtnTRrfcOFs6AdzgjQZxFjLXCq1M3EW1Aiq9DSZcmtteoSiOkL-Yl_4s2YOFo6jNRRQrcEHNylGYTBCyHc65n4_85NWbx-ikEWoVlI4LXcJW4dftTovp8EWo5xXhEORiceFOjZRVbk5MVtSKHu91b7gPLC3F3USPVAc68XpKKXL_xvsUAp1wPS1patgsMBTMQo3Gwa68P9HfAfTWEjlQ1Yf3yTIWtRpNF8qyyGgAUBLgrJVAT_OmXFJJrX08CV-vxGPkepVr0r1FVRxwTmimvKh55xYEKkfPK5XJKmenbfgUa9CbfH9d_FpW5yVigO-oMpueUaWL8bSCYMeFYr8B1GfpUn9ASsdqnfnFqtpUGY0Y4MI9f0bvAFH6gYvW7ZTeYh_jKu&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=c038b022-b182-11ef-83cc-0118134ab4bf&ppid=RT000186&cnac=US&rsta=en_US%28en-US%29&unptid=c038b022-b182-11ef-83cc-0118134ab4bf&calc=f826437c02759&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.294.0&tenant_name=&xt=145585%2C150948%2C104038&link_ref=www.paypal.com_signin	Get hash	malicious	Unknown	Browse
	https://www.paypal.com/signin/?returnUri=%2Fmyaccount%2Ftransfer%2FpayRequest%2FU-8FB07512G02736728%2FU-8UU1421709629722J%3FclassicUrl%3D%2FCA%2Fcgi-bin%2F%3Fcmd%3D_prq&id=bCWb7axPkTBIYo2JytQu3Yqi-gfJnEsVyEvflA&expId=p2p&onboardData=%7B%22signUpRequest%22%3A%7B%22method%22%3A%22get%22%2C%22url%22%3A%22https%3A%2F%2Fwww.paypal.com%2Fmyaccount%2Ftransfer%2FguestLogin%2FpayRequest%2FU-8FB07512G02736728%2FU-8UU1421709629722J%3FclassicUrl%3D%2FCA%2Fcgi-bin%2F%3Fcmd%3D_prq%26id%3DbCWb7axPkTBIYo2JytQu3Yqi-gfJnEsVyEvflA%22%7D%7D&flowContextData=FhBIPUN7sGX6UXoVcVvHCc0r-kHt8NxPVJdCtufc2-5wJ8xNtYMzwoEItubAbMHSR-Brfj8WYHXSOJOLB7I_xgIcpSMJwP4YtpfCnYEHRE07uUgtzs-5O1p746JYB5MV7Eta_TiVNNWomtvJrK-nZectqmXCVhjzKoLtEhBGgiIcrB-f7ABGIKrBF_pVh3U-k_zBQ_s0uP7jrErg8qUDd9XQNWR77W6gQyiq4pCR6_PvxoaobXaVHTSKv7VEUp-cXHG2cUkCFxRjiQ1tpsfqdUWJRD9Tvzt_P29zQm26DHKsAIdR5Mhbc68zZDkGx4I1cAE6E938r_GFpPcFuCWKTQX5lJdg8-IccRRGQgXdLu7DY98wAWY7-AdsB7zacLPYw3yI9P4HmAif8vysbLkh4amfLfRnxL3D32w9Y7V0HwwB820AtwWjXaNVfz-wisVe6yv1R7ax6xWoLQNM&v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000186&utm_unptid=28b8c20f-b0c4-11ef-8528-d7dddebdc1bf&ppid=RT000186&cnac=CA&rsta=en_US%28en-CA%29&unptid=28b8c20f-b0c4-11ef-8528-d7dddebdc1bf&calc=f298458bd0c86&unp_tpcid=requestmoney-notifications-requestee&page=main%3Aemail%3ART000186&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.294.0&tenant_name=&xt=145585%2C154413%2C104038&link_ref=www.paypal.com_signin	Get hash	malicious	Unknown	Browse
239.255.255.250	https://app.droplet.io/form/K47rYN	Get hash	malicious	Unknown	Browse
	https://shorturl.at/yWYYs?US=1583v79i	Get hash	malicious	Unknown	Browse
	https://haqzt.trc20.kcgrocks.com/merchantServices	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#brian.smith@arnoldclark.com	Get hash	malicious	Unknown	Browse
	http://leatherbook.org	Get hash	malicious	Unknown	Browse
	https://www.schneiderpostaccident.com	Get hash	malicious	Unknown	Browse
	https://getvideoz.click/	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
upload.wikimedia.org	https://rnicrosoft-secured-office.squarespace.com/sharepoint?e=test@test.com.au	Get hash	malicious	HTMLPhisher	Browse	185.15.58.240
	https://jxgy-zcmp.maillist-manage.eu/click/1315cead38f4e738/1315cead38f50cec	Get hash	malicious	Unknown	Browse	185.15.58.240
	http://lesman-dot-x-alcove-439604-j8.uk.r.appspot.com/	Get hash	malicious	Unknown	Browse	185.15.58.240
	https://05kqatnrj9s0snah9.phish.farm/XckdRam1iZXdLcHBTUFlJTlR4SkE5bGxnQ0I0VmtpVFhRWTltRlk3ejQvN2h4WHR0SlJUOXVLRkF5QkQ1R1dlRVVMYWg3RlJPUWwwUFRyeXJqWkhrNHZqU0ErUy9KTC9GRU5UNU9LOFBMaCtIOUgrWG85c2NJdXRVVGY4eG5FVEYrOGgyRGlBQnE2dlQxK1ptMGkvRkUwbkJSMGpnZkMxU2tvSlp3YURJOVFqWkZrV0VLaGJQbldEdS0tV21LS01kOGpOSC9ZWlk0Ry0tZ2ZTcE9EMnkvSHVVSkUvTEhEOWFKQT09?cid=2293724267	Get hash	malicious	KnowBe4	Browse	185.15.58.240
	https://t.co/nq9BYOxCg9	Get hash	malicious	HTMLPhisher	Browse	185.15.58.240
	eInvoice.html	Get hash	malicious	HTMLPhisher	Browse	185.15.58.240
	https://na01.safelinks.protection.outlook.com.url.protected-forms.com/XRDg1aXJTZEo3WnVjMi8rYmFSTlJrZUxJc2pYa2dEMjRmVzkrVm1KSjV2dmFMNjhRYVlhZzhQcGhVa3U0aGJMWjZjZDMzbmdQR3p2azkvT29vbzZYTW96OGE5a1A4c1UxRDdqMXRjTFY3S0c0aGRESzdvcmVmNXVVNEt3WjhyR2ppang0eWN2SGRvakNDK3h6MUg1T1BwNlZ1NVJjRjFPdisrUmV5cmpyRHNUSWtiRzBSRzRPa3hPa21UdkRaQ0dxc21yQk96dlU0K009LS11MEhPdmp1QjU2QWFUdjVDLS1Ubld1REU3SXI3TTJOeG1paVBDQ3pRPT0=?cid=2272549020	Get hash	malicious	HTMLPhisher, KnowBe4	Browse	185.15.58.240
	Rockwool-Benefits-Pay_CCMYTTJHZY.docx	Get hash	malicious	FakeAntivirus	Browse	185.15.58.240
	Fatura931Pendente956.pdf761.msi	Get hash	malicious	Unknown	Browse	185.15.58.240
landing.training.knowbe4.com	https://us-api.mimecast.com.kb4.io/XWko4Q0hGOG85d2pSNGFBUW1UaEJSL09QUThzR2hrYWl3UGh4aEFVNkQ0dW1jU0FrdnhwRFB2clh1VmRINlRhSTJXNkM0N2NiS0J6WWlVRENjUVlPSWZYbk9xUkNaRDNGSjR3OU1Jd2RSdlJKL0k2cjZWV0ozK1BLRWRrZWJucElFUGVXcFpkM2hlOXluYlErY01WYkRnNmtzUldXNlJEcmIvN0Z0WVNMOHNobW5lMjVGcEdENDA0TWZNblZTWFVuRUp3PS0taC91cHJQRm5XdmFVejBTdC0tWVNTU2ZrYnF5clZ0ZndVU0tiNHIzUT09?cid=2313358952	Get hash	malicious	KnowBe4	Browse	52.200.18.75
	https://do.not.click.on.this.link.instantrevert.net/XSEg2WDlKd2JCRDJOMWtwUGE5L0dpYzEyZUF0UjVQWmNQaWl2Q21KaDZSeUhuKzhLc243eHpPN1h4NjVNTnAzblZ6ZFZhaGwydDB1ZHJNUnQ5S25RRk0yTEtDbkhEZUlDZ29KY3lveXU2YW9kWkxheHEvTm1wWU5tWjUvT0lGZHkvR3k2MXBCbkYxdmJkZWl2NnNHa1dFcTFVd29uTklraVNkNHdISUFEbCszRE9tc3RETjdZSXdsaWl3PT0tLWJIaFJQTDlXUWhZQ0V6eWMtLWtnaFdmOHAzRW9zTE12VmNnY2lDS2c9PQ==?cid=2314349904	Get hash	malicious	KnowBe4	Browse	52.200.18.75
	https://su.onamoc.comano.us/XcEhOOWF1eS9pVi9RYkVJUURCV1RYR0RGd2dHRjNGcUhDdkhxWFpsdUp1UWlVZk83UmwwZjIrYmdvdzh3aFZ3V1NpdnFZTG4zSE16TDBDYU5yc2hZVWQ3UU1GNHRON29GNEpZZkN6SGY0Nk8rdVp2U2tOWmNQbDNnZ0lyalR3OXBmeDlrU0FLKzlVeHI4YXk2YUFmaTRMUUR5TkhWNlhtSzMwQ2IrcU16UzRXUWROZDFlc3k0aldiNy0td25BVUltZUhhSGpCZG5tRS0tN1VocVZyWm1JT2tITW5yVjN4YWNxdz09?cid=2310889346	Get hash	malicious	KnowBe4	Browse	3.234.59.60
	https://addto.password.land/XTi9aSHpxMU9CSkxBVXRhNGJhTWRLelpoTjl5MHNEUndKbFN6WU9rV1E1QnF0azRVN1Z3OEFWTE0rd0NldXVBQ3QyUGw3NXpZcDNMMHZ3QklHeU5CYzJBSmowVWUzYlJtS1FOZlBKQzNHRkV5dDRZckdUSHVVZ1h3VGRxL2VNZkw3RDBlOS9rSTYvK3FOU2UwdUd2OFA0KzZWaWc4ZmMrMzhaTnBpSzc3aU55UVlxUnlKZXRwdm9nPS0td0ZVSjRCSTRJclFTRVBuVS0tc2h0a3RIa3J5VGJRUUt5NUZCdmxvdz09?cid=2310145655	Get hash	malicious	KnowBe4	Browse	3.234.59.60
	https://temp.farenheit.net/XWU9WdXVLQ1BPcVcwN28vNmJmQW9rZy9JbGl2YjNqdU82UXRXbjVuRDE4WHZ2S3E3MTh0U0RLVVRZRjcvL3o0M1ZEZW5HMGQ2cUJ6Q1dmd0d6MzNsK1IwNkc0c1FQTlFkODFpdjI1RE5wTTZrZjNNL2ZlNTNzb3kvbXlTenlUOC94REZCNXJyYzEwcDduQ0JYM1JvQnpTTEhpdHIzWXlMVFh3dnJkNWo5N3JWODhWWVd4MWx5T0pqcUNZQlY3ZHRFTktEUGRLRVR4czR1dTMvY282WURmWGE0TkhiSkd2dkNZOUlGWUE9PS0tVVdmbHMzdlpZZDU2aFdnMy0teWdvSnFiVklFSk13UEoyUlNUQzd4Zz09?cid=2308276595	Get hash	malicious	KnowBe4	Browse	3.221.180.152
	https://nam05.safelinks.protection.outlook.com.url.atp-redirect.protected-forms.com/XTnQrajg1OGVHZkdSZC9jY09NbW40Z2plNHVuWDhsQVZRZkFYNVBxOWlTekFXSXBLSVRWLyt2WXhuS1hGNVo3UUxGQTRLRVpXNHpLSjVKdDEvbHJLSmtFWjMzbFIxb3IvR2xvdWJ1em5yeTJBK1FXdzF3UG52YXBaVmJBSEJZcXBSdjFvMTh6TmplRHV4azZ6UHkrTnM5dUY2QmVzbVFVRWk5di9PMEZxZ2lXNnM5N2tuOExqN1pyUy0tcEx5Q0xXTTBEOURyNFdnTS0tTTJJM3JGT2w2ZzQxTnorb2NMd1lrZz09?cid=2305347406	Get hash	malicious	KnowBe4	Browse	3.221.180.152
	https://05kqatnrj9s0snah9.phish.farm/XckdRam1iZXdLcHBTUFlJTlR4SkE5bGxnQ0I0VmtpVFhRWTltRlk3ejQvN2h4WHR0SlJUOXVLRkF5QkQ1R1dlRVVMYWg3RlJPUWwwUFRyeXJqWkhrNHZqU0ErUy9KTC9GRU5UNU9LOFBMaCtIOUgrWG85c2NJdXRVVGY4eG5FVEYrOGgyRGlBQnE2dlQxK1ptMGkvRkUwbkJSMGpnZkMxU2tvSlp3YURJOVFqWkZrV0VLaGJQbldEdS0tV21LS01kOGpOSC9ZWlk0Ry0tZ2ZTcE9EMnkvSHVVSkUvTEhEOWFKQT09?cid=2293724267	Get hash	malicious	KnowBe4	Browse	3.221.180.152
	https://secure-mail.web.magnetonics.com/XYUplc3JPalpuZ2tsL0s3eW1FZTQzVXdBbkRTQlhudjJVMWlZdTlHUW51elRUVG5QOEhlMTg0MXUzb3VXWkJzRGQ2ODlFV0ZMeXBwN0txZ1lRckxxYk9XV1MvcXk2L0EvWHMyY0JKQTFTMytWdmduZ1J6aW1IOWh4eWlER21pOVJwTUhiZFdKMVJBUUhkZmswZS9mVDY0WDVGZFpRLzZTS3VWTlRqaGdqYm1hWG9QaEZWQmJ2d1RYeWxyNjNLVUVvaGtmS2pBZlYwdWtqMGtwWHJXOD0tLUlSL1J5NlA4VnkzaGRLbEYtLU1PTExESEVObm5kbC9kNzBWdS9hWEE9PQ==?cid=2289196598	Get hash	malicious	KnowBe4	Browse	3.210.252.138
	https://na01.safelinks.protection.outlook.com.url.protected-forms.com/XRDg1aXJTZEo3WnVjMi8rYmFSTlJrZUxJc2pYa2dEMjRmVzkrVm1KSjV2dmFMNjhRYVlhZzhQcGhVa3U0aGJMWjZjZDMzbmdQR3p2azkvT29vbzZYTW96OGE5a1A4c1UxRDdqMXRjTFY3S0c0aGRESzdvcmVmNXVVNEt3WjhyR2ppang0eWN2SGRvakNDK3h6MUg1T1BwNlZ1NVJjRjFPdisrUmV5cmpyRHNUSWtiRzBSRzRPa3hPa21UdkRaQ0dxc21yQk96dlU0K009LS11MEhPdmp1QjU2QWFUdjVDLS1Ubld1REU3SXI3TTJOeG1paVBDQ3pRPT0=?cid=2272549020	Get hash	malicious	HTMLPhisher, KnowBe4	Browse	3.210.252.138
static.thenounproject.com	https://isragohar.github.io/Fb-Clone-	Get hash	malicious	Unknown	Browse	108.138.7.24
	https://lithiuimvalley.com/ssd	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	18.164.78.86
	http://black-sun-a335.asyorfplmnv.workers.dev	Get hash	malicious	Unknown	Browse	18.164.78.86
secured-login.net	https://us-api.mimecast.com.kb4.io/XWko4Q0hGOG85d2pSNGFBUW1UaEJSL09QUThzR2hrYWl3UGh4aEFVNkQ0dW1jU0FrdnhwRFB2clh1VmRINlRhSTJXNkM0N2NiS0J6WWlVRENjUVlPSWZYbk9xUkNaRDNGSjR3OU1Jd2RSdlJKL0k2cjZWV0ozK1BLRWRrZWJucElFUGVXcFpkM2hlOXluYlErY01WYkRnNmtzUldXNlJEcmIvN0Z0WVNMOHNobW5lMjVGcEdENDA0TWZNblZTWFVuRUp3PS0taC91cHJQRm5XdmFVejBTdC0tWVNTU2ZrYnF5clZ0ZndVU0tiNHIzUT09?cid=2313358952	Get hash	malicious	KnowBe4	Browse	54.85.18.81
	https://do.not.click.on.this.link.instantrevert.net/XSEg2WDlKd2JCRDJOMWtwUGE5L0dpYzEyZUF0UjVQWmNQaWl2Q21KaDZSeUhuKzhLc243eHpPN1h4NjVNTnAzblZ6ZFZhaGwydDB1ZHJNUnQ5S25RRk0yTEtDbkhEZUlDZ29KY3lveXU2YW9kWkxheHEvTm1wWU5tWjUvT0lGZHkvR3k2MXBCbkYxdmJkZWl2NnNHa1dFcTFVd29uTklraVNkNHdISUFEbCszRE9tc3RETjdZSXdsaWl3PT0tLWJIaFJQTDlXUWhZQ0V6eWMtLWtnaFdmOHAzRW9zTE12VmNnY2lDS2c9PQ==?cid=2314349904	Get hash	malicious	KnowBe4	Browse	52.200.18.75
	https://su.onamoc.comano.us/XcEhOOWF1eS9pVi9RYkVJUURCV1RYR0RGd2dHRjNGcUhDdkhxWFpsdUp1UWlVZk83UmwwZjIrYmdvdzh3aFZ3V1NpdnFZTG4zSE16TDBDYU5yc2hZVWQ3UU1GNHRON29GNEpZZkN6SGY0Nk8rdVp2U2tOWmNQbDNnZ0lyalR3OXBmeDlrU0FLKzlVeHI4YXk2YUFmaTRMUUR5TkhWNlhtSzMwQ2IrcU16UzRXUWROZDFlc3k0aldiNy0td25BVUltZUhhSGpCZG5tRS0tN1VocVZyWm1JT2tITW5yVjN4YWNxdz09?cid=2310889346	Get hash	malicious	KnowBe4	Browse	52.200.18.75
	https://addto.password.land/XTi9aSHpxMU9CSkxBVXRhNGJhTWRLelpoTjl5MHNEUndKbFN6WU9rV1E1QnF0azRVN1Z3OEFWTE0rd0NldXVBQ3QyUGw3NXpZcDNMMHZ3QklHeU5CYzJBSmowVWUzYlJtS1FOZlBKQzNHRkV5dDRZckdUSHVVZ1h3VGRxL2VNZkw3RDBlOS9rSTYvK3FOU2UwdUd2OFA0KzZWaWc4ZmMrMzhaTnBpSzc3aU55UVlxUnlKZXRwdm9nPS0td0ZVSjRCSTRJclFTRVBuVS0tc2h0a3RIa3J5VGJRUUt5NUZCdmxvdz09?cid=2310145655	Get hash	malicious	KnowBe4	Browse	3.234.59.60
	https://nam05.safelinks.protection.outlook.com.url.atp-redirect.protected-forms.com/XTnQrajg1OGVHZkdSZC9jY09NbW40Z2plNHVuWDhsQVZRZkFYNVBxOWlTekFXSXBLSVRWLyt2WXhuS1hGNVo3UUxGQTRLRVpXNHpLSjVKdDEvbHJLSmtFWjMzbFIxb3IvR2xvdWJ1em5yeTJBK1FXdzF3UG52YXBaVmJBSEJZcXBSdjFvMTh6TmplRHV4azZ6UHkrTnM5dUY2QmVzbVFVRWk5di9PMEZxZ2lXNnM5N2tuOExqN1pyUy0tcEx5Q0xXTTBEOURyNFdnTS0tTTJJM3JGT2w2ZzQxTnorb2NMd1lrZz09?cid=2305347406	Get hash	malicious	KnowBe4	Browse	18.213.11.77
	https://05kqatnrj9s0snah9.phish.farm/XckdRam1iZXdLcHBTUFlJTlR4SkE5bGxnQ0I0VmtpVFhRWTltRlk3ejQvN2h4WHR0SlJUOXVLRkF5QkQ1R1dlRVVMYWg3RlJPUWwwUFRyeXJqWkhrNHZqU0ErUy9KTC9GRU5UNU9LOFBMaCtIOUgrWG85c2NJdXRVVGY4eG5FVEYrOGgyRGlBQnE2dlQxK1ptMGkvRkUwbkJSMGpnZkMxU2tvSlp3YURJOVFqWkZrV0VLaGJQbldEdS0tV21LS01kOGpOSC9ZWlk0Ry0tZ2ZTcE9EMnkvSHVVSkUvTEhEOWFKQT09?cid=2293724267	Get hash	malicious	KnowBe4	Browse	34.233.23.178
	https://secure-mail.web.magnetonics.com/XYUplc3JPalpuZ2tsL0s3eW1FZTQzVXdBbkRTQlhudjJVMWlZdTlHUW51elRUVG5QOEhlMTg0MXUzb3VXWkJzRGQ2ODlFV0ZMeXBwN0txZ1lRckxxYk9XV1MvcXk2L0EvWHMyY0JKQTFTMytWdmduZ1J6aW1IOWh4eWlER21pOVJwTUhiZFdKMVJBUUhkZmswZS9mVDY0WDVGZFpRLzZTS3VWTlRqaGdqYm1hWG9QaEZWQmJ2d1RYeWxyNjNLVUVvaGtmS2pBZlYwdWtqMGtwWHJXOD0tLUlSL1J5NlA4VnkzaGRLbEYtLU1PTExESEVObm5kbC9kNzBWdS9hWEE9PQ==?cid=2289196598	Get hash	malicious	KnowBe4	Browse	44.196.219.76
	https://2fa.com-token-auth.com/XLzgrdk01ellQd1gvQjlDc2VyNTJoRHlpQ0lSMHBKeFZZV0RyZ1Q3YUlVbENaRG50WDFzWjhWZTNmMllYNjZHN283dE8vOG02QklSQUZxNVRFUzZVRkovMnJ0YVZweExPcjhwdHlNdXRpbzhWVWJnZDdSbTVCSkhId0dHcjNzTkovc3F3MFV6eWFjdEZGNkpHTlVPdWxRTlVUOHZ6RUVGN3FlL2VVSzlzY09tVldDN2l2OVlFalZtWW9RPT0tLUpSRGZWdnhOOENBUTNhcGEtLUU0RE5seTEwRHZtK043c1QyOTFrV3c9PQ==?cid=2293130893	Get hash	malicious	KnowBe4	Browse	52.4.233.203
	8347392490280.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	3.228.211.141

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WIKIMEDIAUS	https://rnicrosoft-secured-office.squarespace.com/sharepoint?e=test@test.com.au	Get hash	malicious	HTMLPhisher	Browse	185.15.58.240
	https://jxgy-zcmp.maillist-manage.eu/click/1315cead38f4e738/1315cead38f50cec	Get hash	malicious	Unknown	Browse	185.15.58.224
	http://lesman-dot-x-alcove-439604-j8.uk.r.appspot.com/	Get hash	malicious	Unknown	Browse	185.15.58.240
	https://05kqatnrj9s0snah9.phish.farm/XckdRam1iZXdLcHBTUFlJTlR4SkE5bGxnQ0I0VmtpVFhRWTltRlk3ejQvN2h4WHR0SlJUOXVLRkF5QkQ1R1dlRVVMYWg3RlJPUWwwUFRyeXJqWkhrNHZqU0ErUy9KTC9GRU5UNU9LOFBMaCtIOUgrWG85c2NJdXRVVGY4eG5FVEYrOGgyRGlBQnE2dlQxK1ptMGkvRkUwbkJSMGpnZkMxU2tvSlp3YURJOVFqWkZrV0VLaGJQbldEdS0tV21LS01kOGpOSC9ZWlk0Ry0tZ2ZTcE9EMnkvSHVVSkUvTEhEOWFKQT09?cid=2293724267	Get hash	malicious	KnowBe4	Browse	185.15.58.240
	https://t.co/nq9BYOxCg9	Get hash	malicious	HTMLPhisher	Browse	185.15.58.240
	eInvoice.html	Get hash	malicious	HTMLPhisher	Browse	185.15.58.240
	https://na01.safelinks.protection.outlook.com.url.protected-forms.com/XRDg1aXJTZEo3WnVjMi8rYmFSTlJrZUxJc2pYa2dEMjRmVzkrVm1KSjV2dmFMNjhRYVlhZzhQcGhVa3U0aGJMWjZjZDMzbmdQR3p2azkvT29vbzZYTW96OGE5a1A4c1UxRDdqMXRjTFY3S0c0aGRESzdvcmVmNXVVNEt3WjhyR2ppang0eWN2SGRvakNDK3h6MUg1T1BwNlZ1NVJjRjFPdisrUmV5cmpyRHNUSWtiRzBSRzRPa3hPa21UdkRaQ0dxc21yQk96dlU0K009LS11MEhPdmp1QjU2QWFUdjVDLS1Ubld1REU3SXI3TTJOeG1paVBDQ3pRPT0=?cid=2272549020	Get hash	malicious	HTMLPhisher, KnowBe4	Browse	185.15.58.240
	Rockwool-Benefits-Pay_CCMYTTJHZY.docx	Get hash	malicious	FakeAntivirus	Browse	185.15.58.240
	Fatura931Pendente956.pdf761.msi	Get hash	malicious	Unknown	Browse	185.15.58.240
MIT-GATEWAYSUS	https://app.droplet.io/form/K47rYN	Get hash	malicious	Unknown	Browse	18.173.205.71
	.akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	18.23.216.147
	arm5.elf	Get hash	malicious	Unknown	Browse	18.42.143.185
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	19.17.72.189
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	19.35.70.222
	jmggnxeedy.elf	Get hash	malicious	Unknown	Browse	19.254.236.2
	https://i.postimg.cc/y6hBTtv7/png-Hand-SAward.png	Get hash	malicious	HTMLPhisher	Browse	18.165.216.233
	https://unum-emailverification.web.squarehealth.com/?key=WZLk1yIhxDj5tJW3uaZJQn%2BDxlU0ZZTDSJ9jJhd3ARniXVLwgtPCt9ivs7H7Kxiug8z%2BM0SOg88QQHugHRm3ZCjBlCjkT5383pDSGCuGej12PC1FVkSi5%2BrDQLeDPiVsasFGD9wNLGIx30qHuSxMJe9TSFyGtW7rPS52yCZCw4EWYN6petCR%2FRH3vwFlDkqk%2FIKBTBUot26KbneLxRqk%2FvEoiC14IoE8emMKUXlg2%2FA%3D	Get hash	malicious	Unknown	Browse	18.161.97.81
	na.elf	Get hash	malicious	Unknown	Browse	18.23.80.108
	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	18.161.111.117
AMAZON-AESUS	https://app.droplet.io/form/K47rYN	Get hash	malicious	Unknown	Browse	34.193.91.139
	https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#brian.smith@arnoldclark.com	Get hash	malicious	Unknown	Browse	54.235.109.11
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	54.224.241.105
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	50.16.47.176
	https://dsbemcm.r.us-east-1.awstrack.me/L0/https:%2F%2Fmondialrelay-fr.pdfing.ai%2F/1/0100019399661370-1ce77c65-1b81-4233-8a20-5a39fd0f0317-000000/J1Yr9vKfHbZhazSj6gj8UC7ow80=403	Get hash	malicious	Unknown	Browse	3.232.156.127
	IFhqcKaIol.lnk	Get hash	malicious	Unknown	Browse	3.219.243.226
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	44.221.131.20
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	44.196.3.45
	jew.mips.elf	Get hash	malicious	Unknown	Browse	54.42.218.193
AMAZON-AESUS	https://app.droplet.io/form/K47rYN	Get hash	malicious	Unknown	Browse	34.193.91.139
	https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#brian.smith@arnoldclark.com	Get hash	malicious	Unknown	Browse	54.235.109.11
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	54.224.241.105
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	50.16.47.176
	https://dsbemcm.r.us-east-1.awstrack.me/L0/https:%2F%2Fmondialrelay-fr.pdfing.ai%2F/1/0100019399661370-1ce77c65-1b81-4233-8a20-5a39fd0f0317-000000/J1Yr9vKfHbZhazSj6gj8UC7ow80=403	Get hash	malicious	Unknown	Browse	3.232.156.127
	IFhqcKaIol.lnk	Get hash	malicious	Unknown	Browse	3.219.243.226
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	44.221.131.20
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	44.196.3.45
	jew.mips.elf	Get hash	malicious	Unknown	Browse	54.42.218.193

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://app.droplet.io/form/K47rYN	Get hash	malicious	Unknown	Browse	20.190.177.84 20.109.210.53 13.107.246.63
	https://shorturl.at/yWYYs?US=1583v79i	Get hash	malicious	Unknown	Browse	20.190.177.84 20.109.210.53 13.107.246.63
	https://haqzt.trc20.kcgrocks.com/merchantServices	Get hash	malicious	Unknown	Browse	20.190.177.84 20.109.210.53 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.190.177.84 20.109.210.53 13.107.246.63
	https://m0g9861wc1.execute-api.us-east-1.amazonaws.com/uyt/#brian.smith@arnoldclark.com	Get hash	malicious	Unknown	Browse	20.190.177.84 20.109.210.53 13.107.246.63
	http://leatherbook.org	Get hash	malicious	Unknown	Browse	20.190.177.84 20.109.210.53 13.107.246.63
	https://www.schneiderpostaccident.com	Get hash	malicious	Unknown	Browse	20.190.177.84 20.109.210.53 13.107.246.63
	vUlh7stUHJ.exe	Get hash	malicious	XWorm	Browse	20.190.177.84 20.109.210.53 13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.190.177.84 20.109.210.53 13.107.246.63
	y1rS62yprs.exe	Get hash	malicious	Babadeda	Browse	20.190.177.84 20.109.210.53 13.107.246.63
6271f898ce5be7dd52b0fc260d0662b3	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	34.196.207.207
	Outstanding_Payment.vbs	Get hash	malicious	Unknown	Browse	34.196.207.207
	https://ness.wiktripfitness.com/ghjki9l-8765t4/3/er4t5y6u7jyhtgrfefrgthyjuyhtgdsarfedwsqa	Get hash	malicious	Unknown	Browse	34.196.207.207
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	34.196.207.207
	https://cdn.tailwindcss.com	Get hash	malicious	Unknown	Browse	34.196.207.207
	Itelyum_Regeneration_S.P.A___Bank_of_America_KYC_Outreach.eml	Get hash	malicious	Unknown	Browse	34.196.207.207
	Structural_Design_Proposal.docx.doc	Get hash	malicious	Unknown	Browse	34.196.207.207
	Invoice268277.pdf	Get hash	malicious	Unknown	Browse	34.196.207.207
	http://vpnconsumer.com	Get hash	malicious	Unknown	Browse	34.196.207.207
	4z0JKnfc8L.xlsx	Get hash	malicious	Unknown	Browse	34.196.207.207

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:	3072:gdTb5Sb3F2FqSrfZm+CnQsbzxZO7aYb6f5780K2:wb5q3umBnzT
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Reputation:	high, very likely benign file
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:	12288:Zn84XULLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/cLQ/zhm1kjFKy6Nyjbqq+:N8XPDs5+ivOXgo1kYvyz2
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8368618060228155
Encrypted:	false
SSDEEP:	48:uiTrlKxsxxmxl9Il8uxYoEaAiMXy2SBe45cDk6iSw2leeygZzd1rc:viYHdEaRMeBV5czf7leePU
MD5:	B84AE16C26990AC9089EB364E2EAE36A
SHA1:	BD6349A5E871AC82D6E4170F862177550308B0F6
SHA-256:	D5A65C2ACDBCF3B26C7AEDC05C4F8EA091436E21E5FBEC33A09D640D5B20B429
SHA-512:	B8FE2D071D0A473E60DFCDF440B9174A50F0FB3468D1D436E0CAE2FE5F63B24CB7D211869C75455852A440041F280FEA10F4B2A78291FE88CF1F1D3C1194CA64
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.I.o.1.p.w.J.I.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.I.m.k.e.l.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.900132188353977
Encrypted:	false
SSDEEP:	48:uiTrlKxJxWxl9Il8uxNT+MCVheGAwJGiI7dta4r7Vd/vc:nYHN7CSpg4r7U
MD5:	3EBD446CB930419F05B4B359E4F0A8F9
SHA1:	18398652B20806033C6F9B546A9F2272044C1819
SHA-256:	C2174BF4D3B6453A34AAE5CCDBEE9F82B94F4F444BA774493DEEDC094B410370
SHA-512:	524515E222DEA211B93C9F779F0D3646B94F3B8E331714860DF13959C098084EDAF8F865CD57491ED43BB9D0E56638839730E564A92FA62850653CDA0477F307
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.H.X.L.G.R.5.H.j.D.k.3.C.i.F.b.L.a.m.K.N.+.n.c.g.T.0.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".9.r.7.k.v.s.t.m.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.I.m.k.e.l.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	3.995370826672358
Encrypted:	false
SSDEEP:	48:uiTrlKxxx9xD9Il8uxYKHPT0Bzfp7tjru4sNQvRF3RCmr/3OBc5CiCqgegQhtuhT:CYHYKvipxurWRDCCeqB1gaqo1s5TdSQD
MD5:	5060A94CAA1BEAED3D3E6BEC3AFEDB18
SHA1:	6ADB272FF6FBC41C500E27105E4B945DBF2C74A9
SHA-256:	663F15445DA0B5540AEC2EA0B531BFF027127B2F770F6BFA693D95F374300A1C
SHA-512:	8206786FF8EA4189714B2D474D23B797252437A34098A944B1538284DDFFFA0DA3D2CBC28B3F2EBB9C15C28F465C12F098764E52E0815428B8D2BC90F94715CA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".o.S.9.H.j.f.p.H.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.d.I.m.k.e.l.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\63534831.jpeg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 337x150, components 3
Category:	dropped
Size (bytes):	6217
Entropy (8bit):	7.910953250801019
Encrypted:	false
SSDEEP:	192:bi7WdHL0rhMOzR7SboKrNj59SFtH7I+MyZ:2idL0rttekoNfS3MG
MD5:	711770BAC92B61644F0A0FB4F917DB44
SHA1:	FF697068764E82833C34833ADE1E0866FC790E78
SHA-256:	F7A061901758E6043632DD450C736D218B256A08BE22DDF40DE2C57682A4CED3
SHA-512:	6DE07CD4BB5FBC1C3C8F8C5356ADB0562EC3D215DC5993F08EEDB52AFCC2F1B42C0A6BC50E000D2A6ADF19EA5686B7F4D6CFC2E30225C258424441E9AF834968
Malicious:	false
Preview:	......JFIF.................................................. ( ..&..."1!%)+../..383-8)-.+...........7% "3770573-17327+-0-5.75-.77-7427--82746--2-5-/3--5+-........Q.."........................................P.........................!...1"AQaq.2...#3BRrst.....456CSb...U.....$%.................................................................!4..123AQqr....a................?..Q..........)D..Q."...E6D..R.!...B)D..l.!...E6K .R.!..,..J .Sd..E(..JY.".".E(..........D.D@DD.D@DD.D@DD.D@DD.D@DD.D@DD.D@DD.D@DD.D@DD.E.s....~......QS.q.....?..4z.7...T..5.......Y....w.f..eC...o.t....k+.....u...j..........=gS.Y.UL..<.\|...%..m...Q..a..4m.:..k..+..../.t}w..J......>...{.....+8.....=...\....._%.N6....v\.wi.N.xn.v1OP/.....Hx...=y.pH#....V....B.H.H....%.....O....rf6...U.Z>.5k..".....J0..g....kH#..d7..oJ...(..0.r...\.................+g..Y#......!``.q3.k.; a.......c4t.d5...ZQ.rT..t......@.}..l.$.iO.D.X..q....49..tO+.."......F.DT...w......<...../...43..C...{...jv...n..8...2

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{EAA8276B-2E93-4C9C-8B2D-B9CD5E7CD592}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	1.4260284318211052
Encrypted:	false
SSDEEP:	12:rl3lTpFQ7XIgaegaeCI4wo4woCICICb77:rnMHk
MD5:	7A167E67600D36C484B8D2F08648F4E3
SHA1:	A25047301288067004999C7F4B80E0155EB1F82A
SHA-256:	829434C38543681FCD28FA5D6242D63DBC5B68FE12FC9AF64322C3FF237DF363
SHA-512:	A08975D66F84FBFF2D63AB16564C607413BBDB168EBD2B3C15807CEEA6A45795DED2EAA8FF66E421136F568C23840DCAF8E8C241936DB75D00AF94F30DA37759
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{4F1984A5-4312-49A7-9155-4E7DEC480E0A}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.5084060033114233
Encrypted:	false
SSDEEP:	3:ml+lGl+l+l+l1PPPHRlALlPy1Pl7lhlJvl5hzldlxpxl/b1l/pl/Ppl/Rl/POlhe:mEMEEE3Dmlq14sl9lCgKufWqGz2kRAX
MD5:	75E3245575CC058B57C5F6B3944950BF
SHA1:	8E00CEBC6A2533E0E86A93B4FAC1CF57D5575F95
SHA-256:	2DEBBF14ABD9330554A858D841CE9BDB851198119311F5D0100A16563E200BA7
SHA-512:	E9633168C8415B7C3E3965383B255E796990CA738958B34246821D37F323267531F952580DF8D48DB924F89D231444FA7C215F162CD283A014D0F93A147DEAD1
Malicious:	false
Preview:	....1.2.....1.2.....1.....1.....1.2.....1.2.....1.2.....1.2.....(.....(.....(.....(.....(...j.o.n.e.s...j............................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...&...(.......0...6...8...>...@...D...F...J...L...P...R...V...X...\...h...l...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{FB6653F0-A1A5-4B11-B275-635DE211F946}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	3.8017762494150626
Encrypted:	false
SSDEEP:	96:6VGkUG8FxXY1IxfjrMJfpZl5V6SNKvU4XzqOUCgk4eZoiGpQO4ufXPzyOznKSap6:6VSYedrM1V4Uozqd1saFfXPbu1Pg
MD5:	D9A472D1190B6748A489913F6D4DEA8D
SHA1:	C09AFEC0D240A220A4F9A0B0AE8C1DCA0BBF91AD
SHA-256:	0028071E9D20D13827D01F3959255535FA4897F7FA8DE74589D1931057185C78
SHA-512:	E5A40A4B948C6A560A98EF437C45072887B6DA75B0D7605CD10B3A75E3D8EAD07B6B4C4B33E762F711E977614992E2710C3BF8A64384AB171950F8CEC7EA2CFF
Malicious:	false
Preview:	.................................. .I.N.C.L.U.D.E.P.I.C.T.U.R.E. .".". .\.*. .M.E.R.G.E.F.O.R.M.A.T. .\.d. ..................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ..."...@...D...................................d...f...h..................................................................................................................................................................................................................................................................................................................................................................$.a$.gd/(.......$.a$.gdM%P...

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1733501813671989200_2D19354F-AE74-4435-90CA-88A30FB6DED6.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (4487), with CRLF line terminators
Category:	dropped
Size (bytes):	27406
Entropy (8bit):	5.52784271323239
Encrypted:	false
SSDEEP:	768:p+Tt5jBNbM/UkH8FzzWKyeBrDYgujmL9QM0pERigVe7BhI/10OGhYwkE:p+Tt5jBNbqUkH8FfWKySrDYjmL6M0pEk
MD5:	71D1D128931776A12343718895ED6E33
SHA1:	64FCCEF763B9E3A0F09C7365B7C4EE6431CBD2B7
SHA-256:	59C2C2F1317091DF958C47113F57688AE1466A2C9889243C3E7FA027415DF965
SHA-512:	B7794F00E87BA20AA928798B974E47CD4F519BB24B027A9AF467BD31419D3841B52CDFE838C33EE6A75703CF2599F14267610947D668AB4CE6C5A5C9E58A39FD
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/06/2024 16:16:53.851.WINWORD (0x1E00).0x1E5C.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-12-06T16:16:53.851Z","Contract":"Office.System.Activity","Activity.CV":"TzUZLXSuNUSQyoijD7be1g.7.1","Activity.Duration":426,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...12/06/2024 16:16:53.851.WINWORD (0x1E00).0x1E5C.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":24,"Time":"2024-12-06T16:16:53.851Z","Contract":"Office.System.Activity","Activity.CV":"TzUZLXSuNUSQyoijD7be1g.7","Activity.Duration":2889,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.FailureD

C:\Users\user\AppData\Local\Temp\TCD40D.tmp\Main_Event.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Local\Temp\TCD40D.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5434534344080606
Encrypted:	false
SSDEEP:	6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
MD5:	C9812793A4E94320C49C7CA054EE6AA4
SHA1:	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA
SHA-256:	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
SHA-512:	D28AADEDE0473C5889F3B770E8D34B20570282B154CD9301932BF90BF6205CBBB96B51027DEC6788961BAF2776439ADBF9B56542C82D89280C0BEB600DF4B633
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.a.i.n._.E.v.e.n.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD43.tmp\Damask.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Local\Temp\TCD43.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.544065206514744
Encrypted:	false
SSDEEP:	6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
MD5:	06B3DDEFF905F75FA5FA5C5B70DCB938
SHA1:	E441B94F0621D593DC870A27B28AC6BE3842E7DB
SHA-256:	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
SHA-512:	058792BAA633516037E7D833C8F59584BA5742E050FA918B1BEFC6F64A226AB3821B6347A729BEC2DF68BB2DFD2F8E27947F74CD4F6BDF842606B9DEDA0B75CC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.a.m.a.s.k...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD48C.tmp\Mesh.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD48C.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5303110391598502
Encrypted:	false
SSDEEP:	6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
MD5:	8D1E1991838307E4C2197ECB5BA9FA79
SHA1:	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93
SHA-256:	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
SHA-512:	DCDC9DB834303CC3EC8F1C94D950A104C504C588CE7631CE47E24268AABC18B1C23B6BEC3E2675E8A2A11C4D80EBF020324E0C7F985EA3A7BBC77C1101C23D01
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.s.h...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD896.tmp\Vapor_Trail.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD896.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.5359188337181853
Encrypted:	false
SSDEEP:	6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
MD5:	0FEA64606C519B78B7A52639FEA11492
SHA1:	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76
SHA-256:	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
SHA-512:	E04102E435B8297BF33086C0AD291AD36B5B4A97A59767F9CAC181D17CFB21D3CAA3235C7CD59BB301C58169C51C05DDDF2D637214384B9CC0324DAB0BB1EF8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.p.o.r._.T.r.a.i.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD934.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.4699940532942914
Encrypted:	false
SSDEEP:	6:fxnxUXGWWYlIWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxny2WzIgN2RGHmD0wbnKYZAH+Vwv
MD5:	55BA5B2974A072B131249FD9FD42EB91
SHA1:	6509F8AC0AA23F9B8F3986217190F10206A691EA
SHA-256:	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
SHA-512:	3DFB0B21D09B63AF69698252D073D51144B4E6D56C87B092F5D97CE07CBCF9C966828259C8D95944A7732549C554AE1FF363CB936CA50C889C364AA97501B558
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.s.i.g.h.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD934.tmp\Insight design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Local\Temp\TCDF370.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4721586910685547
Encrypted:	false
SSDEEP:	6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
MD5:	4DD225E2A305B50AF39084CE568B8110
SHA1:	C85173D49FC1522121AA2B0B2E98ADF4BB95B897
SHA-256:	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
SHA-512:	0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF370.tmp\chevronaccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Local\Temp\TCDF371.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.4680595384446202
Encrypted:	false
SSDEEP:	6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
MD5:	D79B5DE6D93AC06005761D88783B3EE6
SHA1:	E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
SHA-256:	96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
SHA-512:	34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF371.tmp\architecture.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Local\Temp\TCDF394.tmp\CircleProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Local\Temp\TCDF394.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4720677950594836
Encrypted:	false
SSDEEP:	6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
MD5:	D04EC08EFE18D1611BDB9A5EC0CC00B1
SHA1:	668FF6DFE64D5306220341FC2C1353199D122932
SHA-256:	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
SHA-512:	97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF395.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.4871192480632223
Encrypted:	false
SSDEEP:	6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	333BA58FCE326DEA1E4A9DE67475AA95
SHA1:	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
SHA-256:	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
SHA-512:	BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF395.tmp\mlaseventheditionofficeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Local\Temp\TCDF3A6.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5280239200222887
Encrypted:	false
SSDEEP:	6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
MD5:	877A8A960B2140E3A0A2752550959DB9
SHA1:	FBEC17B332CBC42F2F16A1A08767623C7955DF48
SHA-256:	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
SHA-512:	B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF3A6.tmp\gb.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDF3B9.tmp\APASixthEditionOfficeOnline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Local\Temp\TCDF3B9.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.541819892045459
Encrypted:	false
SSDEEP:	6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
MD5:	C3216C3FC73A4B3FFFE7ED67153AB7B5
SHA1:	F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
SHA-256:	7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
SHA-512:	D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF3BA.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.523917709458511
Encrypted:	false
SSDEEP:	6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
MD5:	4A9A2E8DB82C90608C96008A5B6160EF
SHA1:	A49110814D9546B142C132EBB5B9D8A1EC23E2E6
SHA-256:	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
SHA-512:	320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF3BA.tmp\chicago.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDF3EC.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	3.5414485333689694
Encrypted:	false
SSDEEP:	6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
MD5:	2F7A8FE4E5046175500AFFA228F99576
SHA1:	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
SHA-256:	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
SHA-512:	4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF3EC.tmp\Text Sidebar (Annual Report Red and Black design).docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Local\Temp\TCDF3FC.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.472155835869843
Encrypted:	false
SSDEEP:	6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
MD5:	2240CF2315F2EB448CEA6E9CE21B5AC5
SHA1:	46332668E2169E86760CBD975FF6FA9DB5274F43
SHA-256:	0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
SHA-512:	10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF3FC.tmp\rings.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Local\Temp\TCDF44A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.4895685222798054
Encrypted:	false
SSDEEP:	6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
MD5:	63E8B0621B5DEFE1EF17F02EFBFC2436
SHA1:	2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
SHA-256:	9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
SHA-512:	A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF44A.tmp\VaryingWidthList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Local\Temp\TCDF45F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4670546921349774
Encrypted:	false
SSDEEP:	6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
MD5:	3D52060B74D7D448DC733FFE5B92CB52
SHA1:	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
SHA-256:	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
SHA-512:	952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF45F.tmp\ThemePictureAlternatingAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Local\Temp\TCDF470.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.494357416502254
Encrypted:	false
SSDEEP:	6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
MD5:	6F8FE7B05855C203F6DEC5C31885DD08
SHA1:	9CC27D17B654C6205284DECA3278DA0DD0153AFF
SHA-256:	B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
SHA-512:	C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF470.tmp\ThemePictureGrid.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Local\Temp\TCDF493.tmp\BracketList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Local\Temp\TCDF493.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.4916022431157345
Encrypted:	false
SSDEEP:	6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
MD5:	1A314B08BB9194A41E3794EF54017811
SHA1:	D1E70DB69CA737101524C75E634BB72F969464FF
SHA-256:	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
SHA-512:	AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF494.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.484503080761839
Encrypted:	false
SSDEEP:	6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
MD5:	1309D172F10DD53911779C89A06BBF65
SHA1:	274351A1059868E9DEB53ADF01209E6BFBDFADFB
SHA-256:	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
SHA-512:	31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF494.tmp\InterconnectedBlockProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Local\Temp\TCDF495.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4845992218379616
Encrypted:	false
SSDEEP:	6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
MD5:	E8B30D1070779CC14FBE93C8F5CF65BE
SHA1:	9C87F7BC66CF55634AB3F070064AAF8CC977CD05
SHA-256:	2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
SHA-512:	C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF495.tmp\HexagonRadial.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Local\Temp\TCDF496.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.5026803317779778
Encrypted:	false
SSDEEP:	6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
MD5:	A0D51783BFEE86F3AC46A810404B6796
SHA1:	93C5B21938DA69363DBF79CE594C302344AF9D9E
SHA-256:	47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
SHA-512:	CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF496.tmp\gosttitle.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDF4A7.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.537169234443227
Encrypted:	false
SSDEEP:	6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
MD5:	9C00979164E78E3B890E56BE2DF00666
SHA1:	1FA3C439D214C34168ADF0FBA5184477084A0E51
SHA-256:	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
SHA-512:	54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF4A7.tmp\iso690nmerical.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Local\Temp\TCDF4A8.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5161159456784024
Encrypted:	false
SSDEEP:	6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
MD5:	C15EB3F4306EBF75D1E7C3C9382DEECC
SHA1:	A3F9684794FFD59151A80F97770D4A79F1D030A6
SHA-256:	23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
SHA-512:	ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF4A8.tmp\turabian.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Local\Temp\TCDF4A9.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.48087342759872
Encrypted:	false
SSDEEP:	6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
MD5:	69757AF3677EA8D80A2FBE44DEE7B9E4
SHA1:	26AF5881B48F0CB81F194D1D96E3658F8763467C
SHA-256:	0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
SHA-512:	BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF4A9.tmp\PictureFrame.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Local\Temp\TCDF4B9.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5039994158393686
Encrypted:	false
SSDEEP:	6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
MD5:	16711B951E1130126E240A6E4CC2E382
SHA1:	8095AA79AEE029FD06428244CA2A6F28408448DB
SHA-256:	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
SHA-512:	454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF4B9.tmp\TabbedArc.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Local\Temp\TCDF4CA.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.464918006641019
Encrypted:	false
SSDEEP:	6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
MD5:	93149E194021B37162FD86684ED22401
SHA1:	1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
SHA-256:	50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
SHA-512:	410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDF4CA.tmp\Equations.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Local\Temp\TCDF4EB.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.438490642908344
Encrypted:	false
SSDEEP:	6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
MD5:	0F98498818DC28E82597356E2650773C
SHA1:	1995660972A978D17BC483FCB5EE6D15E7058046
SHA-256:	4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
SHA-512:	768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCDF4EB.tmp\Element design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Local\Temp\TCDF4EC.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4901887319218092
Encrypted:	false
SSDEEP:	6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
MD5:	52BD0762F3DC77334807DDFC60D5F304
SHA1:	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
SHA-256:	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
SHA-512:	FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF4EC.tmp\RadialPictureList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Local\Temp\TCDF4ED.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.4866056878458096
Encrypted:	false
SSDEEP:	6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
MD5:	6C489D45F3B56845E68BE07EA804C698
SHA1:	C4C9012C0159770CB882870D4C92C307126CEC3F
SHA-256:	3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
SHA-512:	D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF4ED.tmp\ThemePictureAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Local\Temp\TCDF4FE.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	3.4692172273306268
Encrypted:	false
SSDEEP:	6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
MD5:	C1B36A0547FB75445957A619201143AC
SHA1:	CDB0A18152F57653F1A707D39F3D7FB504E244A7
SHA-256:	4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
SHA-512:	0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF4FE.tmp\pictureorgchart.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Local\Temp\TCDF4FF.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.547857457374301
Encrypted:	false
SSDEEP:	6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	4EC6724CBBA516CF202A6BD17226D02C
SHA1:	E412C574D567F0BA68B4A31EDB46A6AB3546EA95
SHA-256:	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
SHA-512:	DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF4FF.tmp\harvardanglia2008officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Local\Temp\TCDF51F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.5230842510951934
Encrypted:	false
SSDEEP:	6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	F25AC64EC63FA98D9E37782E2E49D6E6
SHA1:	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
SHA-256:	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
SHA-512:	A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF51F.tmp\ieee2006officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Local\Temp\TCDF530.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5502940710609354
Encrypted:	false
SSDEEP:	6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
MD5:	9B8D7EFE8A69E41CDC2439C38FE59FAF
SHA1:	034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
SHA-256:	70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
SHA-512:	E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF530.tmp\iso690.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDF531.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.538396048757031
Encrypted:	false
SSDEEP:	6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
MD5:	149948E41627BE5DC454558E12AF2DA4
SHA1:	DB72388C037F0B638FCD007FAB46C916249720A8
SHA-256:	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
SHA-512:	070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF531.tmp\sist02.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCDF532.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.4938093034530917
Encrypted:	false
SSDEEP:	6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
MD5:	A6B2731ECC78E7CED9ED5408AB4F2931
SHA1:	BA15D036D522978409846EA682A1D7778381266F
SHA-256:	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
SHA-512:	666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF532.tmp\TabList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Local\Temp\TCDF562.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.4842773155694724
Encrypted:	false
SSDEEP:	6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
MD5:	923D406B2170497AD4832F0AD3403168
SHA1:	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
SHA-256:	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
SHA-512:	A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCDF562.tmp\ConvergingText.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Local\Temp\TCDF5B1.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5081874837369886
Encrypted:	false
SSDEEP:	6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
MD5:	8D9B02CC69FA40564E6C781A9CC9E626
SHA1:	352469A1ABB8DA1DC550D7E27924E552B0D39204
SHA-256:	1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
SHA-512:	8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCDF5B1.tmp\gostname.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Local\Temp\TCDF630.tmp\View.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCDF630.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.535303979138867
Encrypted:	false
SSDEEP:	6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
MD5:	35AFE8D8724F3E19EB08274906926A0B
SHA1:	435B528AAF746428A01F375226C5A6A04099DF75
SHA-256:	97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
SHA-512:	ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF693.tmp\Dividend.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDF693.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5459495297497368
Encrypted:	false
SSDEEP:	6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
MD5:	76340C3F8A0BFCEDAB48B08C57D9B559
SHA1:	E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
SHA-256:	78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
SHA-512:	49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF694.tmp\Parcel.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDF694.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.516359852766808
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
MD5:	960E28B1E0AB3522A8A8558C02694ECF
SHA1:	8387E9FD5179A8C811CCB5878BAC305E6A166F93
SHA-256:	2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
SHA-512:	89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF6A5.tmp\Basis.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDF6A5.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5361139545278144
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
MD5:	133D126F0DE2CC4B29ECE38194983265
SHA1:	D8D701298D7949BE6235493925026ED405290D43
SHA-256:	08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
SHA-512:	75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF6B7.tmp\Banded.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDF6B7.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.535736910133401
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
MD5:	487E25E610F3FC2EEA27AB54324EA8F6
SHA1:	11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
SHA-256:	022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
SHA-512:	B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF6D7.tmp\Frame.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCDF6D7.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5159096381406645
Encrypted:	false
SSDEEP:	6:Q+sxnxUXQIa3ARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygIaqymD0wbnKNAH/lMz1
MD5:	71CCB69AF8DD9821F463270FB8CBB285
SHA1:	8FED3EB733A74B2A57D72961F0E4CF8BCA42C851
SHA-256:	8E63D7ABA97DABF9C20D2FAC6EB1665A5D3FDEAB5FA29E4750566424AE6E40B4
SHA-512:	E62FC5BEAEC98C5FDD010FABDAA8D69237D31CA9A1C73F168B1C3ED90B6A9B95E613DEAD50EB8A5B71A7422942F13D6B5A299EB2353542811F2EF9DA7C3A15DC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .F.r.a.m.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF6E8.tmp\Metropolitan.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCDF6E8.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5091498509646044
Encrypted:	false
SSDEEP:	6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
MD5:	23D59577F4AE6C6D1527A1B8CDB9AB19
SHA1:	A345D683E54D04CC0105C4BFFCEF8C6617A0093D
SHA-256:	9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
SHA-512:	B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF8FF.tmp\Parallax.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCDF8FF.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.51145753448333
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
MD5:	7956D2B60E2A254A07D46BCA07D0EFF0
SHA1:	AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
SHA-256:	C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
SHA-512:	668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF920.tmp\Wood_Type.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Local\Temp\TCDF920.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.5552837910707304
Encrypted:	false
SSDEEP:	6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
MD5:	5728F26DF04D174DE9BDFF51D0668E2A
SHA1:	C998DF970655E4AF9C270CC85901A563CFDBCC22
SHA-256:	979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840
SHA-512:	491B36AC6D4749F7448B9A3A6E6465E8D97FB30F33EF5019AF65660E98F4570711EFF5FC31CBB8414AD9355029610E6F93509BC4B2FB6EA79C7CB09069DE7362
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .W.o.o.d._.T.y.p.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF931.tmp\Quotable.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Local\Temp\TCDF931.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5323495192404475
Encrypted:	false
SSDEEP:	6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
MD5:	BD6B5A98CA4E6C5DBA57C5AD167EDD00
SHA1:	CCFF7F635B31D12707DC0AC6D1191AB5C4760107
SHA-256:	F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
SHA-512:	A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDF951.tmp\Berlin.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDF951.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5270134268591966
Encrypted:	false
SSDEEP:	6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
MD5:	327DA4A5C757C0F1449976BE82653129
SHA1:	CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
SHA-256:	341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
SHA-512:	9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDFADA.tmp\Gallery.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Local\Temp\TCDFADA.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5301133500353727
Encrypted:	false
SSDEEP:	6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
MD5:	1C5D58A5ED3B40486BC22B254D17D1DD
SHA1:	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A
SHA-256:	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
SHA-512:	4736E4F26C6FAAB47718945BA54BD841FE8EF61F0DBA927E5C4488593757DBF09689ABC387A8A44F7C74AA69BA89BEE8EA55C87999898FEFEB232B1BA8CC7086
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .G.a.l.l.e.r.y...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDFB59.tmp\Savon.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Local\Temp\TCDFB59.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5364757859412563
Encrypted:	false
SSDEEP:	6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
MD5:	CD465E8DA15E26569897213CA9F6BC9C
SHA1:	9EA9B5E6C9B7BF72A777A21EC17FD82BC4386D4C
SHA-256:	D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610
SHA-512:	869A42679F96414FE01FE1D79AF7B33A0C9B598B393E57E0E4D94D68A4F2107EC58B63A532702DA96A1F2F20CE72E6E08125B38745CD960DF62FE539646EDD8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.a.v.o.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDFBB8.tmp\Circuit.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDFBB8.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5286004619027067
Encrypted:	false
SSDEEP:	6:Q+sxnxUXOzXkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6WymD0wbnKNAH/lMz1
MD5:	40FF521ED2BA1B015F17F0B0E5D95068
SHA1:	0F29C084311084B8FDFE67855884D8EB60BDE1A6
SHA-256:	CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB
SHA-512:	9507E6145417AC730C284E58DC6B2063719400B395615C40D7885F78F57D55B251CB9C954D573CB8B6F073E4CEA82C0525AE90DEC68251C76A6F1B03FD9943C0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.u.i.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDFD22.tmp\Droplet.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDFD22.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.528155916440219
Encrypted:	false
SSDEEP:	6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
MD5:	AA7B919B21FD42C457948DE1E2988CB3
SHA1:	19DA49CF5540E5840E95F4E722B54D44F3154E04
SHA-256:	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
SHA-512:	01D27377942F69A0F2FE240DD73A1F97BB915E19D3D716EE4296C6EF8D8933C80E4E0C02F6C9FA72E531246713364190A2F67F43EDBE12826A1529BC2A629B00
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.r.o.p.l.e.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCDFF85.tmp\Slate.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCDFF85.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.516423078177173
Encrypted:	false
SSDEEP:	6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
MD5:	5402138088A9CF0993C08A0CA81287B8
SHA1:	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A
SHA-256:	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
SHA-512:	F40A8704F16AB1D5DCD861355B07C7CB555934BB9DA85AACDCF869DC942A9314FFA12231F9149D28D438BE6A1A14FCAB332E54B6679E29AD001B546A0F48DE64
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.l.a.t.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\cab13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1881952
Entropy (8bit):	7.999066394602922
Encrypted:	true
SSDEEP:	49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
MD5:	53C5F45B22E133B28D4BD3B5A350FDBD
SHA1:	D180CFB1438D27F76E1919DA3E84F307CB83434F
SHA-256:	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
SHA-512:	46AD3DA58C63CA62FCFC4FAF9A7B5B320F4898A1E84EEF4DE16E0C0843BAFE078982FC9F78C5AC6511740B35382400B5F7AC3AE99BB52E32AD9639437DB481D1
Malicious:	false
Preview:	MSCF.....x......D...............l............x..`?..........\|...D..............M[. .content.inf...!........M[. .Damask.thmx...o.PI..[.............../.TU.jj0..3jCUPU.jF...m.UU.P}.....PU..........w..#....E..].................A.. w.$..@..'g.......6%:..r9..d.M;M+.r.8[d{.s..dh..(P..........!.. ..ne..f.Nc..#..Y..q....KB}..b].@..F.&.t....E.........@&.m......$w......q...:.H....p.p.....?.9x.. .....?...ao....I....................o......g.u..;."....O;....{..(k..._.w/.Z......Jb..P.O?...........?....F....ty..72......! #....v..J......?.....!,.5.7..Em.....is.h.. \.H)i1v..zwp.....P.....x].X{O//..\....Z>z....6...+..a.c...;.K..+...?014..p.w%o^.....]...MguF...`....r.S.......eF..):.dnk#.p{..<..{..Ym...>...H......x.}.hI..M....e......*G.&.?..~.~G6.....+...D..p...._...T....F6.[Cx./Q..Xe.>.;.}>.^..:..SB.X..2.......(A..&j9....\\.......Haf+]Y...$t^Y=........><.w....tL../E...%6.Vr~MI...l.....<.0.I....7.Q8y.f.uu...I.p..O..eYYS.O......9..Qo.......:..........o.............{

C:\Users\user\AppData\Local\Temp\cab3CE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2527736
Entropy (8bit):	7.992272975565323
Encrypted:	true
SSDEEP:	49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
MD5:	F256ACA509B4C6C0144D278C7036B0A8
SHA1:	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6
SHA-256:	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
SHA-512:	08C57661F8CC9B547BBE42B4A5F8072B979E93346679ADE23CA685C0085F7BC14C26707B3D3C02F124359EBB640816E13763C7546FF095C96D2BB090320F3A95
Malicious:	false
Preview:	MSCF.....R&.....D............................R&.8?..............Z..............M). .content.inf..,........M). .Main_Event.thmx......R..[...............=.1.^xa..^...../..^x....QA^"....^/.I.{/F..F..........6Vn. ..._Hmc......<....#.{.@.....Xl../Y....Ye..'V.f.S.Vf.T..0t+..y...5O...{.....-.dT...........!...[ .ns..k.....QAA.. ....B..u.`.....{.\u8.0.....@t........K....@..w.......>...-1F...........1.E....O............_M.m..CP.O......X......g......].../..:C...Q...i.._"...M..1o...S../...9....k;...}S........y..;1o....1h......t.CL.3...].@...T...4.6.}.....M...f...[.s.."f....nZ.W......0.c.{.`.^..Oo.[.JT.2].^.f..a....kO......Q..G..s.5...V.Wj.....e...I,]...SHa..U.N.N.....v.C.....x..J{.Z.t...]WN...77BO-J......g......3:i..2..EFeL.,n..t:..,~4gt.w...M.5.'h.L..#..A&.O.ys%K.Z....F.PW..=jH...jGB.i..j.J.^.#.\n...J@.....-5.f.1jZ68.o...H2.......$O...>..ld&,#$.&_....yl.fkP$.........l....s....i.tx.~<.z...>..2.Gx..B..z.E.3.N<....`$.....b..?.w.[.X..1.=q!.s......v.......r.w

C:\Users\user\AppData\Local\Temp\cab42E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2591108
Entropy (8bit):	7.999030891647433
Encrypted:	true
SSDEEP:	49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
MD5:	BEB12A0464D096CA33BAEA4352CE800F
SHA1:	F678D650B4A41676BA05C836D462F34BDC5BF648
SHA-256:	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
SHA-512:	B6E7CCD1ECBB9A49FC72E40771725825DAF41DDB2FF8EA4ECCE18B8FA1A59D3B2C474ADD055F30DA58C7E833A6E6555EBB77CCC324B61CA337187B4B41F7008B
Malicious:	false
Preview:	MSCF.....D'.....D............................D'..D..........z...^..............M7. .content.inf............M7. .Mesh.thmx....&~j..[.....0.................]............ww,v.\....D......3m..m!f..0..E{..?..`..A...k.:....I..........\|bmG.FS...f.;.J.vzb.......R.......-....\|.......ESD.....".4M..M..t.N....y..,..#.4.5.2.......'.8.Q..3.D..T....!.......&rJg...s........(..9........Dw..'....9.-..G.c............E.. .O.....a..O.._..s..)7Wz~....bJ..D...o....0..R/.#...?.......~6.Q?....?y...g.?............TP..r-...>....-..!.6...B.....\../...2....4...p$...Oge.G.?.....S.#x(..$.A~.U.%f....dJ..S.f{.g.._..3{.fm2.....Z.\o&.[k.m....ko.8..r.-.Go.OQ..'!6..f.L...Ud.$.q.L.....R.. J.T&4g...7.2K...#k.[.].:....lk.....;c..DRx.`..&L..cpv.>.Ngz~.{..v5.\...'C.<R:.C8.\|.fE{......K...).....T...gz}..rF..Q.dof7.....D.f=cm...U\|.O.]F...5zg(.. ....S..._?D....^..+.i...Z.....+X..U!4qy..._..`I..>./.W.7......=.O....BG..=..%9\|...3.?...}.$"..H..u...0.......a..:t?.....8...Z..#g.=<.e.`\......KQ..U....

C:\Users\user\AppData\Local\Temp\cab847.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	3256855
Entropy (8bit):	7.996842935632312
Encrypted:	true
SSDEEP:	98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
MD5:	8867BDF5FC754DA9DA6F5BA341334595
SHA1:	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9
SHA-256:	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
SHA-512:	93421D7FE305D27E7E2FD8521A8B328063CD22FE4DE67CCCF5D3B8F0258EF28027195C53062D179CD2EBA3A7E6F6A34A7A29297D4AF57650AA6DD19D1EF8413D
Malicious:	false
Preview:	MSCF....Gm1.....D...............cM..........Gm1..D..............o... ..........MP. .content.inf...7. ......MP. .Vapor_Trail.thmx..n...N..[......L........7...+I..x...P7/...BH..Rm.\yqi.x..B....{.m.............=.....p.%.@......BpV.[......C.4..X./..Y.'SB..........0.Gr.FG.).....R\...2..Jt..1..._.4_B..................cn7H.-.....Q...1..G{G.~.. '.$......@.(....=@=..`....@.@.A. ....'.4`. .@....D...'....S.s..9.7" /....?.aY.c.........LG....k...?_.....P.....?.1.....FB..m..t...['......:...?...W..../~..z.Tr...X.@...._....3..N..p.....b...t.....^..t...~..t.8A...t_....D..3R.Z.=..{.A.8).3-5..v.isz....0A~%.s.D.4....k.K......8......)R.}f.E..n.g&:W...'E....4%T..>......b.y..[..zI....e...j.s....F.....\|7826U.C.,..BY.U.F.f......"..#.m..,..._...#.\.....gPP.2.}Kas......g..3.d0.Z.Z.]..n......MY]6.....].m..D.6...?.n.20.,.#...S...JK..#.W.%.Z4.....i..CBf...../..z......n.N...U.....8t...ny...=.!..#..SF..e...1.P..@.Qx*.f.;..t..S.>..... F..)...@.Y..5j....x....vI.mM....Z.W..77...

C:\Users\user\AppData\Local\Temp\cab8D5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	3417042
Entropy (8bit):	7.997652455069165
Encrypted:	true
SSDEEP:	98304:1YYkj2mRz6vkkB15AW4QD0ms+FdniD60bDUpS:qYkj7d6vP7NZDLn+PM8
MD5:	749C3615E54C8E6875518CFD84E5A1B2
SHA1:	64D51EB1156E850ECA706B00961C8B101F5AC2FC
SHA-256:	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
SHA-512:	A5F591BA5C31513BD52BBFC5C6CAA79C036C7B50A55C4FDF96C84D311CCDCF1341F1665F1DA436D3744094280F98660481DCA4AA30BCEB3A7FCCB2A62412DC99
Malicious:	false
Preview:	MSCF......3.....L.............................3..?..............j.....3.....t.4.............Insight design set.dotx.................Content.inf...QJ.N..[.........R.....L....N).J\|E.B.$.B).3,...n.....JW....k.U1..M...3#.5....$^.....;vR...Z.nj...#......^......a.{..(..o.v...!L`...T.-&jZ`.\.0.....G.."b.m..F.X......$>%..?.D..H.l.j....$.......MrQ......q-....hx...6.D.3...j....n..U#R..3....sm?..xJr..............$G8..t.g...?.g.}......$P._...7.#..w..9DR....lu....?..'.Ai..v.vl..`......B..N_....W./.;...c=oYW.lL'bv.......+...9.P..B=...Y.SX=EL.5o....?H.e\|.Fn.M[...d.v.....i......9..U..H....uq.Nrn..@..e...3....8.....s8}z..$........B....26...d..?.l....=.aeM.[..\|n....H.;..7A.`....=.F...V.Y.l..8.........%e.x0S.....~..2..%.....U..#.r_.0V.v.6w.l.......Y.........v..o+....sn.$^'.Il...akUU....w....~.....&8.Vwj.....Q.uQ..&..G.($.2.s.?m.B.~j...+G.W..qi..g..5.)){O........o.ow.(;.{...y;n...J...&.F2.@.;......[{'w..........`....czW.........?W...}..w....x..........

C:\Users\user\AppData\Local\Temp\cabF35F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20457
Entropy (8bit):	7.612540359660869
Encrypted:	false
SSDEEP:	384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
MD5:	4EFA48EC307EAF2F9B346A073C67FCFB
SHA1:	76A7E1234FF29A2B18C968F89082A14C9C851A43
SHA-256:	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
SHA-512:	2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
Malicious:	false
Preview:	MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t.....!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......\|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.\|.?7.'....b.G.4..'..A...o.Z...//..?...d.......C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.\|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

C:\Users\user\AppData\Local\Temp\cabF360.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	7.662386258803613
Encrypted:	false
SSDEEP:	384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
MD5:	ABBF10CEE9480E41D81277E9538F98CB
SHA1:	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
SHA-256:	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
SHA-512:	9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
Malicious:	false
Preview:	MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....\|.\|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.\|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d\|...4\|...C......R28.E......a....e...J.S..Ng.]<&..mm

C:\Users\user\AppData\Local\Temp\cabF382.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31835
Entropy (8bit):	7.81952379746457
Encrypted:	false
SSDEEP:	768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
MD5:	92A819D434A8AAEA2C65F0CC2F33BB3A
SHA1:	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
SHA-256:	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
SHA-512:	01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
Malicious:	false
Preview:	MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v\|..[.{7m.......\|}aI..\|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....\|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z...u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

C:\Users\user\AppData\Local\Temp\cabF383.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	31083
Entropy (8bit):	7.814202819173796
Encrypted:	false
SSDEEP:	384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
MD5:	89A9818E6658D73A73B642522FF8701F
SHA1:	E66C95E957B74E90B444FF16D9B270ADAB12E0F4
SHA-256:	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
SHA-512:	321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
Malicious:	false
Preview:	MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`\|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.I.N.......@\|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.\|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r\|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

C:\Users\user\AppData\Local\Temp\cabF384.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31008
Entropy (8bit):	7.806058951525675
Encrypted:	false
SSDEEP:	768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
MD5:	E033CCBC7BA787A2F824CE0952E57D44
SHA1:	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
SHA-256:	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
SHA-512:	B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
Malicious:	false
Preview:	MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...\|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......^..'.4.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

C:\Users\user\AppData\Local\Temp\cabF3A7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	33610
Entropy (8bit):	7.8340762758330476
Encrypted:	false
SSDEEP:	768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
MD5:	51804E255C573176039F4D5B55C12AB2
SHA1:	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
SHA-256:	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
SHA-512:	2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
Malicious:	false
Preview:	MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`....^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.\|...=..R...-7......TU.....7a...&I.noOK\|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...\|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

C:\Users\user\AppData\Local\Temp\cabF3A8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.840826397575377
Encrypted:	false
SSDEEP:	768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
MD5:	62863124CDCDA135ECC0E722782CB888
SHA1:	2543B8A9D3B2304BB73D2ADBEC60DB040B732055
SHA-256:	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
SHA-512:	2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
Malicious:	false
Preview:	MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S\|..-.duN.Z..g.O......X8....1.....\|,.f/..w.\|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.\|5...i.%H..<.J...0n.....lZ.....?.?.~..O .)..

C:\Users\user\AppData\Local\Temp\cabF3CA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	46413
Entropy (8bit):	7.9071408623961394
Encrypted:	false
SSDEEP:	768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
MD5:	C455C4BC4BEC9E0DA67C4D1E53E46D5A
SHA1:	7674600C387114B0F98EC925BE74E811FB25C325
SHA-256:	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
SHA-512:	08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
Malicious:	false
Preview:	MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n.../....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N\|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0Vh...C..//....W..:w......7.6....]....4.9...sL.0k...zHh..2N.H.....]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.\|......5S..=.............l.../\|....G\|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

C:\Users\user\AppData\Local\Temp\cabF3DB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	7.641082043198371
Encrypted:	false
SSDEEP:	384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
MD5:	97F5B7B7E9E1281999468A5C42CB12E7
SHA1:	99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
SHA-256:	1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
SHA-512:	ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
Malicious:	false
Preview:	MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..\|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M\|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..a.$..-.K.Hf....L..;.#...H....U,........P.@.-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

C:\Users\user\AppData\Local\Temp\cabF3FD.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19288
Entropy (8bit):	7.570850633867256
Encrypted:	false
SSDEEP:	384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
MD5:	B9A6FF715719EE9DE16421AB983CA745
SHA1:	6B3F68B224020CD4BF142D7EDAAEC6B471870358
SHA-256:	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
SHA-512:	062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
Malicious:	false
Preview:	MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l\|.D.p9`..Y09.:.u....p. :,..YD=0.p. ......w...........<..;.....u.."......7[....8.....?^........-..;q.\|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...\|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....\|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h\|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}\|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

C:\Users\user\AppData\Local\Temp\cabF40E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21875
Entropy (8bit):	7.6559132103953305
Encrypted:	false
SSDEEP:	384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
MD5:	E532038762503FFA1371DF03FA2E222D
SHA1:	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
SHA-256:	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
SHA-512:	E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
Malicious:	false
Preview:	MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...\|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.\|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9\|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.\|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.\|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

C:\Users\user\AppData\Local\Temp\cabF40F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21111
Entropy (8bit):	7.6297992466897675
Encrypted:	false
SSDEEP:	384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
MD5:	D30AD26DBB6DECA4FDD294F48EDAD55D
SHA1:	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
SHA-256:	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
SHA-512:	7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
Malicious:	false
Preview:	MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%\|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=\|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........\|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

C:\Users\user\AppData\Local\Temp\cabF410.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	7.668619892503165
Encrypted:	false
SSDEEP:	384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
MD5:	8B29FAB506FD65C21C9CD6FE6BBBC146
SHA1:	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
SHA-256:	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
SHA-512:	AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
Malicious:	false
Preview:	MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...\|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

C:\Users\user\AppData\Local\Temp\cabF411.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21791
Entropy (8bit):	7.65837691872985
Encrypted:	false
SSDEEP:	384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
MD5:	7BF88B3CA20EB71ED453A3361908E010
SHA1:	F75F86557051160507397F653D7768836E3B5655
SHA-256:	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
SHA-512:	2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
Malicious:	false
Preview:	MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...\|..j..Q.,.....7.W...\|;j...%...:...\|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.\|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

C:\Users\user\AppData\Local\Temp\cabF412.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22594
Entropy (8bit):	7.674816892242868
Encrypted:	false
SSDEEP:	384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
MD5:	EE0129C7CC1AC92BBC3D6CB0F653FCAE
SHA1:	4ABAA858176B349BDAB826A7C5F9F00AC5499580
SHA-256:	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
SHA-512:	CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
Malicious:	false
Preview:	MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

C:\Users\user\AppData\Local\Temp\cabF413.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	23597
Entropy (8bit):	7.692965575678876
Encrypted:	false
SSDEEP:	384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
MD5:	7C645EC505982FE529D0E5035B378FFC
SHA1:	1488ED81B350938D68A47C7F0BCE8D91FB1673E2
SHA-256:	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
SHA-512:	9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
Malicious:	false
Preview:	MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..\|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB... .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D..P..!.)S.{..c....&'E.lJ%.\|O.a...FG.\|.....A..h.=c7.)d.5...D...L...IQ..TTE.NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

C:\Users\user\AppData\Local\Temp\cabF433.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	25314
Entropy (8bit):	7.729848360340861
Encrypted:	false
SSDEEP:	384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
MD5:	C47E3430AF813DF8B02E1CB4829DD94B
SHA1:	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
SHA-256:	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
SHA-512:	6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
Malicious:	false
Preview:	MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b..}",n.qou..M.[.;%../c.x.4.z.2.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

C:\Users\user\AppData\Local\Temp\cabF434.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	28911
Entropy (8bit):	7.7784119983764715
Encrypted:	false
SSDEEP:	384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
MD5:	6D787B1E223DB6B91B69238062CCA872
SHA1:	A02F3D847D1F8973E854B89D4558413EA2E349F7
SHA-256:	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
SHA-512:	9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
Malicious:	false
Preview:	MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.....\|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K...].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

C:\Users\user\AppData\Local\Temp\cabF435.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31471
Entropy (8bit):	7.818389271364328
Encrypted:	false
SSDEEP:	768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
MD5:	91AADBEC4171CFA8292B618492F5EF34
SHA1:	A47DEB62A21056376DD8F862E1300F1E7DC69D1D
SHA-256:	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
SHA-512:	1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.\|.J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.\|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................\|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9\|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-...u.Rm..x<...?...!g@.}..).J...:...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5\|.9+....$M..L........(...@#.....N.....N...........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

C:\Users\user\AppData\Local\Temp\cabF446.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	30957
Entropy (8bit):	7.808231503692675
Encrypted:	false
SSDEEP:	384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
MD5:	D3C9036E4E1159E832B1B4D2E9D42BF0
SHA1:	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
SHA-256:	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
SHA-512:	D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
Malicious:	false
Preview:	MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../\|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'.....C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.\|..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..\|m:.):......F

C:\Users\user\AppData\Local\Temp\cabF447.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	32833
Entropy (8bit):	7.825460303519308
Encrypted:	false
SSDEEP:	768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
MD5:	205AF51604EF96EF1E8E60212541F742
SHA1:	D436FE689F8EF51FBA898454CF509DDB049C1545
SHA-256:	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
SHA-512:	BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
Malicious:	false
Preview:	MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P\|....F...F.......&&J.:I.34......+M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K\|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...[.A1....m...4h.9...N[....h5 n%k.~RR.c..n..=...4....).eH.-./..>.....r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...\|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

C:\Users\user\AppData\Local\Temp\cabF448.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	35519
Entropy (8bit):	7.846686335981972
Encrypted:	false
SSDEEP:	768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
MD5:	53EE9DA49D0B84357038ECF376838D2E
SHA1:	AB03F46783B2227F312187DD84DC0C517510DE20
SHA-256:	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
SHA-512:	751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
Malicious:	false
Preview:	MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]...n<.7........=......"Q.E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%.VdS..H...o...s.....+..%[../>.t..I....F.....".G\|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

C:\Users\user\AppData\Local\Temp\cabF449.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31562
Entropy (8bit):	7.81640835713744
Encrypted:	false
SSDEEP:	384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
MD5:	1D6F8E73A0662A48D332090A4C8C898F
SHA1:	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
SHA-256:	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
SHA-512:	5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
Malicious:	false
Preview:	MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O....#.P.,{..m...\|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f\|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#..rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h...sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

C:\Users\user\AppData\Local\Temp\cabF44B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31482
Entropy (8bit):	7.808057272318224
Encrypted:	false
SSDEEP:	768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
MD5:	F10DF902980F1D5BEEA96B2C668408A7
SHA1:	92D341581B9E24284B7C29E5623F8028DBBAAFE9
SHA-256:	E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
SHA-512:	00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3....bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9\|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..\|fB.il.(`..h.d;.l...`.s:

C:\Users\user\AppData\Local\Temp\cabF44C.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20235
Entropy (8bit):	7.61176626859621
Encrypted:	false
SSDEEP:	384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
MD5:	E3C64173B2F4AA7AB72E1396A9514BD8
SHA1:	774E52F7E74B90E6A520359840B0CA54B3085D88
SHA-256:	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
SHA-512:	7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
Malicious:	false
Preview:	MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc\|.....a...j...=...{..a.`!8!..\|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE.....3.\|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).Q.\|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

C:\Users\user\AppData\Local\Temp\cabF44D.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22149
Entropy (8bit):	7.659898883631361
Encrypted:	false
SSDEEP:	384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
MD5:	66C5199CF4FB18BD4F9F3F2CCB074007
SHA1:	BA9D8765FFC938549CC19B69B3BF5E6522FB062E
SHA-256:	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
SHA-512:	94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
Malicious:	false
Preview:	MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...\|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..\|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...\|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..\|.T.jjS..4p.Pxu....W...\|.A)..\|9;....H.e.^.8D..S...M..Lj.\|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

C:\Users\user\AppData\Local\Temp\cabF44E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31605
Entropy (8bit):	7.820497014278096
Encrypted:	false
SSDEEP:	384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
MD5:	69EDB3BF81C99FE8A94BBA03408C5AE1
SHA1:	1AC85B369A976F35244BEEFA9C06787055C869C1
SHA-256:	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
SHA-512:	BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
Malicious:	false
Preview:	MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..\|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...\|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..\|b?.N.}..MyO..q..:q.7..-~.xa.S...\|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......\|.Q\d-.S..2... ......Y..A...s....

C:\Users\user\AppData\Local\Temp\cabF45E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	26944
Entropy (8bit):	7.7574645319832225
Encrypted:	false
SSDEEP:	384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
MD5:	F913DD84915753042D856CEC4E5DABA5
SHA1:	FB1E423C8D09388C3F0B6D44364D94D786E8CF53
SHA-256:	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
SHA-512:	C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
Malicious:	false
Preview:	MSCF....0......D...........................0...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+\|.Cb.t6f],.n.LV......OVg....O.at\|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v\|......l...t..l#{...H....9..\|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......\|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.\|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

C:\Users\user\AppData\Local\Temp\cabF471.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20554
Entropy (8bit):	7.612044504501488
Encrypted:	false
SSDEEP:	384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
MD5:	486CBCB223B873132FFAF4B8AD0AD044
SHA1:	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
SHA-256:	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
SHA-512:	69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
Malicious:	false
Preview:	MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u\|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....\|.E-Y....]n".\|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.\|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...\|p....`lrA.\|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

C:\Users\user\AppData\Local\Temp\cabF482.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	43653
Entropy (8bit):	7.899157106666598
Encrypted:	false
SSDEEP:	768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
MD5:	DA3380458170E60CBEA72602FDD0D955
SHA1:	1D059F8CFD69F193D363DA337C87136885018F0F
SHA-256:	6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
SHA-512:	17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
Malicious:	false
Preview:	MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F....@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11..m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x\|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

C:\Users\user\AppData\Local\Temp\cabF483.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19893
Entropy (8bit):	7.592090622603185
Encrypted:	false
SSDEEP:	384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
MD5:	EF9CB8BDFBC08F03BEF519AD66BA642F
SHA1:	D98C275E9402462BF52A4D28FAF57DF0D232AF6B
SHA-256:	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
SHA-512:	4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
Malicious:	false
Preview:	MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.\|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR.....?..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...\|Lu.\|mCU..b.^.n39.h[M...%D{..w.1

C:\Users\user\AppData\Local\Temp\cabF4CB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	42788
Entropy (8bit):	7.89307894056
Encrypted:	false
SSDEEP:	768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
MD5:	21A4B7B71631C2CCDA5FBBA63751F0D2
SHA1:	DE65DC641D188062EF9385CC573B070AAA8BDD28
SHA-256:	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
SHA-512:	075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
Malicious:	false
Preview:	MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d.. . (.8.".......(>..<...@...~v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u.....J3.V....~...~tn#.Kf6.s.\|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..\|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....\|..........WX..-?..........W.)^`1.......].R2..s6...H.......

C:\Users\user\AppData\Local\Temp\cabF61F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	222992
Entropy (8bit):	7.994458910952451
Encrypted:	true
SSDEEP:	6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
MD5:	26BEAB9CCEAFE4FBF0B7C0362681A9D2
SHA1:	F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
SHA-256:	217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
SHA-512:	2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
Malicious:	false
Preview:	MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._\|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.\|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

C:\Users\user\AppData\Local\Temp\cabF66F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	230916
Entropy (8bit):	7.994759087207758
Encrypted:	true
SSDEEP:	6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
MD5:	93FA9F779520AB2D22AC4EA864B7BB34
SHA1:	D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
SHA-256:	6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
SHA-512:	AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
Malicious:	false
Preview:	MSCF.....F......D................g...........F...?..........\|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....uO..g.y....f...].5.........W.....h^[..w.\|.=.ru.\|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...s,(.o.@.ar.!.J.....

C:\Users\user\AppData\Local\Temp\cabF670.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.995561338730199
Encrypted:	true
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
MD5:	84D8F3848E7424CBE3801F9570E05018
SHA1:	71D7F2621DA8B295CE6885F8C7C81016D583C6B1
SHA-256:	B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
SHA-512:	E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cabF681.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.996203550147553
Encrypted:	true
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
MD5:	9A07035EF802BF89F6ED254D0DB02AB0
SHA1:	9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
SHA-256:	6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
SHA-512:	BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cabF682.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307348
Entropy (8bit):	7.996451393909308
Encrypted:	true
SSDEEP:	6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
MD5:	0EBC45AA0E67CC435D0745438371F948
SHA1:	5584210C4A8B04F9C78F703734387391D6B5B347
SHA-256:	3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
SHA-512:	31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
Malicious:	false
Preview:	MSCF....tq......D...........................tq.. ?..........\|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...\|.\|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w.......E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.Kf.*P(..F..-.y.Z...

C:\Users\user\AppData\Local\Temp\cabF6A4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	261258
Entropy (8bit):	7.99541965268665
Encrypted:	true
SSDEEP:	6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
MD5:	65828DC7BE8BA1CE61AD7142252ACC54
SHA1:	538B186EAF960A076474A64F508B6C47B7699DD3
SHA-256:	849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
SHA-512:	8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
Malicious:	false
Preview:	MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..\|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H[%i.GNHB1D<......(# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

C:\Users\user\AppData\Local\Temp\cabF6A6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 252241 bytes, 2 files, at 0x44 +A "content.inf" +A "Frame.thmx", flags 0x4, ID 34169, number 1, extra bytes 20 in head, 16 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	271273
Entropy (8bit):	7.995547668305345
Encrypted:	true
SSDEEP:	6144:zfdvQnJMwXse4Vradf3mrC7woyWbjKlCVC7K:zfJwJse4VrS1AK
MD5:	21437897C9B88AC2CB2BB2FEF922D191
SHA1:	0CAD3D026AF2270013F67E43CB44F0568013162D
SHA-256:	372572DCBAD590F64F5D18727757CBDF9366DDE90955C79A0FCC9F536DAB0384
SHA-512:	A74DA3775C19A7AF4A689FA4D920E416AB9F40A8BDA82CCF651DDB3EACBC5E932A120ABF55F855474CEBED0B0082F45D091E211AAEA6460424BFD23C2A445CC7
Malicious:	false
Preview:	MSCF....Q.......D...............y...........Q...XJ..........{..................M.. .content.inf.(..........M.. .Frame.thmx.1....b..[.........B.....6....ZZ}....BH..-D..}..V.V-........Z..O.....H.f..........;..@d.`......!..=;.,bp..K.q....s.y....D.qZ)p......D...r.S....s=B.4.).8B....4.a6 ...~........."....#.....}....n.Q.1cH.%c/.U....E..E...!..Da.p....X..G..:.....1.@.....W.'...._........W.c...<.v.k.....&.8......?.h.>d._:-.X.......9..tL}........3.;.N3.D~......>.^?..\|:...}......oT.z.......w..[..}:...._fu........Kk.......L..9..p..e..^......K.%...Mapqhvv..E&.^.....[...9\|"l...9...U......!..w..Nya...~C.yx...w.K..q.z.j.W?t.......DY.x.S2.....]..na.Qj...X.K..^...S.hK.W...Z....s.0...NF...8C.......j.'Zc...k.%...l....S.....OW..o.Qf.x...X.;<.rO].....W.m.e....T.1.6........".....Q.3........l..v.."..I...&......w..4vE...c.s[.3.m..8.q$.....a...)...&:6..,..#..?....;.!.....~.UP.r=.}h.&U......X...]..X.e\u.G<....E....lG.@.Z...10.D@.]....z+-.S....p..Y.PK.:.S..p.....1E`..-

C:\Users\user\AppData\Local\Temp\cabF831.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	550906
Entropy (8bit):	7.998289614787931
Encrypted:	true
SSDEEP:	12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
MD5:	1C12315C862A745A647DAD546EB4267E
SHA1:	B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
SHA-256:	4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
SHA-512:	CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
Malicious:	false
Preview:	MSCF....#......D...............Q...........#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q.R.".RTH.%.T..F......u.{.+.P.....FK0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6.78..X~.e+..CCw...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/.

C:\Users\user\AppData\Local\Temp\cabF8CE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	723359
Entropy (8bit):	7.997550445816903
Encrypted:	true
SSDEEP:	12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
MD5:	748A53C6BDD5CE97BD54A76C7A334286
SHA1:	7DD9EEDB13AC187E375AD70F0622518662C61D9F
SHA-256:	9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351
SHA-512:	EC8601D1A0DBD5D79C67AF2E90FAD44BBC0B890412842BF69065A2C7CB16C12B1C5FF594135C7B67B830779645801DA20C9BE8D629B6AD8A3BA656E0598F0540
Malicious:	false
Preview:	MSCF....?.......D...........................?...`J..............3..............M.. .content.inf..+.........M.. .Wood_Type.thmx......r..[.........................!.wwwwqwwwwwwwwwww..."....+......nR..x..\..w..r.5R.....(\|.>.$e3.!..g....f..`9NL......o./.O.bxI...7.....\|........6.n."J.....4^g.........?...................o.......s3.....8. .T.j...._.Z.Q.t.k,(o.c.t.......?Z....`o........?.a....6.)....6b..../.t...........Mz....q}......C.......+{.......o...K.tQjt............7.._....O.....\....` ..............@..`....%..t....V.]........m..m....u..1.yr;..t..F.'..+{....zqvd.g._..$H..Vl...m..../....g..rG.....:......8....h...[...a06...U.W....5.Z.W..1I..#.2.....B3...x....$PRh...\{J.c.v.y..5+Y.W.N..hG......<..F..W.d8_....c...g....p\|7.]..^.o.H.[$Zj..{4......m.KZ..n.T%...4.Z..Y."q7?kuB......U....).~.......W%..!.e.U.mp.o...h...?.w...T.s.YG#......Y.}....Z.O.i.r,...n..4.\....P..m..=....f........v....g....j....wP..4.VK.y.z...C..oum.b.1......?.Z.>.7.!?......A..Q>..Z....-

C:\Users\user\AppData\Local\Temp\cabF8DF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	640684
Entropy (8bit):	7.99860205353102
Encrypted:	true
SSDEEP:	12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
MD5:	F93364EEC6C4FFA5768DE545A2C34F07
SHA1:	166398552F6B7F4509732E148F93E207DD60420B
SHA-256:	296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
SHA-512:	4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
Malicious:	false
Preview:	MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..\|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.\|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K..F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C\|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!\|.u.3t....2e.wWH..'7p....E_...e.._;..k....&E.^.f=V..{..al.y:.4a...+.g...-..>e

C:\Users\user\AppData\Local\Temp\cabF910.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	698244
Entropy (8bit):	7.997838239368002
Encrypted:	true
SSDEEP:	12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
MD5:	E29CE2663A56A1444EAA3732FFB82940
SHA1:	767A14B51BE74D443B5A3FEFF4D870C61CB76501
SHA-256:	3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
SHA-512:	6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
Malicious:	false
Preview:	MSCF....lh......D...............P...........lh...?..........\|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D..........&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)\|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$\|\X...8.....Fj'%,.)6w...u\|C..,y..E..`Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.\|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.\|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

C:\Users\user\AppData\Local\Temp\cabFAAA.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	953453
Entropy (8bit):	7.99899040756787
Encrypted:	true
SSDEEP:	24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
MD5:	D4EAC009E9E7B64B8B001AE82B8102FA
SHA1:	D8D166494D5813DB20EA1231DA4B1F8A9B312119
SHA-256:	8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D
SHA-512:	561653F9920661027D006E7DEF7FB27DE23B934E4860E0DF78C97D183B7CEBD9DCE0D395E2018EEF1C02FC6818A179A661E18A2C26C4180AFEE5EF4F9C9C6035
Malicious:	false
Preview:	MSCF....]M......D...............=...........]M...?..........}..."..............Li. .content.inf............Li. .Gallery.thmx.].(.Vq..[.....0Y..........v.....w.wwwww.wwwwww.w.....".83....y8..mg...o..U..N(..@uD.:O<........{.G....~~.....c.c.5..6./\|G .@#1O.B.............PT@...b.d.~..U....B.{.........0.H.....`.H.`..'S.......Ic..W..x...z....... .........g......._....o......S......p...$....._........._...K......x..?.6.U~...'./.r.................../.......5.8..2........2b.@j ....0.........``....H... ,5...........X........\|..Y.QoiW..\|.......x.sO8...Yb....7...m..b.f.hv..b......=...:Ar.-...[..A\.D..g..u....].9..M...'.R-`.....<..+.....]...1.^..I.z..W{.._....L.. ...4;..6O.....9,.-.Vt+b/$7..}.O05.Y...-..S.....$.....1."Z.r;.!..E.mMN..s .U...P%.[.P...cU...j...h.d.../.s..N/..:..X...p5.7\}h.Q ..._.F.X.C..z$.nV..+.k..\|.@.L...&.........^#.G.a..x..w!wx.8e+..E. i..$?9..8...:......\|..[."..y..&y..?...W....s..._...3Z0c.....i.q.........1c.jI....W..^%xH.._...n.......&J..

C:\Users\user\AppData\Local\Temp\cabFB29.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1065873
Entropy (8bit):	7.998277814657051
Encrypted:	true
SSDEEP:	24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
MD5:	E1101CCA6E3FEDB28B57AF4C41B50D37
SHA1:	990421B1D858B756E6695B004B26CDCCAE478C23
SHA-256:	69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E
SHA-512:	B1EDEA65B6D0705A298BFF85FC894A11C1F86B43FAC3C2149D0BD4A13EDCD744AF337957CBC21A33AB7A948C11EA9F389F3A896B6B1423A504E7028C71300C44
Malicious:	false
Preview:	MSCF....q.......D...........................q... ?..........{...%..............M. .content.inf.Q_.........M. .Savon.thmx...O>.o..[..............&.5....UUcC.C....A...`TU...F....".54.E.....g.-.7-D....1g...p.6......@..w(....h'?.....(..........p..J.2n$4.........A......?...........@.C.W.R.5X..:....I..?....r.y..~!.....!.A.a...!........O.........5.x<C...?.?....C.C.......'....F../....../.$................4.7...................P...(.w.}6.........7.....01.1r........._..?.............'.._..JOx.CFA<.........0..2.?...>F.../...;..6-8..4...8&yb....".1%..v'..N...x......}.gYb..~L.....f[..!......Y.G.....p..r...?.p...F.Vy.....o.Whll...+...M.V...:.]...B.%.H....n..@.].zaVxf...y{.@....V.t.W....$Kp-.....7W.J..h..0A3mK.=.ub..R...W......*'T2..G#G,.^..T..XZu...U. ...76.d..#.I.JB.v...d...%.....6..O.K.[.:.L.\.....1.D..2a.>f......X...b5...ZgN.u.f...a!..."...sx....>..?.a.3.8.^._q..JS1.E..9..Lg.n.+....lE.f:j.9)Q..H1=..<.R.......{c>:.p[..S.9h.a.gL.U....8.z..z.!.....2I.~.b..2..c...

C:\Users\user\AppData\Local\Temp\cabFB79.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1097591
Entropy (8bit):	7.99825462915052
Encrypted:	true
SSDEEP:	24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
MD5:	BF95E967E7D1CEC8EFE426BC0127D3DE
SHA1:	BA44C5500A36D748A9A60A23DB47116D37FD61BC
SHA-256:	4C3B008E0EB10A722D8FEDB325BFB97EDAA609B1E901295F224DD4CB4DF5FC26
SHA-512:	0697E394ABAC429B00C3A4F8DB9F509E5D45FF91F3C2AF2C2A330D465825F058778C06B129865B6107A0731762AD73777389BB0E319B53E6B28C363232FA2CE8
Malicious:	false
Preview:	MSCF............D...............-,..............x?..........}...-...RU.........M. .Circuit.thmx.....RU.....M. .content.inf.g...&\|..[......=..R.....=.,.!QA?h..Q.!....Uk!.HJ.......VKuk.....q.w.w.U.....;...K.@.URA..0..B..\|rv.ND(.`{..@.1.}...s?.....-...O.(V.w..1..a.....aW...a.Z..aX....5.I...!..........(. ./.d...me.( ..f.........w.......Xp.s....c..vB.98.....C.J......V ..ML.M...B.n.>...\|....u!.5@t..q4....(K...u qL.S....>/%v%.2..TF.].e..'..-..L.N..c].a..(WU\o.%^..;...\|o.6..L..[..;&....^p.Lu.sr,-.R=.:.8.>VOB...:.?$.h.o....Zh.h....`.B.c.../K......b^...;2..bY.[.V.Q8....@..V7....I0c.cQN7..I.p..}..!..M....1K....+....9.2......a..W.V..........;.J .i......]%O.-......CeQ.0.c....MbP3.0.w..8w..Y...\|...H;#.J.+M......>.`y..aWk\|.i.BF.pJv;.....S..6....F.....RLG~..........J.=......"..........H.....h..o...u........M.6F?.F.p.B.>./*l....J.R..#P.....K......<iu..gm^..n...#c..zO"7M.O......4'>A..(.E.Cy.N.)....6.tx.r[.....7.......m.t..E?.....5.5.6.\..{.V.T.D.j..=~a^.I

C:\Users\user\AppData\Local\Temp\cabFD02.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1310275
Entropy (8bit):	7.9985829899274385
Encrypted:	true
SSDEEP:	24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
MD5:	9C9F49A47222C18025CC25575337A965
SHA1:	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0
SHA-256:	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
SHA-512:	9FDCBAB988CBE97BFD931B727D31BA6B8ECF795D0679A714B9AFBC2C26E7DCF529E7A51289C7A1AE7EF04F4A923C2D7966D5AF7C0BC766DCD0FCA90251576794
Malicious:	false
Preview:	MSCF...........D...............9..............XJ..........}...6..............M.. .content.inf............M.. .Droplet.thmx..m7.>J..[...............2.QQPIj..."o^R.H5^...^(e.W...R..x..^`..m...."..+.....{o.......Q.-....$V.N>...T]..L.... ..N.h..dOY.......S......N.%.d..d....Y.....e..$...<.m...`............@....=.z..n..[...,G..1Fn.qPDH{C<...3.Q...2..r.....E.E.E.ErM"&a..'..W....:...?I..<.I..6o.`.d.?!..!..._.4\.._.E..).._O.S....; ..#..p.H.....c....o\.K..?$U.e.........!...J.v.....gNe._..[....#A.O.n_.....gm:P._.........{@..-g..j.69b.NH.I.$Hk?.6.n...@......'.C.._.U..:,j.-G.....e.#.Sr.t.L......d[.[...s.....rx.3.F[.5o..:....K.x..)M.fb...3IP.&h.Q.VX^%U.......x..l......@6.k.P..zSW.?....F..[L...4..b.l.w."&.....`.j...i.5}".~.-.....{\.:...o.'H\+)....3.Y......\...f:.;....e........4't7..f...w..j...3....N..9`.J...P..?.....=3_.y]...f.<.......JM5.}Q/ .F.a..Z.._yh......V..>m .......a....f....!.hz..\.....F_..'z...,....h.=.......=.o..T....3.e..........$..g.2.

C:\Users\user\AppData\Local\Temp\cabFF46.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1766185
Entropy (8bit):	7.9991290831091115
Encrypted:	true
SSDEEP:	24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
MD5:	828F96031F40BF8EBCB5E52AAEEB7E4C
SHA1:	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2
SHA-256:	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
SHA-512:	61F6355FF4D984931E79624394CCCA217054AE0F61B9AF1A1EDED5ACCA3D6FEF8940E338C313BE63FC766E6E7161CAFA0C8AE44AD4E0BE26C22FF17E2E6ABAF7
Malicious:	false
Preview:	MSCF............D...............)q..............0?..........{...H..............M.. .content.inf.;.#........M.. .Slate.thmx.p.+..P..[......U..............p..K.!..........K..w..v........=....D$r...B....6 ...X.F0..d..m.s...$$r........m.)6.m3....vXn.l..o...a...V......Ru.:=2M.........T.....4S`EP......\..r,..v...G.P......'._H0]..%_............X.P.,.............H.?.-.H..".......M..&..o....R........<......`...D.H.._.G.Qv..(..U,.9..D...."..T..i.e../.e.."....,S...o.X.....c./..V....Z..o.O..2....{...+... ....0.@J.R.Q.m.....{.....h?u.q.O{...l.d)..Yk`.....#...u.-.m..#CXwrz4..7.>......v.E:.#.oGSKS.TX.Chm.4aQ......avH..{..j+@6[k].....`c..W8..j.v.Zh.]....4......K..#Hzyd..K}.....H\|<H..\(l...+..%Z......~.S:^..d>..1..H%..7N-v.....Wu.*..b^.B.....k0gc.2.{.!...E7.}3.d...{.Ye...&#f6...:2......v..&!..k0d.p.b...,..$.....Y..60...h.N}.r...<[./........{...Es..&.nf.....2.@Fh3.9.G....l.[.C..SD/6.H.K....}..m....M..........gl.P.]..I......5....e.c...V....P...[.=.......O.eq+

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:/Glj:O
MD5:	F97AA11F77EFCD58633DD593CD2F3911
SHA1:	DC126CCE3BCDB1CEB8D66E5F6CD1DCCB955BF20E
SHA-256:	F8F0606305EC756091DB8842F9F8942D42A2B9E1B5FC88BEAF113EBDA086F865
SHA-512:	B7D4FB72BE179121388B9E7E849093DB34147D448055C65B3BE9817FFF3F3419C44644570BCA86804AA32102D738B4F780BC43522A1B5EBA5990C95EB7CE738D
Malicious:	false
Preview:	.............................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Platinum Hall County, Georgia Proposal (16.6 KB).LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Oct 4 11:02:31 2023, mtime=Fri Dec 6 15:16:57 2024, atime=Fri Dec 6 15:16:52 2024, length=32167, window=hide
Category:	dropped
Size (bytes):	710
Entropy (8bit):	4.736194133071815
Encrypted:	false
SSDEEP:	12:8pEzAseO/X7Ws/4HOjA+88tAQJUnO/X7Ws/4+ps1IBmV:8SAsBKsgSA+rxRKsgczBm
MD5:	B00240925DCBA3FCBA1B604B902427DF
SHA1:	7745DE8AC27509729256106F88BE653C4421FD5C
SHA-256:	EBE890617FBE4C85B9C211688F520ED40AA59C2B89A50DB8AC8F4F6EA1A1B163
SHA-512:	F770899ECB85497A42AEDE30C986DA587364A1B2D7EB70C27308265FB59F9506DDE61A0D7CFC886201EB7F0C14D2DD46470304522BED8B9E64C35706F7BE21B7
Malicious:	false
Preview:	L..................F.... .............E.G....wB.G...}..........................2..}...Y.. .PLATIN~1.DOC.........DWP`.Y............................nY0.P.l.a.t.i.n.u.m. .H.a.l.l. .C.o.u.n.t.y.,. .G.e.o.r.g.i.a. .P.r.o.p.o.s.a.l. .(.1.6...6. .K.B.)...d.o.c.x.......{...............-.......z............F.......C:\Users\user\Desktop\Platinum Hall County, Georgia Proposal (16.6 KB).docx..L.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.P.l.a.t.i.n.u.m. .H.a.l.l. .C.o.u.n.t.y.,. .G.e.o.r.g.i.a. .P.r.o.p.o.s.a.l. .(.1.6...6. .K.B.)...d.o.c.x.`.......X.......367706...........hT..CrF.f4... .`.T..b...,.......hT..CrF.f4... .`.T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Fri Dec 6 15:16:53 2024, mtime=Fri Dec 6 15:18:14 2024, atime=Fri Dec 6 15:18:14 2024, length=0, window=hide
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	4.667285664119676
Encrypted:	false
SSDEEP:	12:8Vf4UlGIJWCICH2g9FbDQ/+Ud0/x6juLwpTcupXu74Vl+EjAArHSuT1lilG3mNfn:8VhG4vwd6gjIduI4GQAAmuTqTYfqyFm
MD5:	C2A87EE5842C5EF2E15E13D0A60C515D
SHA1:	2230AAA799CFB5CB2A3C8738B71B40BC853FA684
SHA-256:	7614E1E472155F38AADA0FC5A9295B79182B7C1CE1C522002BE7565CE25AD137
SHA-512:	C65AF85BC242299E805ED3646D0F277FC4EC198B0E61444FEDA00238D915AF66BF83925866DA93229C96773E33225ED5ED512D5A73823B85B0555AEA58AB34D2
Malicious:	false
Preview:	L..................F.........`C.G....vs.G....vs.G..........................[....P.O. .:i.....+00.../C:\...................x.1.....CW;^..Users.d......OwH.Y......................:.....K...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....P.1......Y....user.<......CW.^.Y..............................U.j.o.n.e.s.....V.1.....CW.^..AppData.@......CW.^.Y.............................%..A.p.p.D.a.t.a.....V.1......Y....Roaming.@......CW.^.Y..............................M.R.o.a.m.i.n.g.....\.1......Y....MICROS~1..D......CW.^.Y................................M.i.c.r.o.s.o.f.t.....\.1......Y&...TEMPLA~1..D......Y...Y&...........................<Y0.T.e.m.p.l.a.t.e.s.......a...............-.......`............F.......C:\Users\user\AppData\Roaming\Microsoft\Templates........\.....\.T.e.m.p.l.a.t.e.s...........................>.e.L.:..er.=....`.......X.......367706...........hT..CrF.f4... .[g/.....,.......hT..CrF.f4... .[g/.....,..................1SPS.XF.L8C....&.m.q............/...S

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	148
Entropy (8bit):	5.009732536140859
Encrypted:	false
SSDEEP:	3:H+KRKQ/L8HCFmNAELvLUYCm474KQ/L8HCFmNAELvLUYCpnbJlv:Hpz8c0AQAYZz8c0AQAYQv
MD5:	CF7C9FE532C089FF9E94B25891E7A7A4
SHA1:	96F821C8C3471ED2402D0CC45A170DF11C939DEB
SHA-256:	783994D753D79367552BA16BDF19FE6969EB099F38E22E0BBA51DEDC4D9092B1
SHA-512:	2F4EAF0C9592B7899C3343BF6B72960612B22094558C2F0442F73D856F2F1995F16EF985A04C318E73AE008F1CDD8D52601685105AC26585AFE8E905E646E2CE
Malicious:	false
Preview:	[misc]..Platinum Hall County, Georgia Proposal (16.6 KB).LNK=0..[folders]..Platinum Hall County, Georgia Proposal (16.6 KB).LNK=0..Templates.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	523048
Entropy (8bit):	7.715248170753013
Encrypted:	false
SSDEEP:	6144:WfmDdN6Zfv8q5rnM6vZ02PtMZRkfW5ipbnMHxVcsOWrCMxy0sD/mcKb4rYEY:xDdQXBrMi2YtggW5ObnMH1brJpUmBU0N
MD5:	C276F590BB846309A5E30ADC35C502AD
SHA1:	CA6D9D6902475F0BE500B12B7204DD1864E7DD02
SHA-256:	782996D93DEBD2AF9B91E7F529767A8CE84ACCC36CD62F24EBB5117228B98F58
SHA-512:	B85165C769DFE037502E125A04CFACDA7F7CC36184B8D0A54C1F9773666FFCC43A1B13373093F97B380871571788D532DEEA352E8D418E12FD7AAD6ADB75A150
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19361
Entropy (8bit):	7.469351996389178
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUKd4eckdMH+qfRABRqSOq6fC90WSgH:VAxllNxa+qJABRqSNfH
MD5:	E91348DA1696E8A3A5AF947D43F9C4F4
SHA1:	7FFBE64FB9BC05E02192417167E9FC6F4F19B992
SHA-256:	5EE21D4A4578EFA2ADD1281ECE4BE0E39083F2E742C97B54435C0BBA89F01844
SHA-512:	1E9461650865A13CF8FA4749FABAF625A159CE2C302AFAAFA44D8B8CEA0745AAD9854017B43152EFFAA7630A21907F7F1FF61B88C332CFA5DCF6F3A0297AF72E
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	3.33519891307039
Encrypted:	false
SSDEEP:	3:KVGl/lilKlRAGl/sAl/daHxI16Klsll3eQwlEt/coQKj+n:KVy/4KDZsAUHUls/3enei4+
MD5:	FB1FB6E33ADAAA078BA347F719605866
SHA1:	0BA2843CC4F285FFF4A09D6BD7FA4642D16683E7
SHA-256:	742B64E7E8A7F701491C716E2BE721D0BCAB76299F0115ED4FB2359A24E031FC
SHA-512:	BA5DE896EB97C50AFFA07E82789AF7EBE73845BFDA6A5F832C9390D1981144E686E51F25F9BEA7BAB1B0081AD5D4C8228E3967A4A69C7FA6BA70E49F32F3AD2A
Malicious:	false
Preview:	.user..................................................j.o.n.e.s..................3..L5o.Xz.kM.....o...ni.........3..PFo.h3....,...,.M.............,......5o.PFo.

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0002.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19361
Entropy (8bit):	7.469351996389178
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUKd4eckdMH+qfRABRqSOq6fC90WSgH:VAxllNxa+qJABRqSNfH
MD5:	E91348DA1696E8A3A5AF947D43F9C4F4
SHA1:	7FFBE64FB9BC05E02192417167E9FC6F4F19B992
SHA-256:	5EE21D4A4578EFA2ADD1281ECE4BE0E39083F2E742C97B54435C0BBA89F01844
SHA-512:	1E9461650865A13CF8FA4749FABAF625A159CE2C302AFAAFA44D8B8CEA0745AAD9854017B43152EFFAA7630A21907F7F1FF61B88C332CFA5DCF6F3A0297AF72E
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\Desktop\Platinum Hall County, Georgia Proposal (16.6 KB).docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	30882
Entropy (8bit):	7.658828628658646
Encrypted:	false
SSDEEP:	768:ct0qC0XLlM+d6VReJdeteScH792mKERn3:ctu0bCO6VReJ0YScHxLR3
MD5:	95A0EA5154F07A14D08AA33D1B812E41
SHA1:	76268299161BBAB8A2499C0EFFE3FDFB973A2941
SHA-256:	F9A2D962832E897B4A7FB162B830A4144215C475527230C11212F280FEB9A6CD
SHA-512:	248AAE081ED482D6B7EAB71A69CFF89F032691EC5A29B360E5EAC681E6E969CC106AC849FF472E13341AE7D766ED42AC80E19D1A17E3123418DC788FD47718C9
Malicious:	false
Preview:	PK..........!.XT..............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................MO.@...&..f...z0.P<.qT.1..Nau..;..{...C....&.....N...niM..1i..v..Y.Nz..`o................g..@.H.R.f...$g`E.}.G..G+.n..!?...U...w..{Xy....J17.=....#..e....`.V.u...D0iG#B0Z..:.rj.....IY.......$T.......3j..HD\|.....G..sK.....N_.ZB...B..R..dM.T..n..C..z.n...v.}H.'.4...D.....,........=..I.....a....(~.........h.[!........%.....n.@.....a.6."..........]....~..7.d}.......l^...........PK..........!.........N......._

C:\Users\user\Desktop\~$atinum Hall County, Georgia Proposal (16.6 KB).docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.672073945769557
Encrypted:	false
SSDEEP:	3:KVGl/lilKlRAGlMgOQP4a9b/cxPJqHKiYgRCnSa0B+M:KVy/4KDmgOQ1VcxR8KiYUCp0Bz
MD5:	D7F980318E6D59142758C42A1FDA9991
SHA1:	6E113FF54C7A819899299015A985586A18CA77EA
SHA-256:	955050859ABF44CDBAC611E67EF872DB538EF21B147C1801014582BA64498C20
SHA-512:	20DBD84A48A61A9D5177A79FC67C4FE13BA36E96E9313636D93358B60A6A6EC411ECB5DD833A3AC8CC7888B5D643B743CC1AFBD36AA3D39D82683310ADBB45BC
Malicious:	false
Preview:	.user..................................................j.o.n.e.s...3..a.dq\...?o.2:..~..%.>...q...&.)...%.>5.).>.&.=K......1.....G......g...'o.}..i......n..=.i

C:\Users\user\Desktop\~WRD0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	30882
Entropy (8bit):	7.658828628658646
Encrypted:	false
SSDEEP:	768:ct0qC0XLlM+d6VReJdeteScH792mKERn3:ctu0bCO6VReJ0YScHxLR3
MD5:	95A0EA5154F07A14D08AA33D1B812E41
SHA1:	76268299161BBAB8A2499C0EFFE3FDFB973A2941
SHA-256:	F9A2D962832E897B4A7FB162B830A4144215C475527230C11212F280FEB9A6CD
SHA-512:	248AAE081ED482D6B7EAB71A69CFF89F032691EC5A29B360E5EAC681E6E969CC106AC849FF472E13341AE7D766ED42AC80E19D1A17E3123418DC788FD47718C9
Malicious:	false
Preview:	PK..........!.XT..............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................MO.@...&..f...z0.P<.qT.1..Nau..;..{...C....&.....N...niM..1i..v..Y.Nz..`o................g..@.H.R.f...$g`E.}.G..G+.n..!?...U...w..{Xy....J17.=....#..e....`.V.u...D0iG#B0Z..:.rj.....IY.......$T.......3j..HD\|.....G..sK.....N_.ZB...B..R..dM.T..n..C..z.n...v.}H.'.4...D.....,........=..I.....a....(~.........h.[!........%.....n.@.....a.6."..........]....~..7.d}.......l^...........PK..........!.........N......._

C:\Users\user\Desktop\~WRD0000.tmp:Zone.Identifier

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	downloaded
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
URL:	https://secured-login.net/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 10 x 7, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	379
Entropy (8bit):	6.33139337594966
Encrypted:	false
SSDEEP:	6:6v/lhPCtqU3sXUyKO/cqKYdjh32Ud8cqqVZkeyn4lhPXloPNLvRnwvzgNk44ev6s:6v/76tuXU0DmcXVen4uNLJwvzSkTfZ2V
MD5:	CB6887B44D515927FF81A5292C94D783
SHA1:	4783906101BFF62CD3504F65E97AF0DF37C4FB71
SHA-256:	AE646120E73D34B6AE8586212A36D4EDD12E77D982B828C2A7406D054F01C11B
SHA-512:	184B4DF21C3F43A2295C2C5B423287458923DB6DE5BA806D7F937B50ADB39D7B7BC8F47025A00FD4BDC13F51509259EC753B92BAB6C4AB1F377BB6AA35A9BD86
Malicious:	false
URL:	https://upload.wikimedia.org/wikipedia/commons/thumb/3/36/Chevron-down%2C_Web_Fundamentals.svg/10px-Chevron-down%2C_Web_Fundamentals.svg.png
Preview:	.PNG........IHDR.....................gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME...... ,.Mw....IDAT..c.]....B.\|g21..<.+....q.!....1...........g.,...5.3.3.1Fi.R7...A...c.#...1.:......l9..................l9.......d..........E."........%tEXtdate:create.2024-07-17T18:04:32+00:00...$...%tEXtdate:modify.2024-07-17T18:04:32+00:00..q.....IEND.B`.

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (459)
Category:	downloaded
Size (bytes):	513
Entropy (8bit):	5.86655832115633
Encrypted:	false
SSDEEP:	12:3R+xnh1M0/g02e30tIoqJpWzOzsU3lKnyKpa1u4AEdeIQL:3ETtgnqH+csU1KnJp+uNEkj
MD5:	42A989AF3E41D91F386B4AE82877C5F6
SHA1:	6734F80CEDEB85B8C233985E8F1A35B155DA076E
SHA-256:	C22C643904DCB3E3A1BB470687D731AB374EEC3A06AD3CAB2F6740C1D9E1F6E2
SHA-512:	3C5566E0B277A0D16D9119EEF452FBE11C397DB6420C148E8B46BED541CEC6F156E5E750A2E66472C28B8A3CCB142FB0562500E80F1188A9E6C7B9D486CEA557
Malicious:	false
URL:	https://2fa.com-token-auth.com/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==?cid=2306703812
Preview:	<html>. <head>. <script>window.location.href = 'https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==';</script>. </head>. <body>. </body>.</html>.

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x168, components 3
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	7.85952317949815
Encrypted:	false
SSDEEP:	192:y5t5BheiFNAKuwBJOAZy/nLolT61LrqTlZ06rLZO:y5t5HeiF/xfZmMFWSTlXI
MD5:	1C816A8F7D646E5D72B64621B00454FB
SHA1:	9B189DCF55CD5D2F9903F226F5D710FADBB73324
SHA-256:	FFD16D335F3349225729878BCC0BB48E7DE06D92843250D4DE2C04AC2553A634
SHA-512:	4C0968BAE174ABBFED20175B83018F438688868EE006212BD72C09C5A748B0C863FE099BC967E052A87AE5C237C6FAE2E559F5261C9F10A58A246C129DB5ABCA
Malicious:	false
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************........,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..B.(...(...(.......(...(...(...(...(...(...)3Tn5$..X..;.zW=lE.....1rvE.+.mcm.v.\n%N}.S.^#p....7..j.k..q.......TP.4W..{...QL..(.......(...(...(...(...(...(...)i)h...(...(...(...B@.h.h.....l.s.Z./T3....Y....i...d......e..Z.wh.8....r.F^S.GS\..,_........?..3}....z.....X..EA.m9t.#R.z..t$.V.V .1....L.....&...M....Q...!#...q].._=..%....d.;.^1../........*..4.<-.

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (959)
Category:	downloaded
Size (bytes):	10610
Entropy (8bit):	5.438711183858136
Encrypted:	false
SSDEEP:	192:ObzAsuMZFbMpKypb6wxi/1ihXCJ0F9FSRGlOfj2D4tv0YHZVokUH3H:O6j6wINiVqGAiDav0YHMkUH3H
MD5:	BA1FF33C6015E8C69C596DC9E8B20D48
SHA1:	F00C6057CD15B3C492B7B9CC25B9CC2912EF7080
SHA-256:	B56520E7AC024EFDAEF02D0A38FE7AB5780DD438DC525FB554434E73DC33FB09
SHA-512:	EC4E113126F842EFB5EBCB166E9E2FCFE6C4A9F6AC116EDB7BF93B76C1950715AA36E24FF8508F0D846E30E0A76CC7F99B8D7C3CB5CA63EFCC15FF7B0B1E8597
Malicious:	false
URL:	https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN". "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">. <meta name="IMPORTANT" content="This page is part of a simulated phishing attack initiated by KnowBe4 on behalf of its customers." />. <meta name="IMPORTANT" content="If you have any questions please contact support@knowbe4.com." />. <meta content="IE=edge,chrome=1" http-equiv="X-UA-Compatible"/>. <meta name="robots" content="noindex, nofollow" />.. <head>. <script src="/assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js"></script>.. <link rel="stylesheet" href="/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css" media="all" />. <link rel="stylesheet" href="/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css" media="all" />.. <script>.//<![CDATA[.. $(document).ready(function() {.

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 10 x 7, 8-bit gray+alpha, non-interlaced
Category:	dropped
Size (bytes):	379
Entropy (8bit):	6.33139337594966
Encrypted:	false
SSDEEP:	6:6v/lhPCtqU3sXUyKO/cqKYdjh32Ud8cqqVZkeyn4lhPXloPNLvRnwvzgNk44ev6s:6v/76tuXU0DmcXVen4uNLJwvzSkTfZ2V
MD5:	CB6887B44D515927FF81A5292C94D783
SHA1:	4783906101BFF62CD3504F65E97AF0DF37C4FB71
SHA-256:	AE646120E73D34B6AE8586212A36D4EDD12E77D982B828C2A7406D054F01C11B
SHA-512:	184B4DF21C3F43A2295C2C5B423287458923DB6DE5BA806D7F937B50ADB39D7B7BC8F47025A00FD4BDC13F51509259EC753B92BAB6C4AB1F377BB6AA35A9BD86
Malicious:	false
Preview:	.PNG........IHDR.....................gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME...... ,.Mw....IDAT..c.]....B.\|g21..<.+....q.!....1...........g.,...5.3.3.1Fi.R7...A...c.#...1.:......l9..................l9.......d..........E."........%tEXtdate:create.2024-07-17T18:04:32+00:00...$...%tEXtdate:modify.2024-07-17T18:04:32+00:00..q.....IEND.B`.

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3299
Entropy (8bit):	7.842766165260185
Encrypted:	false
SSDEEP:	96:2SQZvXE2g6KUq2HYamFxX2RiyfjlsnuG7NI6hw:2SQVX5EUqqFmFx2iyrlsnvNIIw
MD5:	1E158165AB6A84E827CEDE6F6DDBD053
SHA1:	6545EACF98838B287BDE72186717E317E8D7C104
SHA-256:	C849F694D2BA6B5720EEA6C81C17AE9B426DF633DFFFC3A107B702D3CBDC54F7
SHA-512:	9330361051970D37EED1AF1B48C2E882E588BC74DC4005BEEA42582FFC7C725C989201C02B0971DE3B786E96D76B9CC7627333AE32377B9129F519BFF5CA22E0
Malicious:	false
URL:	https://static.thenounproject.com/png/113149-200.png
Preview:	.PNG........IHDR..............X......sBIT....\|.d.....pHYs.................IDATx...y..U....$!.a..`.$ b.... ....%.Z.".J......."J..-.A..R..(@P...I.AYdO ..&@ ..$..w.L:o.t.sz..~........y.u..DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD....1.....d`.`...).[.0..........HG.s.^...x.8..........!..\..n.8.8..vE........s$..'Qtv..#...c..M...).I`"....w.#....M...j.s......T..<..d.D,.j..7H7z.(..M.Ml.9@z....r.m..+"...._..l.`4.;..q.x.s-0..$.Rk..SN.4NYOFo'L!..e=..W7.SV......KEJ6.x.rk.q.L..x...d.4..s(.^...{...NU%$.v....Zi....^..T...y.....q.J..x.8.......b....).@O.......+.L,>.,.v.cj.q.&.?.8..qz..I.3._..."..qb...X...8..Wh.....[.....}mv.......O~..*1?.g5.4!....L..n....-..#...U..%.'C..\..:>.l.i.....F....d.V`........~...l.... .k.7G...{..8J56......D..V4@..%,)i=..[9.'.m.<..z]N...5@...\..f6..ou.OV.......3.^.P....#........d...^.~}..y<..A...v6^...$'+.J..c.&....S...c.SK,.d)....d.._..._...!.D.$....\|Lr....\|...ql......{....T]......wF.A.$...sr!.l.0....~...vGQ.........r.s.im

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3299
Entropy (8bit):	7.842766165260185
Encrypted:	false
SSDEEP:	96:2SQZvXE2g6KUq2HYamFxX2RiyfjlsnuG7NI6hw:2SQVX5EUqqFmFx2iyrlsnvNIIw
MD5:	1E158165AB6A84E827CEDE6F6DDBD053
SHA1:	6545EACF98838B287BDE72186717E317E8D7C104
SHA-256:	C849F694D2BA6B5720EEA6C81C17AE9B426DF633DFFFC3A107B702D3CBDC54F7
SHA-512:	9330361051970D37EED1AF1B48C2E882E588BC74DC4005BEEA42582FFC7C725C989201C02B0971DE3B786E96D76B9CC7627333AE32377B9129F519BFF5CA22E0
Malicious:	false
Preview:	.PNG........IHDR..............X......sBIT....\|.d.....pHYs.................IDATx...y..U....$!.a..`.$ b.... ....%.Z.".J......."J..-.A..R..(@P...I.AYdO ..&@ ..$..w.L:o.t.sz..~........y.u..DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD....1.....d`.`...).[.0..........HG.s.^...x.8..........!..\..n.8.8..vE........s$..'Qtv..#...c..M...).I`"....w.#....M...j.s......T..<..d.D,.j..7H7z.(..M.Ml.9@z....r.m..+"...._..l.`4.;..q.x.s-0..$.Rk..SN.4NYOFo'L!..e=..W7.SV......KEJ6.x.rk.q.L..x...d.4..s(.^...{...NU%$.v....Zi....^..T...y.....q.J..x.8.......b....).@O.......+.L,>.,.v.cj.q.&.?.8..qz..I.3._..."..qb...X...8..Wh.....[.....}mv.......O~..*1?.g5.4!....L..n....-..#...U..%.'C..\..:>.l.i.....F....d.V`........~...l.... .k.7G...{..8J56......D..V4@..%,)i=..[9.'.m.<..z]N...5@...\..f6..ou.OV.......3.^.P....#........d...^.~}..y<..A...v6^...$'+.J..c.&....S...c.SK,.d)....d.._..._...!.D.$....\|Lr....\|...ql......{....T]......wF.A.$...sr!.l.0....~...vGQ.........r.s.im

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x168, components 3
Category:	downloaded
Size (bytes):	6458
Entropy (8bit):	7.85952317949815
Encrypted:	false
SSDEEP:	192:y5t5BheiFNAKuwBJOAZy/nLolT61LrqTlZ06rLZO:y5t5HeiF/xfZmMFWSTlXI
MD5:	1C816A8F7D646E5D72B64621B00454FB
SHA1:	9B189DCF55CD5D2F9903F226F5D710FADBB73324
SHA-256:	FFD16D335F3349225729878BCC0BB48E7DE06D92843250D4DE2C04AC2553A634
SHA-512:	4C0968BAE174ABBFED20175B83018F438688868EE006212BD72C09C5A748B0C863FE099BC967E052A87AE5C237C6FAE2E559F5261C9F10A58A246C129DB5ABCA
Malicious:	false
URL:	https://www.hallcounty.org/ImageRepository/Document?documentID=9656
Preview:	......JFIF.....`.`.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............*************************************************........,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..B.(...(...(.......(...(...(...(...(...(...)3Tn5$..X..;.zW=lE.....1rvE.+.mcm.v.\n%N}.S.^#p....7..j.k..q.......TP.4W..{...QL..(.......(...(...(...(...(...(...)i)h...(...(...(...B@.h.h.....l.s.Z./T3....Y....i...d......e..Z.wh.8....r.F^S.GS\..,_........?..3}....z.....X..EA.m9t.#R.z..t$.V.V .1....L.....&...M....Q...!#...q].._=..%....d.;.^1../........*..4.<-.

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3168
Entropy (8bit):	7.704911325185365
Encrypted:	false
SSDEEP:	48:37TcgUFv95NwPpK+adjaoVaqzGfYdIO+bExaLM2uO+xVwvpoP:ftUFvdy8dXVaGNdIb1Lz8PwvpY
MD5:	A907E6E737788176B026FA71DFE8AFFE
SHA1:	6844236F638CEDCD652EB0A805476A1A13376CF5
SHA-256:	FC5E7621BA0E98C5C6728E3B2BDF802311C0A0953A05E60A7551CB0C7BED00A9
SHA-512:	3A17E66931A15B5C6553DAE241C5A7BB40240699F0608F92ED940CB203CBEA3031CB0FAC23F9C962F50D573F56DB27A3369F1A38ED1AEA0168D7E707803CA27A
Malicious:	false
URL:	https://secured-login.net/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png
Preview:	.PNG........IHDR.............>U....'IDATx..].\...e.!.H..B/J."""R..R....E)"../..".H..3s......&.O....d.QJ.L......P.m.U..u.Q..$.....}.5..M.....{.y.!A...\|.\|...3{.-M....m..~~....0.a...0..`...0........C...!`...0.a...0..<.z......w.tt<X.f..f.O.f./.(QK&s.t.{..z+.T..J..r.....3.....<r..../..Z.}.`..^.gGF6....p%.y^.,.R.....dr.c6/....w_[^........#G.j.7x...?.N.l..k.}...0< a..'.M...XO&g.....to......B..q~.......{....:...^H*QT..m..x.'..K}}.eu.&a........a..{...o..8.".-`Yi.p..zs........l........X-..tt<..=N&...H....&^...eE^M.9...U..gd..D;....gw.xL{.E.1..}}.+Q..U.......x.rO....V.8.,.n.p{...+............m...V.8.\|~``.\.........[.......>s...r......v$.+ctq...B{.A....L...j..T..K...b.V.y.M.Z....7T..8...e-.>...u...&`)..\|...... .....2...d....=:.N.~.....g%..x..5...7..-.l.e.........Y.u..=..l-...s.&.......r.vx.....{..e....).<1S(.\{>j.....+5.....kO...\|"Q-.r.k.I..........]i..!...W..._...=7[.[uo....sk....t[..B.a....\...X......7..\.96...F..]..]...M{.6..!..lv...V..C..p5..q.f

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3168
Entropy (8bit):	7.704911325185365
Encrypted:	false
SSDEEP:	48:37TcgUFv95NwPpK+adjaoVaqzGfYdIO+bExaLM2uO+xVwvpoP:ftUFvdy8dXVaGNdIb1Lz8PwvpY
MD5:	A907E6E737788176B026FA71DFE8AFFE
SHA1:	6844236F638CEDCD652EB0A805476A1A13376CF5
SHA-256:	FC5E7621BA0E98C5C6728E3B2BDF802311C0A0953A05E60A7551CB0C7BED00A9
SHA-512:	3A17E66931A15B5C6553DAE241C5A7BB40240699F0608F92ED940CB203CBEA3031CB0FAC23F9C962F50D573F56DB27A3369F1A38ED1AEA0168D7E707803CA27A
Malicious:	false
Preview:	.PNG........IHDR.............>U....'IDATx..].\...e.!.H..B/J."""R..R....E)"../..".H..3s......&.O....d.QJ.L......P.m.U..u.Q..$.....}.5..M.....{.y.!A...\|.\|...3{.-M....m..~~....0.a...0..`...0........C...!`...0.a...0..<.z......w.tt<X.f..f.O.f./.(QK&s.t.{..z+.T..J..r.....3.....<r..../..Z.}.`..^.gGF6....p%.y^.,.R.....dr.c6/....w_[^........#G.j.7x...?.N.l..k.}...0< a..'.M...XO&g.....to......B..q~.......{....:...^H*QT..m..x.'..K}}.eu.&a........a..{...o..8.".-`Yi.p..zs........l........X-..tt<..=N&...H....&^...eE^M.9...U..gd..D;....gw.xL{.E.1..}}.+Q..U.......x.rO....V.8.,.n.p{...+............m...V.8.\|~``.\.........[.......>s...r......v$.+ctq...B{.A....L...j..T..K...b.V.y.M.Z....7T..8...e-.>...u...&`)..\|...... .....2...d....=:.N.~.....g%..x..5...7..-.l.e.........Y.u..=..l-...s.&.......r.vx.....{..e....).<1S(.\{>j.....+5.....kO...\|"Q-.r.k.I..........]i..!...W..._...=7[.[uo....sk....t[..B.a....\...X......7..\.96...F..]..]...M{.6..!..lv...V..C..p5..q.f

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5934
Entropy (8bit):	4.931906350831601
Encrypted:	false
SSDEEP:	96:fiIg+VsCy59sZUAcYLoX9U0JePXOBaxAzi80JeaOV7Fzu/B3qn6dk/nGgje/mPFd:fiP+VbyPsZxcYLot7SXsaCQuu/Nq66/v
MD5:	134D934420B13974981A9634B7380865
SHA1:	18C01D3711CF8C21C1CD0CF544002358C1C929C6
SHA-256:	B3C447F15FCE33DFA869B9D2190364509EDE3937AE05B51BA394A78E28C244BA
SHA-512:	7FAE93AD1895DCF7CC58FC2C477BA51D3EB7D7B2884FE117E21C0A7E0160981EB53D23A6ACDA07DA594AF6984F52E1B57B6F157F84220729C7EEBF9AE062C092
Malicious:	false
URL:	https://secured-login.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css
Preview:	/* line 2, app/assets/stylesheets/sei-styles.scss /.x-sei.sei-flag {. border-bottom: 2px solid tomato;. padding-left: 3px;.}../ line 6, app/assets/stylesheets/sei-styles.scss /.x-sei.sei-flag::before {. content: ' ';. display: inline-block;. background: url(/assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png) no-repeat;. background-size: contain;. height: 12px;. width: 12px;. margin: 0 .1rem;.}../ line 16, app/assets/stylesheets/sei-styles.scss /.x-sei.sei-flag[generic='true'] {. display: block;. border-bottom: 0px;.}../ line 21, app/assets/stylesheets/sei-styles.scss /.x-sei.sei-flag[generic='true']::after {. font-family: "Courier New", Courier, monospace;. line-height: 1.8;. color: #b65555;. font-weight: bold;. content: attr(data-original-title);.}../ line 29, app/assets/stylesheets/sei-styles.scss */.x-sei.sei-flag[generic='true']::before {. content: ' ';. display: inline-block;. background: url(/assets/dark-flag-2846d82c5

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65447)
Category:	dropped
Size (bytes):	380848
Entropy (8bit):	5.202109831427653
Encrypted:	false
SSDEEP:	3072:sHNwcv9VBQpLl88SMBQ47GKYQa8ITLYI9fB8NJOD3EAjV2Uc9M1U+/uz+rSLyCAV:sHWK9VC78UBQ47GKXIvd9sOVAqtNX
MD5:	67A0C4DBD69561F3226243034423F1ED
SHA1:	88C1B5C7EBBFA24D8196290206BF544F28EEB406
SHA-256:	74B9F1CFE7CAD31AE1C1901200890B76676E6D92AC817641F5EF9BFD552F2110
SHA-512:	D5326C46E2FC443AA0C75DB573B39957514BD025235ADB5F16797133394E1AFD0A6458B38DA8220BF7558333E8F2334532FBCC4CD9DD4DD5811AAC403B498542
Malicious:	false
Preview:	/! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.remove

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1471
Entropy (8bit):	4.754611179426391
Encrypted:	false
SSDEEP:	24:y40r8CQo40agx40mC400XLaR404hZYmx40vGk40vG/I40vGhH40VhZ40UrCmn:xdDgCFEiBZgnTOHTn
MD5:	15E89F9684B18EC43EE51F8D62A787C3
SHA1:	9CBAAACEAE96845ECD3497F41EE3B02588ABEC11
SHA-256:	16F13E16A7EF02FB6F94250AA1931DED83DBEE5D9FAD278E33DD5792D085194F
SHA-512:	79E0110A045F28437D192290AC9789270CB0D4E676A985564746DB439992D867BA89639D7738E2A7F7D83BBF37D9A02CAA2AE1DC4E0EE2519797E5840A47FABE
Malicious:	false
URL:	https://secured-login.net/assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css
Preview:	/* line 1, app/assets/stylesheets/landing-watermark.scss /..watermark {. -webkit-writing-mode: vertical-rl;. -ms-writing-mode: tb-rl;. writing-mode: vertical-rl;. text-orientation: sideways;.}../ line 4, app/assets/stylesheets/landing-watermark.scss /..watermark.left {. left: 0;.}../ line 7, app/assets/stylesheets/landing-watermark.scss /..watermark.right {. right: 0;.}../ line 10, app/assets/stylesheets/landing-watermark.scss /..watermark.top {. text-align: center;. -webkit-writing-mode: horizontal-tb;. -ms-writing-mode: lr-tb;. writing-mode: horizontal-tb;. top: -38px;.}../ line 15, app/assets/stylesheets/landing-watermark.scss /..watermark h1 {. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. user-select: none;. font-size: 15px;. color: #fdfdfa;. font-weight: bold;.}../ line 24, app/assets/stylesheets/landing-watermark.scss /.#template_sei .watermark.left {. margin-left: -10px;.}../ li

Static File Info

General

File type:	Microsoft OOXML
Entropy (8bit):	7.942602906735231
TrID:	Word Microsoft Office Open XML Format document (49504/1) 58.23% Word Microsoft Office Open XML Format document (27504/1) 32.35% ZIP compressed archive (8000/1) 9.41%
File name:	Platinum Hall County, Georgia Proposal (16.6 KB).docx
File size:	32'167 bytes
MD5:	cc645920228b9ece5762ade90001d177
SHA1:	9de79eaf50b1c880cf6fa41d7af6bf8464df02f0
SHA256:	a3bf9762b1acf878b4ff2c40c6f39c462061e7d3c8a8a14e7887b93898752b11
SHA512:	dbf3ecbc66a06af7dc60a71a554320d0c559288f3ffa06e0354d5fe8d7a0763fd9d751e45fdb7f1675f7d83c54232c2ddcb64f7bddea91e876eab9dd9f02750b
SSDEEP:	768:azsQxRc0LdkWDbpIcm/SDeTAhX4rnH4T9kYA9rf4WhDt/s:b0LjbpFm66AhX4rH49JcfnhDtE
TLSH:	0CE2BF35DA4E6020D60352FD76E81FA0F49EB653D0DE225E3B27A0C514D39E97A71E88
File Content Preview:	PK........\|o.Y................[Content_Types].xml..MO.0...+.."_Q..J...).>........../.S..~.I...&.D\.3..>....N..).!&.]...)+.I..[T.....7+.........N..?f7... .K.[".?.'..+R..8..>Z....<.. ....._\z..p....ggP.......nI..,Xq.6...i.......`.....h).....7d..UI..'-uH..

File Icon


Icon Hash:	35e5c48caa8a8599

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 17:16:53.388676882 CET	49675	443	192.168.2.4	173.222.162.32
Dec 6, 2024 17:16:59.807591915 CET	49738	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:16:59.807643890 CET	443	49738	20.190.177.84	192.168.2.4
Dec 6, 2024 17:16:59.807976007 CET	49738	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:16:59.808228016 CET	49738	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:16:59.808240891 CET	443	49738	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:01.595072031 CET	443	49738	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:01.595212936 CET	49738	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:03.117188931 CET	49738	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:03.117212057 CET	443	49738	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:03.117589951 CET	443	49738	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:03.124322891 CET	49738	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:03.124368906 CET	49738	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:03.124386072 CET	443	49738	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:03.642725945 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:03.642756939 CET	443	49742	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:03.642854929 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:03.643400908 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:03.643414974 CET	443	49742	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:03.802593946 CET	443	49738	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:03.802675962 CET	443	49738	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:03.802731991 CET	49738	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:03.803045034 CET	49738	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:03.803061962 CET	443	49738	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:03.803072929 CET	49738	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:03.803077936 CET	443	49738	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:03.834263086 CET	49743	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:03.834310055 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:03.834369898 CET	49743	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:03.834541082 CET	49743	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:03.834557056 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:05.386127949 CET	443	49742	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:05.386224985 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:05.419909000 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:05.419931889 CET	443	49742	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:05.420195103 CET	443	49742	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:05.420253992 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:05.422566891 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:05.467329979 CET	443	49742	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:05.614037991 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:05.614394903 CET	49743	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:05.614423990 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:05.616184950 CET	49743	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:05.616190910 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:05.616255999 CET	49743	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:05.616266966 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:05.836472034 CET	443	49742	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:05.836522102 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:05.836548090 CET	443	49742	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:05.836560965 CET	443	49742	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:05.836587906 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:05.836610079 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:05.836673021 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:05.836688995 CET	443	49742	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:05.836709976 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:05.836729050 CET	49742	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:06.337995052 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:06.338043928 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:06.338130951 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:06.339752913 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:06.339766979 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:07.989217043 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:07.989291906 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:08.023520947 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:08.023541927 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.023762941 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.076112032 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:08.136136055 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:08.183332920 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.682203054 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.682229996 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.682236910 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.682262897 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.682274103 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.682285070 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.682391882 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:08.682391882 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:08.682391882 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:08.682420969 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.682466984 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:08.703433037 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.703497887 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:08.703505993 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.703524113 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.703564882 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:08.704370022 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:08.704386950 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:08.704399109 CET	49746	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:08.704405069 CET	443	49746	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:13.036187887 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:13.036211014 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:13.036226034 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:13.036304951 CET	49743	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:13.036338091 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:13.036391020 CET	49743	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:13.044629097 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:13.044735909 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:13.044749975 CET	49743	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:13.044780970 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:13.044797897 CET	49743	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:13.044797897 CET	49743	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:13.044806004 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:13.044811964 CET	443	49743	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:13.096980095 CET	49749	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:13.097018003 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:13.097826004 CET	49749	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:13.098023891 CET	49749	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:13.098037958 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:14.918015003 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:14.918435097 CET	49749	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:14.918452978 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:14.921149969 CET	49749	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:14.921158075 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:14.921319008 CET	49749	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:14.921334028 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:15.863584042 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:15.863610983 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:15.863641977 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:15.863677979 CET	49749	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:15.863706112 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:15.863717079 CET	49749	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:15.868094921 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:15.868963957 CET	49749	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:15.884737015 CET	49749	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:15.884757042 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:15.884767056 CET	49749	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:15.884773016 CET	443	49749	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:15.995426893 CET	49803	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:15.995482922 CET	443	49803	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:15.995564938 CET	49803	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:15.997930050 CET	49803	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:15.997947931 CET	443	49803	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:17.783119917 CET	443	49803	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:17.783592939 CET	49803	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:17.783603907 CET	443	49803	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:17.784564972 CET	49803	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:17.784573078 CET	443	49803	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:17.784621000 CET	49803	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:17.784629107 CET	443	49803	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:18.549105883 CET	443	49803	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:18.549124956 CET	443	49803	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:18.549197912 CET	443	49803	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:18.549259901 CET	49803	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:18.549463034 CET	49803	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:18.549489975 CET	443	49803	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:18.549508095 CET	49803	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:18.549514055 CET	443	49803	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:18.558593035 CET	49804	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:18.558623075 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:18.558679104 CET	49804	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:18.558839083 CET	49804	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:18.558851957 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:20.334778070 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:20.335264921 CET	49804	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:20.335279942 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:20.335849047 CET	49804	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:20.335855007 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:20.335881948 CET	49804	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:20.335889101 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:21.600476980 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:21.600505114 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:21.600553989 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:21.600600958 CET	49804	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:21.600630999 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:21.600644112 CET	49804	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:21.600924969 CET	49804	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:21.600943089 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:21.600951910 CET	49804	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:21.601093054 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:21.601124048 CET	443	49804	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:21.601197004 CET	49804	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:21.622188091 CET	49805	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:21.622220039 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:21.622327089 CET	49805	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:21.622530937 CET	49805	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:21.622539997 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:23.401151896 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:23.402201891 CET	49805	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:23.402218103 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:23.402986050 CET	49805	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:23.402998924 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:23.403027058 CET	49805	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:23.403032064 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:24.152986050 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:24.153012037 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:24.153053045 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:24.153075933 CET	49805	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:24.153091908 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:24.153105021 CET	49805	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:24.153157949 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:24.153193951 CET	49805	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:24.153445959 CET	49805	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:24.153460026 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:24.153470039 CET	49805	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:24.153475046 CET	443	49805	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:24.174602032 CET	49806	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:24.174640894 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:24.174721003 CET	49806	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:24.174892902 CET	49806	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:24.174906969 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:25.962114096 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:25.962604046 CET	49806	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:25.962644100 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:25.963213921 CET	49806	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:25.963228941 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:25.963284016 CET	49806	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:25.963293076 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:26.642110109 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:26.642142057 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:26.642179966 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:26.642222881 CET	49806	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:26.642254114 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:26.642268896 CET	49806	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:26.642812967 CET	49806	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:26.642823935 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:26.642841101 CET	49806	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:26.642988920 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:26.643018961 CET	443	49806	20.190.177.84	192.168.2.4
Dec 6, 2024 17:17:26.643064022 CET	49806	443	192.168.2.4	20.190.177.84
Dec 6, 2024 17:17:32.074875116 CET	49811	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:17:32.074913979 CET	443	49811	142.250.181.68	192.168.2.4
Dec 6, 2024 17:17:32.074981928 CET	49811	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:17:32.075273991 CET	49811	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:17:32.075290918 CET	443	49811	142.250.181.68	192.168.2.4
Dec 6, 2024 17:17:33.729860067 CET	49812	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:33.729918957 CET	443	49812	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:33.729983091 CET	49812	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:33.730180025 CET	49813	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:33.730240107 CET	443	49813	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:33.730293036 CET	49813	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:33.736129045 CET	49813	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:33.736144066 CET	443	49813	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:33.736448050 CET	49812	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:33.736471891 CET	443	49812	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:33.772511959 CET	443	49811	142.250.181.68	192.168.2.4
Dec 6, 2024 17:17:33.782943010 CET	49811	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:17:33.782960892 CET	443	49811	142.250.181.68	192.168.2.4
Dec 6, 2024 17:17:33.783989906 CET	443	49811	142.250.181.68	192.168.2.4
Dec 6, 2024 17:17:33.784048080 CET	49811	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:17:33.785593033 CET	49811	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:17:33.785655975 CET	443	49811	142.250.181.68	192.168.2.4
Dec 6, 2024 17:17:33.825737953 CET	49811	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:17:33.825757027 CET	443	49811	142.250.181.68	192.168.2.4
Dec 6, 2024 17:17:33.871695995 CET	49811	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:17:34.963666916 CET	443	49813	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:34.963675976 CET	443	49812	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:34.964067936 CET	49812	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:34.964112997 CET	49813	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:34.964116096 CET	443	49812	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:34.964143991 CET	443	49813	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:34.965212107 CET	443	49813	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:34.965214014 CET	443	49812	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:34.965296984 CET	49813	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:34.965302944 CET	49812	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:34.966643095 CET	49812	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:34.966707945 CET	443	49812	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:34.966732979 CET	49813	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:34.966809034 CET	443	49813	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:34.967032909 CET	49812	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:34.967042923 CET	443	49812	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:35.014899969 CET	49812	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:35.014904976 CET	49813	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:35.014931917 CET	443	49813	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:35.061753988 CET	49813	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:35.531637907 CET	443	49812	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:35.531718016 CET	443	49812	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:35.535126925 CET	49812	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:35.538861990 CET	49812	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:35.538882017 CET	443	49812	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:35.927813053 CET	49814	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:35.927862883 CET	443	49814	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:35.928210020 CET	49815	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:35.928256035 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:35.928263903 CET	49814	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:35.928495884 CET	49814	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:35.928514004 CET	443	49814	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:35.928519964 CET	49815	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:35.928663015 CET	49815	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:35.928674936 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:37.662954092 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:37.663304090 CET	49815	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:37.663342953 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:37.663573027 CET	443	49814	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:37.663738012 CET	49814	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:37.663774014 CET	443	49814	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:37.664463043 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:37.664532900 CET	49815	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:37.664803028 CET	443	49814	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:37.664858103 CET	49814	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:37.665535927 CET	49815	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:37.665616989 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:37.666421890 CET	49814	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:37.666510105 CET	443	49814	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:37.666529894 CET	49815	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:37.666541100 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:37.717597961 CET	49815	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:37.717597961 CET	49814	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:37.717627048 CET	443	49814	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:37.764395952 CET	49814	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:39.742952108 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:39.742976904 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:39.742984056 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:39.743002892 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:39.743006945 CET	49815	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:39.743009090 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:39.743033886 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:39.743040085 CET	49815	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:39.743086100 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:39.743128061 CET	49815	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:39.773258924 CET	49816	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:39.773300886 CET	443	49816	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:39.773363113 CET	49816	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:39.773724079 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:39.773756027 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:39.773807049 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:39.774174929 CET	49814	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:39.774791002 CET	49816	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:39.774806023 CET	443	49816	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:39.777704954 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:39.777717113 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:39.779473066 CET	49815	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:39.779489994 CET	443	49815	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:39.819322109 CET	443	49814	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:40.218341112 CET	443	49814	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:40.218360901 CET	443	49814	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:40.218426943 CET	443	49814	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:40.218437910 CET	49814	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:40.218471050 CET	49814	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:40.219199896 CET	49814	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:40.219218969 CET	443	49814	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:40.534102917 CET	49818	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:40.534143925 CET	443	49818	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:40.534231901 CET	49818	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:40.534466028 CET	49818	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:40.534481049 CET	443	49818	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:40.991708040 CET	443	49816	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:40.995745897 CET	49816	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:40.995780945 CET	443	49816	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:40.996155977 CET	443	49816	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:40.996449947 CET	49816	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:40.996519089 CET	443	49816	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:40.997112036 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.001306057 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.001331091 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.001425028 CET	49816	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.001880884 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.002258062 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.002340078 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.002362967 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.045917034 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.045938015 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.047328949 CET	443	49816	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.435497999 CET	443	49816	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.435524940 CET	443	49816	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.435602903 CET	49816	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.435605049 CET	443	49816	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.435657024 CET	49816	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.441999912 CET	49816	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.442017078 CET	443	49816	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.635302067 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.635334969 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.635344028 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.635353088 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.635375977 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.635404110 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.635428905 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.635443926 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.635474920 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.689366102 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.689384937 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.689449072 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.689469099 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.689493895 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.689506054 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.839644909 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.839668989 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.839740038 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.839761972 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.839849949 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.890250921 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.890271902 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.890317917 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.890333891 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.890346050 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.890376091 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.932010889 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.932029963 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.932090998 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.932102919 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:41.932123899 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:41.932145119 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.019465923 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.019485950 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.019558907 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.019577026 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.020597935 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.054311037 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.054342985 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.054429054 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.054436922 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.054488897 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.084489107 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.084513903 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.084618092 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.084625959 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.084665060 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.103786945 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.103806973 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.103872061 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.103879929 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.104592085 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.118616104 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.118634939 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.118730068 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.118738890 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.119098902 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.134366989 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.134387016 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.134450912 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.134464025 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.135097980 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.214560032 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.214587927 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.214668989 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.214680910 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.215091944 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.228127956 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.228143930 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.228209972 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.228219032 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.228715897 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.244116068 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.244131088 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.244204998 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.244216919 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.244729996 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.259530067 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.259545088 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.259609938 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.259618998 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.260071993 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.261477947 CET	443	49818	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:42.261683941 CET	49818	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:42.261707067 CET	443	49818	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:42.262918949 CET	443	49818	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:42.262984991 CET	49818	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:42.263995886 CET	49818	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:42.264071941 CET	443	49818	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:42.264308929 CET	49818	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:42.264316082 CET	443	49818	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:42.269517899 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.269556046 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.269620895 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.269629002 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.270195961 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.278012037 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.278032064 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.278088093 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.278095961 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.278137922 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.285118103 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.285135031 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.285197020 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.285204887 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.285233021 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.285253048 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.293313026 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.293329000 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.293386936 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.293394089 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.295372963 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.312462091 CET	49818	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:42.406853914 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.406877041 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.407085896 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.407103062 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.407144070 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.414412022 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.414428949 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.414510012 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.414519072 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.417503119 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.422107935 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.422132969 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.422220945 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.422229052 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.425178051 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.430084944 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.430105925 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.430146933 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.430155039 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.430181980 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.430197001 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.431355000 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.431417942 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.431422949 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.431442976 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.431485891 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.431771040 CET	49817	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.431782007 CET	443	49817	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.511959076 CET	49820	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.511990070 CET	443	49820	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.512053013 CET	49820	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.515431881 CET	49820	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.515448093 CET	443	49820	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.592577934 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.592622042 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.592730999 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.592942953 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:42.592952967 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:42.688324928 CET	49823	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:42.688349009 CET	443	49823	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:42.688410044 CET	49823	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:42.688640118 CET	49823	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:42.688652992 CET	443	49823	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:43.478583097 CET	443	49811	142.250.181.68	192.168.2.4
Dec 6, 2024 17:17:43.478662014 CET	443	49811	142.250.181.68	192.168.2.4
Dec 6, 2024 17:17:43.478729963 CET	49811	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:17:43.586880922 CET	443	49818	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:43.588502884 CET	443	49818	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:43.588579893 CET	443	49818	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:43.588584900 CET	49818	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:43.588618040 CET	49818	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:43.589622974 CET	49818	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:43.589637041 CET	443	49818	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:43.614778042 CET	49811	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:17:43.614801884 CET	443	49811	142.250.181.68	192.168.2.4
Dec 6, 2024 17:17:43.745995045 CET	443	49820	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:43.786128998 CET	49820	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:43.814692020 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:43.849873066 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:43.849895000 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:43.849996090 CET	49820	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:43.850009918 CET	443	49820	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:43.850469112 CET	443	49820	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:43.851008892 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:43.851073027 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:43.853529930 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:43.853570938 CET	443	49824	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:43.853636980 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:43.884633064 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:43.884733915 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:43.891777992 CET	49820	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:43.891973019 CET	49820	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:43.892064095 CET	443	49820	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:43.895279884 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:43.895293951 CET	443	49824	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:43.895541906 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:43.895555973 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:43.895600080 CET	49820	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:43.936106920 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:43.943331957 CET	443	49820	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.269753933 CET	443	49823	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:44.269982100 CET	49823	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:44.270013094 CET	443	49823	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:44.271042109 CET	443	49823	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:44.271119118 CET	49823	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:44.271126032 CET	443	49823	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:44.271172047 CET	49823	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:44.272114992 CET	49823	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:44.272188902 CET	443	49823	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:44.272408962 CET	49823	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:44.272416115 CET	443	49823	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:44.323868990 CET	49823	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:44.452462912 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.452483892 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.452491045 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.452519894 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.452534914 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.452543974 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.452555895 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.452584982 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.452600956 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.452625990 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.508871078 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.508893013 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.508934975 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.508944035 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.508982897 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.655064106 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.655086040 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.655138016 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.655160904 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.655174971 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.655200005 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.689003944 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.689024925 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.689062119 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.689074039 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.689104080 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.689117908 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.714207888 CET	443	49820	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.714230061 CET	443	49820	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.714282036 CET	49820	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.714313030 CET	443	49820	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.714325905 CET	443	49820	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.714365005 CET	49820	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.716181993 CET	49820	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.716200113 CET	443	49820	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.721755028 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.721774101 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.721837044 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.721848011 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.721906900 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.724144936 CET	49825	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.724183083 CET	443	49825	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.724241972 CET	49825	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.724493027 CET	49825	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.724503040 CET	443	49825	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.749980927 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.750005007 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.750042915 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.750052929 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.750082016 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.750102043 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.787369013 CET	443	49823	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:44.787451029 CET	443	49823	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:44.787539005 CET	49823	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:44.788733959 CET	49823	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:44.788749933 CET	443	49823	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:44.837723970 CET	49826	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.837763071 CET	443	49826	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.837831974 CET	49826	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.838046074 CET	49826	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.838057995 CET	443	49826	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.860951900 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.860971928 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.861036062 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.861049891 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.861090899 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.892045021 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.892071009 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.892102957 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.892110109 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.892137051 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.892153978 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.912923098 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.912941933 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.913094044 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.913101912 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.913147926 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.935843945 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.935862064 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.935905933 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.935919046 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:44.935931921 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.935954094 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:44.979788065 CET	49828	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:44.979821920 CET	443	49828	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:44.979881048 CET	49828	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:44.980088949 CET	49828	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:44.980098963 CET	443	49828	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:45.028693914 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.028714895 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.028789043 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.028800964 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.028848886 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.047163010 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.047188997 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.047254086 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.047261000 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.047301054 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.064431906 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.064455032 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.064503908 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.064517021 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.064527988 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.067106962 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.084299088 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.084317923 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.084393978 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.084402084 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.084451914 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.098963976 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.098978996 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.099031925 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.099039078 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.099082947 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.112791061 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.112809896 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.112880945 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.112890959 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.112930059 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.127751112 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.127768040 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.127835035 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.127844095 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.127887011 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.140526056 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.140551090 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.140631914 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.140650034 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.140692949 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.171500921 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:45.171542883 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:45.171627045 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:45.172044039 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:45.172056913 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:45.222873926 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.222893000 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.222938061 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.222956896 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.222991943 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.223011971 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.235491037 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.235508919 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.235560894 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.235568047 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.235609055 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.247875929 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.247894049 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.247942924 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.247947931 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.247992039 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.260529995 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.260550976 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.260590076 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.260596991 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.260628939 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.271294117 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.271330118 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.271349907 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.271353960 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.271392107 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.274754047 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.274804115 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.274807930 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.274836063 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.274844885 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.274876118 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.274926901 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.274938107 CET	443	49821	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:45.274964094 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.274982929 CET	49821	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:45.617774010 CET	443	49824	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:45.618052959 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:45.618077040 CET	443	49824	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:45.618956089 CET	443	49824	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:45.619024038 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:45.619333982 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:45.619384050 CET	443	49824	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:45.619477034 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:45.619482994 CET	443	49824	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:45.668557882 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:46.002722025 CET	443	49825	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.003042936 CET	49825	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.003062010 CET	443	49825	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.003432035 CET	443	49825	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.003772974 CET	49825	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.003845930 CET	443	49825	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.003927946 CET	49825	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.051326036 CET	443	49825	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.055273056 CET	443	49826	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.065572023 CET	49826	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.065583944 CET	443	49826	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.066067934 CET	443	49826	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.068247080 CET	49826	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.068327904 CET	443	49826	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.068429947 CET	49826	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.115340948 CET	443	49826	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.446564913 CET	443	49825	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.446587086 CET	443	49825	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.446659088 CET	443	49825	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.446679115 CET	49825	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.446732044 CET	49825	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.500163078 CET	443	49826	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.500237942 CET	443	49826	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.500309944 CET	49826	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.606034994 CET	443	49828	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:46.624553919 CET	49828	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:46.624576092 CET	443	49828	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:46.625610113 CET	49826	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.625633001 CET	443	49826	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.625638008 CET	443	49828	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:46.625705957 CET	49828	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:46.625710964 CET	443	49828	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:46.625757933 CET	49828	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:46.627239943 CET	49828	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:46.627305984 CET	443	49828	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:46.627834082 CET	49825	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.627862930 CET	443	49825	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.628608942 CET	49828	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:46.628614902 CET	443	49828	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:46.635308027 CET	49830	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.635350943 CET	443	49830	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.635555983 CET	49830	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.635741949 CET	49830	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:46.635756969 CET	443	49830	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:46.684016943 CET	49828	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:46.864806890 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:46.864886999 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:46.867729902 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:46.867737055 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:46.867985010 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:46.877082109 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:46.904304981 CET	49831	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:46.904325962 CET	443	49831	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:46.904510021 CET	49831	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:46.904809952 CET	49831	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:46.904824018 CET	443	49831	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:46.919332981 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:46.920846939 CET	443	49824	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:46.920867920 CET	443	49824	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:46.920917988 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:46.920933008 CET	443	49824	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:46.920983076 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:46.922138929 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:46.922169924 CET	443	49824	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:46.922363997 CET	443	49824	18.66.161.97	192.168.2.4
Dec 6, 2024 17:17:46.922415018 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:46.922426939 CET	49824	443	192.168.2.4	18.66.161.97
Dec 6, 2024 17:17:47.130650997 CET	443	49828	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:47.130743980 CET	443	49828	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:47.130785942 CET	49828	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:47.131639004 CET	49828	443	192.168.2.4	185.15.58.240
Dec 6, 2024 17:17:47.131654024 CET	443	49828	185.15.58.240	192.168.2.4
Dec 6, 2024 17:17:47.529846907 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:47.529879093 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:47.529894114 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:47.529939890 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:47.529956102 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:47.529983997 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:47.530004025 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:47.573101997 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:47.573133945 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:47.573173046 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:47.573182106 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:47.573206902 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:47.573225975 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:47.573376894 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:47.573404074 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:47.573420048 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:47.573420048 CET	49829	443	192.168.2.4	20.109.210.53
Dec 6, 2024 17:17:47.573427916 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:47.573434114 CET	443	49829	20.109.210.53	192.168.2.4
Dec 6, 2024 17:17:47.853760004 CET	443	49830	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:47.854011059 CET	49830	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:47.854029894 CET	443	49830	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:47.854393005 CET	443	49830	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:47.854760885 CET	49830	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:47.854851007 CET	443	49830	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:47.854950905 CET	49830	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:47.895330906 CET	443	49830	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:48.113518000 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:48.113559961 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:48.113650084 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:48.113991022 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:48.114005089 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:48.123045921 CET	443	49831	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:48.123121977 CET	49831	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:48.123519897 CET	49831	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:48.123528004 CET	443	49831	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:48.123733044 CET	49831	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:48.123738050 CET	443	49831	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:48.296391964 CET	443	49830	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:48.296475887 CET	443	49830	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:48.296521902 CET	49830	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:48.297180891 CET	49830	443	192.168.2.4	52.205.74.90
Dec 6, 2024 17:17:48.297197104 CET	443	49830	52.205.74.90	192.168.2.4
Dec 6, 2024 17:17:48.692656040 CET	443	49831	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:48.692732096 CET	443	49831	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:48.692873955 CET	49831	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:48.692874908 CET	49831	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:48.693591118 CET	49831	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:48.693609953 CET	443	49831	34.196.207.207	192.168.2.4
Dec 6, 2024 17:17:48.693635941 CET	49831	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:48.693656921 CET	49831	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:17:49.834712029 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:49.834784031 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:49.836560011 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:49.836571932 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:49.836782932 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:49.845864058 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:49.887334108 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.307439089 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.307466030 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.307481050 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.307560921 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.307585955 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.307733059 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.490418911 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.490447044 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.490521908 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.490552902 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.490721941 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.537111998 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.537128925 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.537188053 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.537218094 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.537969112 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.656716108 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.656732082 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.656817913 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.656850100 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.659115076 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.687634945 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.687649965 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.687856913 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.687880039 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.687932014 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.715679884 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.715703011 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.715816975 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.715847969 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.715981007 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.733172894 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.733187914 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.733328104 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.733345032 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.733422041 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.846452951 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.846471071 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.846569061 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.846594095 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.846801996 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.860739946 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.860755920 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.860831022 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.860853910 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.863110065 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.875438929 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.875456095 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.875507116 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.875523090 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.875551939 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.875567913 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.889966011 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.889991999 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.890052080 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.890074015 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.890100002 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.890120983 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.904611111 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.904633999 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.904814959 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.904833078 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.905035019 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.916354895 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.916393995 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.916487932 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.916507959 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.916551113 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.920842886 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.920923948 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.920947075 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.920964003 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.921015024 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.921040058 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.921052933 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.921058893 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.921072006 CET	49832	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.921076059 CET	443	49832	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.960746050 CET	49835	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.960760117 CET	49834	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.960789919 CET	443	49835	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.960797071 CET	443	49834	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.960901022 CET	49834	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.961035967 CET	49835	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.961035967 CET	49835	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.961061954 CET	443	49835	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.961196899 CET	49834	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.961211920 CET	443	49834	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.962332010 CET	49836	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.962367058 CET	443	49836	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.963109016 CET	49836	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.963519096 CET	49837	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.963552952 CET	443	49837	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.963555098 CET	49836	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.963572025 CET	443	49836	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.964157104 CET	49838	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.964169979 CET	443	49838	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.964184999 CET	49837	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.964278936 CET	49837	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.964298010 CET	443	49837	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:50.964303970 CET	49838	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.964371920 CET	49838	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:50.964386940 CET	443	49838	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.694022894 CET	443	49836	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.694478989 CET	443	49835	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.695055008 CET	49836	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:52.695065022 CET	443	49836	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.695723057 CET	49836	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:52.695732117 CET	443	49836	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.695841074 CET	49835	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:52.695864916 CET	443	49835	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.695960045 CET	443	49838	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.696177959 CET	49835	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:52.696182966 CET	443	49835	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.696382999 CET	49838	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:52.696391106 CET	443	49838	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.696846008 CET	49838	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:52.696850061 CET	443	49838	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.696934938 CET	443	49834	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.697021008 CET	443	49837	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.697197914 CET	49834	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:52.697215080 CET	443	49834	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.697488070 CET	49837	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:52.697510004 CET	443	49837	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.697755098 CET	49834	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:52.697762012 CET	443	49834	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:52.697958946 CET	49837	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:52.697964907 CET	443	49837	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.127651930 CET	443	49836	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.127679110 CET	443	49836	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.127784967 CET	49836	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.127816916 CET	443	49836	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.127873898 CET	49836	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.128026009 CET	49836	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.128035069 CET	443	49836	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.128046989 CET	49836	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.128202915 CET	443	49836	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.128230095 CET	443	49836	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.128293037 CET	49836	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.128611088 CET	443	49835	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.128679991 CET	443	49835	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.131153107 CET	49835	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.131563902 CET	443	49837	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.131660938 CET	443	49837	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.131721020 CET	49837	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.131836891 CET	49835	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.131836891 CET	49835	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.131859064 CET	443	49835	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.131867886 CET	443	49835	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.132447004 CET	49837	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.132466078 CET	443	49837	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.132474899 CET	49837	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.132481098 CET	443	49837	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.134953022 CET	49839	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.134974957 CET	443	49839	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.135054111 CET	49839	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.135081053 CET	49840	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.135097027 CET	443	49840	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.135171890 CET	49840	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.135302067 CET	443	49838	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.135329962 CET	443	49838	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.135329962 CET	49839	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.135345936 CET	443	49839	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.135386944 CET	49838	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.135401011 CET	443	49838	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.135581970 CET	49840	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.135591984 CET	443	49840	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.135632038 CET	49838	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.135651112 CET	443	49838	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.135659933 CET	49838	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.135816097 CET	443	49838	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.135847092 CET	443	49838	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.135895967 CET	49838	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.136132956 CET	49841	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.136164904 CET	443	49841	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.136238098 CET	49841	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.136327982 CET	49841	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.136341095 CET	443	49841	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.136581898 CET	443	49834	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.136604071 CET	443	49834	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.136689901 CET	49834	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.136702061 CET	443	49834	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.136740923 CET	49834	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.136846066 CET	49834	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.136848927 CET	443	49834	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.136864901 CET	49834	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.137036085 CET	443	49834	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.137073040 CET	443	49834	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.137129068 CET	49834	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.139302015 CET	49842	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.139319897 CET	443	49842	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.139384031 CET	49842	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.139535904 CET	49842	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.139542103 CET	443	49842	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.139734030 CET	49843	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.139749050 CET	443	49843	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:53.139812946 CET	49843	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.139934063 CET	49843	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:53.139941931 CET	443	49843	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.868670940 CET	443	49839	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.869158983 CET	49839	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:54.869189978 CET	443	49839	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.869707108 CET	49839	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:54.869713068 CET	443	49839	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.902049065 CET	443	49841	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.902187109 CET	443	49840	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.902677059 CET	49840	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:54.902678013 CET	443	49842	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.902714968 CET	443	49840	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.902906895 CET	443	49843	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.902910948 CET	49841	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:54.902928114 CET	443	49841	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.903472900 CET	49840	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:54.903481007 CET	443	49840	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.903537989 CET	49842	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:54.903547049 CET	443	49842	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.903947115 CET	49842	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:54.903951883 CET	443	49842	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.903999090 CET	49841	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:54.904006004 CET	443	49841	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.904058933 CET	49843	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:54.904064894 CET	443	49843	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:54.904407978 CET	49843	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:54.904412985 CET	443	49843	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.303517103 CET	443	49839	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.303599119 CET	443	49839	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.303653955 CET	49839	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.303868055 CET	49839	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.303884983 CET	443	49839	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.303894043 CET	49839	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.303899050 CET	443	49839	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.306623936 CET	49844	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.306642056 CET	443	49844	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.306714058 CET	49844	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.306874990 CET	49844	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.306891918 CET	443	49844	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.336476088 CET	443	49841	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.336539984 CET	443	49841	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.336662054 CET	49841	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.336715937 CET	49841	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.336731911 CET	443	49841	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.336743116 CET	49841	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.336747885 CET	443	49841	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.337533951 CET	443	49840	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.337593079 CET	443	49842	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.337599039 CET	443	49840	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.337662935 CET	443	49842	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.337672949 CET	49840	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.337706089 CET	49842	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.337788105 CET	49840	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.337805986 CET	443	49840	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.337815046 CET	49840	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.337820053 CET	443	49840	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.338133097 CET	49842	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.338136911 CET	443	49842	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.338145971 CET	49842	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.338149071 CET	443	49842	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.338303089 CET	443	49843	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.338362932 CET	443	49843	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.338412046 CET	49843	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.339076042 CET	49843	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.339080095 CET	443	49843	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.339106083 CET	49843	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.339109898 CET	443	49843	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.339726925 CET	49845	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.339756966 CET	443	49845	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.340894938 CET	49845	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.341830015 CET	49846	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.341840982 CET	443	49846	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.341944933 CET	49846	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.342076063 CET	49845	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.342097998 CET	443	49845	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.342231989 CET	49847	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.342240095 CET	443	49847	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.342361927 CET	49847	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.342499018 CET	49847	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.342508078 CET	443	49847	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.342649937 CET	49846	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.342662096 CET	443	49846	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.342807055 CET	49848	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.342834949 CET	443	49848	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:55.342885971 CET	49848	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.342974901 CET	49848	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:55.342984915 CET	443	49848	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.024379969 CET	443	49844	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.024873972 CET	49844	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.024892092 CET	443	49844	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.025363922 CET	49844	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.025369883 CET	443	49844	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.107801914 CET	443	49848	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.109325886 CET	443	49845	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.109565973 CET	49848	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.109585047 CET	443	49848	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.109708071 CET	49845	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.109709978 CET	443	49846	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.109726906 CET	443	49845	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.109740973 CET	443	49847	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.110066891 CET	49848	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.110074043 CET	443	49848	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.110354900 CET	49845	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.110362053 CET	443	49845	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.110464096 CET	49847	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.110471010 CET	443	49847	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.110907078 CET	49847	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.110910892 CET	443	49847	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.110930920 CET	49846	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.110948086 CET	443	49846	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.111289024 CET	49846	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.111294031 CET	443	49846	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.459182024 CET	443	49844	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.459259033 CET	443	49844	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.459327936 CET	49844	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.459522963 CET	49844	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.459541082 CET	443	49844	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.459551096 CET	49844	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.459556103 CET	443	49844	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.462481022 CET	49849	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.462515116 CET	443	49849	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.462594032 CET	49849	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.462775946 CET	49849	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.462790012 CET	443	49849	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.543180943 CET	443	49848	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.543246984 CET	443	49848	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.543376923 CET	49848	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.543597937 CET	49848	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.543613911 CET	443	49848	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.543625116 CET	49848	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.543629885 CET	443	49848	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.545134068 CET	443	49845	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.545198917 CET	443	49845	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.545248985 CET	49845	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.545341969 CET	49845	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.545363903 CET	443	49845	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.545378923 CET	49845	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.545383930 CET	443	49845	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.545716047 CET	443	49846	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.545778990 CET	443	49846	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.545831919 CET	49846	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.545833111 CET	443	49847	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.545893908 CET	443	49847	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.545923948 CET	49846	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.545933962 CET	443	49846	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.545943975 CET	49847	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.545947075 CET	49846	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.545950890 CET	443	49846	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.546370983 CET	49847	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.546375036 CET	443	49847	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.546417952 CET	49847	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.546421051 CET	443	49847	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.548312902 CET	49850	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.548333883 CET	443	49850	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.548403025 CET	49850	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.548808098 CET	49850	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.548818111 CET	443	49850	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.549061060 CET	49851	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.549073935 CET	443	49851	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.549134970 CET	49851	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.549232960 CET	49852	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.549243927 CET	49851	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.549253941 CET	443	49851	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.549263954 CET	443	49852	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.549321890 CET	49852	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.549398899 CET	49852	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.549417973 CET	443	49852	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.550168991 CET	49853	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.550209999 CET	443	49853	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:57.550273895 CET	49853	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.550400019 CET	49853	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:57.550410032 CET	443	49853	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:58.981587887 CET	49723	80	192.168.2.4	199.232.214.172
Dec 6, 2024 17:17:58.981688976 CET	49724	80	192.168.2.4	199.232.214.172
Dec 6, 2024 17:17:59.101885080 CET	80	49723	199.232.214.172	192.168.2.4
Dec 6, 2024 17:17:59.101941109 CET	49723	80	192.168.2.4	199.232.214.172
Dec 6, 2024 17:17:59.102497101 CET	80	49724	199.232.214.172	192.168.2.4
Dec 6, 2024 17:17:59.102560997 CET	49724	80	192.168.2.4	199.232.214.172
Dec 6, 2024 17:17:59.184428930 CET	443	49849	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.185014009 CET	49849	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.185051918 CET	443	49849	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.185477972 CET	49849	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.185492039 CET	443	49849	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.294749975 CET	443	49850	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.295253038 CET	49850	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.295265913 CET	443	49850	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.295706034 CET	49850	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.295710087 CET	443	49850	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.297821045 CET	443	49852	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.298063040 CET	49852	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.298094034 CET	443	49852	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.298381090 CET	49852	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.298388958 CET	443	49852	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.299216032 CET	443	49853	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.299446106 CET	49853	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.299467087 CET	443	49853	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.299779892 CET	49853	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.299784899 CET	443	49853	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.301266909 CET	443	49851	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.301477909 CET	49851	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.301497936 CET	443	49851	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.301788092 CET	49851	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.301794052 CET	443	49851	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.620193958 CET	443	49849	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.620280027 CET	443	49849	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.620492935 CET	49849	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.620686054 CET	49849	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.620707035 CET	443	49849	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.620718002 CET	49849	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.620723963 CET	443	49849	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.623559952 CET	49854	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.623625994 CET	443	49854	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.623727083 CET	49854	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.623848915 CET	49854	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.623867035 CET	443	49854	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.729377985 CET	443	49850	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.729450941 CET	443	49850	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.729603052 CET	49850	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.729691982 CET	49850	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.729707956 CET	443	49850	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.729717970 CET	49850	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.729726076 CET	443	49850	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.732029915 CET	443	49852	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.732104063 CET	443	49852	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.732147932 CET	49852	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.732225895 CET	49852	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.732250929 CET	443	49852	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.732264042 CET	49852	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.732269049 CET	443	49852	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.732599020 CET	49855	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.732644081 CET	443	49855	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.732712984 CET	49855	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.732877970 CET	49855	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.732891083 CET	443	49855	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.733283043 CET	443	49853	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.733347893 CET	443	49853	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.733393908 CET	49853	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.733452082 CET	49853	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.733459949 CET	443	49853	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.733470917 CET	49853	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.733474970 CET	443	49853	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.734828949 CET	49856	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.734837055 CET	443	49856	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.734906912 CET	49856	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.735018969 CET	49856	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.735028028 CET	443	49856	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.735327959 CET	49857	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.735358953 CET	443	49857	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.735413074 CET	49857	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.735547066 CET	49857	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.735559940 CET	443	49857	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.735630989 CET	443	49851	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.735690117 CET	443	49851	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.735748053 CET	49851	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.735830069 CET	49851	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.735841990 CET	443	49851	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.735852003 CET	49851	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.735856056 CET	443	49851	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.737812996 CET	49858	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.737821102 CET	443	49858	13.107.246.63	192.168.2.4
Dec 6, 2024 17:17:59.737896919 CET	49858	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.738044024 CET	49858	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:17:59.738053083 CET	443	49858	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.339540005 CET	443	49854	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.340220928 CET	49854	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.340255976 CET	443	49854	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.340853930 CET	49854	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.340858936 CET	443	49854	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.450582981 CET	443	49856	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.451205969 CET	49856	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.451225996 CET	443	49856	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.451647997 CET	49856	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.451652050 CET	443	49856	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.453784943 CET	443	49857	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.454021931 CET	443	49855	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.454060078 CET	49857	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.454080105 CET	443	49857	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.454293966 CET	49855	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.454310894 CET	443	49855	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.454421997 CET	49857	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.454427004 CET	443	49857	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.454773903 CET	49855	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.454778910 CET	443	49855	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.462853909 CET	443	49858	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.463126898 CET	49858	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.463134050 CET	443	49858	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.463479996 CET	49858	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.463484049 CET	443	49858	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.798068047 CET	443	49854	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.798135042 CET	443	49854	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.798274040 CET	49854	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.798523903 CET	49854	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.798544884 CET	443	49854	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.798554897 CET	49854	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.798562050 CET	443	49854	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.801641941 CET	49859	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.801661015 CET	443	49859	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.801744938 CET	49859	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.801927090 CET	49859	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.801939964 CET	443	49859	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.886018991 CET	443	49856	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.886089087 CET	443	49856	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.886162996 CET	49856	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.886425018 CET	49856	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.886444092 CET	443	49856	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.886486053 CET	49856	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.886492968 CET	443	49856	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.887541056 CET	443	49857	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.887602091 CET	443	49857	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.887670994 CET	49857	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.888108015 CET	49857	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.888117075 CET	443	49857	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.888148069 CET	49857	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.888151884 CET	443	49857	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.889746904 CET	49860	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.889786959 CET	443	49860	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.889885902 CET	49860	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.890017033 CET	49860	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.890031099 CET	443	49860	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.890198946 CET	49861	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.890223980 CET	443	49861	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.890280962 CET	49861	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.890305042 CET	443	49855	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.890368938 CET	443	49855	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.890441895 CET	49861	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.890455008 CET	443	49861	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.890464067 CET	49855	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.890492916 CET	49855	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.890492916 CET	49855	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.890499115 CET	443	49855	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.890507936 CET	443	49855	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.892455101 CET	49862	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.892462969 CET	443	49862	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.892533064 CET	49862	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.892649889 CET	49862	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.892661095 CET	443	49862	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.898933887 CET	443	49858	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.898997068 CET	443	49858	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.899101973 CET	49858	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.899122953 CET	49858	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.899127960 CET	443	49858	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.899137020 CET	49858	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.899141073 CET	443	49858	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.900922060 CET	49863	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.900938988 CET	443	49863	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:01.901009083 CET	49863	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.901148081 CET	49863	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:01.901161909 CET	443	49863	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.529217958 CET	443	49859	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.531574011 CET	49859	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.531610012 CET	443	49859	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.532031059 CET	49859	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.532036066 CET	443	49859	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.613786936 CET	443	49862	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.614558935 CET	443	49861	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.616055012 CET	49862	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.616077900 CET	443	49862	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.616508961 CET	49862	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.616513014 CET	443	49862	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.617005110 CET	49861	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.617036104 CET	443	49861	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.617484093 CET	49861	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.617491007 CET	443	49861	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.644784927 CET	443	49863	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.645349026 CET	49863	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.645378113 CET	443	49863	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.645791054 CET	49863	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.645797968 CET	443	49863	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.746958017 CET	443	49860	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.747688055 CET	49860	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.747714996 CET	443	49860	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.748146057 CET	49860	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.748152018 CET	443	49860	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.977360010 CET	443	49859	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.977427959 CET	443	49859	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.977498055 CET	49859	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.977722883 CET	49859	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.977741957 CET	443	49859	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.977751970 CET	49859	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.977756977 CET	443	49859	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.980895996 CET	49864	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.980936050 CET	443	49864	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:03.981018066 CET	49864	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.981194019 CET	49864	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:03.981204033 CET	443	49864	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.049061060 CET	443	49861	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.049129009 CET	443	49861	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.049376011 CET	49861	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.049412012 CET	49861	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.049434900 CET	443	49861	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.049448013 CET	49861	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.049453020 CET	443	49861	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.050209999 CET	443	49862	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.050276041 CET	443	49862	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.050340891 CET	49862	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.050468922 CET	49862	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.050487041 CET	443	49862	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.050498962 CET	49862	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.050503016 CET	443	49862	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.052232027 CET	49865	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.052268028 CET	443	49865	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.052371979 CET	49865	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.052450895 CET	49866	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.052489042 CET	443	49866	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.052521944 CET	49865	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.052534103 CET	443	49865	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.052546978 CET	49866	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.052717924 CET	49866	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.052731037 CET	443	49866	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.079866886 CET	443	49863	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.079956055 CET	443	49863	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.080226898 CET	49863	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.080265999 CET	49863	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.080276966 CET	443	49863	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.080286026 CET	49863	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.080292940 CET	443	49863	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.083115101 CET	49867	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.083125114 CET	443	49867	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.083194017 CET	49867	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.083333969 CET	49867	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.083343029 CET	443	49867	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.182600975 CET	443	49860	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.182673931 CET	443	49860	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.182727098 CET	49860	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.183089018 CET	49860	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.183099985 CET	443	49860	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.183109045 CET	49860	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.183113098 CET	443	49860	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.186387062 CET	49868	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.186419010 CET	443	49868	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:04.186486006 CET	49868	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.186676025 CET	49868	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:04.186690092 CET	443	49868	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.698879957 CET	443	49864	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.699608088 CET	49864	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:05.699644089 CET	443	49864	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.700193882 CET	49864	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:05.700200081 CET	443	49864	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.780905962 CET	443	49865	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.781480074 CET	49865	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:05.781511068 CET	443	49865	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.781919003 CET	49865	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:05.781923056 CET	443	49865	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.783360958 CET	443	49866	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.783593893 CET	49866	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:05.783613920 CET	443	49866	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.783917904 CET	49866	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:05.783921957 CET	443	49866	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.809062958 CET	443	49867	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.809432983 CET	49867	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:05.809454918 CET	443	49867	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.809788942 CET	49867	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:05.809792995 CET	443	49867	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.909540892 CET	443	49868	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.910104036 CET	49868	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:05.910125017 CET	443	49868	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:05.910599947 CET	49868	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:05.910608053 CET	443	49868	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.137033939 CET	443	49864	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.137109041 CET	443	49864	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.137312889 CET	49864	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.137339115 CET	49864	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.137356043 CET	443	49864	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.137368917 CET	49864	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.137375116 CET	443	49864	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.139954090 CET	49869	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.140006065 CET	443	49869	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.140093088 CET	49869	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.140266895 CET	49869	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.140280962 CET	443	49869	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.216077089 CET	443	49865	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.216162920 CET	443	49865	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.216348886 CET	49865	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.216383934 CET	49865	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.216403008 CET	443	49865	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.216411114 CET	49865	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.216415882 CET	443	49865	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.218399048 CET	443	49866	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.218473911 CET	443	49866	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.218553066 CET	49866	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.218679905 CET	49866	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.218698025 CET	443	49866	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.218705893 CET	49866	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.218710899 CET	443	49866	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.219124079 CET	49870	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.219171047 CET	443	49870	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.219249010 CET	49870	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.219410896 CET	49870	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.219427109 CET	443	49870	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.220904112 CET	49871	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.220930099 CET	443	49871	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.221004009 CET	49871	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.221133947 CET	49871	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.221148014 CET	443	49871	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.245881081 CET	443	49867	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.245959044 CET	443	49867	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.246150017 CET	49867	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.246169090 CET	49867	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.246175051 CET	443	49867	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.246186018 CET	49867	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.246190071 CET	443	49867	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.248558044 CET	49872	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.248579025 CET	443	49872	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.248671055 CET	49872	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.248822927 CET	49872	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.248836994 CET	443	49872	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.345200062 CET	443	49868	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.345268011 CET	443	49868	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.345479965 CET	49868	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.345510960 CET	49868	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.345530033 CET	443	49868	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.345540047 CET	49868	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.345546007 CET	443	49868	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.348421097 CET	49873	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.348452091 CET	443	49873	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:06.348572016 CET	49873	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.348701954 CET	49873	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:06.348706961 CET	443	49873	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:07.872535944 CET	443	49869	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:07.873025894 CET	49869	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:07.873054028 CET	443	49869	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:07.873574018 CET	49869	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:07.873579025 CET	443	49869	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.003643036 CET	443	49870	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.003899097 CET	443	49871	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.004265070 CET	49870	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.004287958 CET	443	49870	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.004503012 CET	49871	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.004513979 CET	443	49871	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.004754066 CET	49870	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.004760981 CET	443	49870	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.005016088 CET	49871	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.005019903 CET	443	49871	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.014081001 CET	443	49872	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.014394999 CET	49872	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.014411926 CET	443	49872	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.014879942 CET	49872	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.014884949 CET	443	49872	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.094038963 CET	443	49873	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.094388962 CET	49873	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.094404936 CET	443	49873	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.094777107 CET	49873	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.094784021 CET	443	49873	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.309612989 CET	443	49869	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.309683084 CET	443	49869	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.309745073 CET	49869	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.310017109 CET	49869	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.310039043 CET	443	49869	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.310054064 CET	49869	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.310060978 CET	443	49869	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.313512087 CET	49874	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.313560009 CET	443	49874	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.313641071 CET	49874	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.313848019 CET	49874	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.313863993 CET	443	49874	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.439065933 CET	443	49870	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.439157009 CET	443	49870	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.439331055 CET	49870	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.439352989 CET	49870	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.439369917 CET	443	49870	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.439380884 CET	49870	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.439385891 CET	443	49870	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.439404011 CET	443	49871	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.439459085 CET	443	49871	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.441981077 CET	49875	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.442018032 CET	49871	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.442022085 CET	443	49875	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.442064047 CET	49871	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.442064047 CET	49871	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.442082882 CET	443	49871	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.442086935 CET	49875	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.442091942 CET	443	49871	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.442375898 CET	49875	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.442389965 CET	443	49875	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.444075108 CET	49876	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.444097042 CET	443	49876	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.444165945 CET	49876	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.444329023 CET	49876	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.444341898 CET	443	49876	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.452310085 CET	443	49872	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.452378035 CET	443	49872	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.452502012 CET	49872	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.452538013 CET	49872	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.452538013 CET	49872	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.452555895 CET	443	49872	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.452564955 CET	443	49872	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.454588890 CET	49877	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.454610109 CET	443	49877	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.454680920 CET	49877	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.454806089 CET	49877	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.454816103 CET	443	49877	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.531227112 CET	443	49873	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.531306982 CET	443	49873	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.531399965 CET	49873	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.531605959 CET	49873	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.531625032 CET	443	49873	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.531636953 CET	49873	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.531642914 CET	443	49873	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.534154892 CET	49878	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.534197092 CET	443	49878	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:08.534275055 CET	49878	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.534473896 CET	49878	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:08.534488916 CET	443	49878	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.030101061 CET	443	49874	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.030680895 CET	49874	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.030713081 CET	443	49874	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.031143904 CET	49874	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.031151056 CET	443	49874	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.175116062 CET	443	49875	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.175543070 CET	49875	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.175559044 CET	443	49875	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.175991058 CET	49875	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.175996065 CET	443	49875	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.182049990 CET	443	49876	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.182322025 CET	49876	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.182353973 CET	443	49876	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.182636976 CET	49876	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.182641983 CET	443	49876	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.200776100 CET	443	49877	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.201093912 CET	49877	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.201106071 CET	443	49877	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.201416969 CET	49877	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.201421022 CET	443	49877	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.261215925 CET	443	49878	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.261673927 CET	49878	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.261689901 CET	443	49878	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.262152910 CET	49878	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.262157917 CET	443	49878	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.465218067 CET	443	49874	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.465291977 CET	443	49874	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.465354919 CET	49874	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.465545893 CET	49874	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.465568066 CET	443	49874	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.465576887 CET	49874	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.465583086 CET	443	49874	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.468059063 CET	49879	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.468096018 CET	443	49879	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.468173027 CET	49879	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.468302965 CET	49879	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.468314886 CET	443	49879	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.611964941 CET	443	49875	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.612035036 CET	443	49875	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.612330914 CET	49875	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.612360001 CET	49875	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.612381935 CET	443	49875	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.612396002 CET	49875	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.612401009 CET	443	49875	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.615092039 CET	49880	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.615144968 CET	443	49880	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.615232944 CET	49880	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.615387917 CET	49880	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.615400076 CET	443	49880	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.625493050 CET	443	49876	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.625557899 CET	443	49876	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.625703096 CET	49876	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.625731945 CET	49876	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.625746965 CET	443	49876	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.625756979 CET	49876	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.625761032 CET	443	49876	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.628000021 CET	49881	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.628043890 CET	443	49881	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.628127098 CET	49881	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.628248930 CET	49881	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.628264904 CET	443	49881	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.637075901 CET	443	49877	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.637140989 CET	443	49877	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.637253046 CET	49877	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.637271881 CET	49877	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.637286901 CET	443	49877	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.637295961 CET	49877	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.637300968 CET	443	49877	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.639379978 CET	49882	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.639420033 CET	443	49882	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.639513016 CET	49882	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.639657021 CET	49882	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.639669895 CET	443	49882	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.699261904 CET	443	49878	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.699342966 CET	443	49878	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.699708939 CET	49878	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.699708939 CET	49878	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.699708939 CET	49878	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.702363014 CET	49883	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.702408075 CET	443	49883	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:10.702476025 CET	49883	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.702605009 CET	49883	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:10.702617884 CET	443	49883	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:11.012556076 CET	49878	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:11.012593985 CET	443	49878	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.186323881 CET	443	49879	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.186794043 CET	49879	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.186816931 CET	443	49879	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.187257051 CET	49879	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.187262058 CET	443	49879	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.355098009 CET	443	49881	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.356762886 CET	49881	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.356786013 CET	443	49881	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.357192039 CET	49881	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.357197046 CET	443	49881	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.357637882 CET	443	49880	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.358021975 CET	49880	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.358050108 CET	443	49880	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.358532906 CET	49880	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.358541965 CET	443	49880	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.389039993 CET	443	49882	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.391827106 CET	49882	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.391850948 CET	443	49882	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.395483017 CET	49882	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.395492077 CET	443	49882	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.421236038 CET	443	49883	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.421605110 CET	49883	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.421622992 CET	443	49883	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.422075033 CET	49883	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.422077894 CET	443	49883	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.622234106 CET	443	49879	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.622323036 CET	443	49879	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.622627974 CET	49879	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.622658968 CET	49879	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.622678041 CET	443	49879	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.622694969 CET	49879	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.622700930 CET	443	49879	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.625344038 CET	49884	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.625380039 CET	443	49884	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.625451088 CET	49884	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.625580072 CET	49884	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.625597954 CET	443	49884	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.794579029 CET	443	49880	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.794641018 CET	443	49880	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.794754028 CET	49880	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.794964075 CET	49880	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.794991970 CET	443	49880	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.795006037 CET	49880	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.795011044 CET	443	49880	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.795954943 CET	443	49881	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.796019077 CET	443	49881	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.796087027 CET	49881	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.796200037 CET	49881	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.796215057 CET	443	49881	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.796230078 CET	49881	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.796235085 CET	443	49881	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.797774076 CET	49885	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.797801971 CET	443	49885	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.797995090 CET	49886	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.798018932 CET	443	49886	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.798032045 CET	49885	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.798075914 CET	49886	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.798182964 CET	49885	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.798196077 CET	443	49885	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.798207045 CET	49886	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.798219919 CET	443	49886	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.825109959 CET	443	49882	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.825165987 CET	443	49882	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.825246096 CET	49882	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.825335979 CET	49882	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.825350046 CET	443	49882	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.825383902 CET	49882	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.825387955 CET	443	49882	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.827231884 CET	49887	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.827246904 CET	443	49887	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.827327013 CET	49887	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.827439070 CET	49887	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.827450991 CET	443	49887	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.857002974 CET	443	49883	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.857062101 CET	443	49883	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.857131004 CET	49883	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.876312971 CET	49883	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.876324892 CET	443	49883	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.876348972 CET	49883	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.876353025 CET	443	49883	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.883311033 CET	49888	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.883344889 CET	443	49888	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:12.883527994 CET	49888	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.883709908 CET	49888	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:12.883728981 CET	443	49888	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.357224941 CET	443	49884	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.357697010 CET	49884	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.357724905 CET	443	49884	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.358139992 CET	49884	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.358150005 CET	443	49884	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.520049095 CET	443	49886	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.520055056 CET	443	49885	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.520592928 CET	49886	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.520592928 CET	49885	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.520613909 CET	443	49885	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.520622015 CET	443	49886	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.521050930 CET	49886	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.521056890 CET	443	49886	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.521152020 CET	49885	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.521159887 CET	443	49885	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.552959919 CET	443	49887	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.553370953 CET	49887	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.553406954 CET	443	49887	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.553787947 CET	49887	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.553793907 CET	443	49887	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.601172924 CET	443	49888	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.601567030 CET	49888	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.601597071 CET	443	49888	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.601928949 CET	49888	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.601933956 CET	443	49888	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.793356895 CET	443	49884	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.793430090 CET	443	49884	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.793488979 CET	49884	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.793684959 CET	49884	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.793708086 CET	443	49884	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.793719053 CET	49884	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.793724060 CET	443	49884	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.796643019 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.796678066 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.796767950 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.796919107 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.796928883 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.966070890 CET	443	49886	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.966137886 CET	443	49886	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.966196060 CET	49886	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.966387033 CET	49886	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.966418982 CET	443	49886	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.966432095 CET	49886	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.966437101 CET	443	49886	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.966475964 CET	443	49885	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.966547966 CET	443	49885	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.966602087 CET	49885	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.966664076 CET	49885	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.966665030 CET	49885	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.966681004 CET	443	49885	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.966689110 CET	443	49885	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.969708920 CET	49890	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.969753981 CET	443	49890	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.969768047 CET	49891	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.969813108 CET	443	49891	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.969827890 CET	49890	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.969865084 CET	49891	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.970005989 CET	49891	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.970009089 CET	49890	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.970021009 CET	443	49891	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.970026016 CET	443	49890	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.988078117 CET	443	49887	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.988147020 CET	443	49887	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.988193035 CET	49887	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.988295078 CET	49887	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.988295078 CET	49887	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.988306046 CET	443	49887	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.988312960 CET	443	49887	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.990452051 CET	49892	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.990504980 CET	443	49892	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:14.990585089 CET	49892	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.990717888 CET	49892	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:14.990731955 CET	443	49892	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:15.040126085 CET	443	49888	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:15.040188074 CET	443	49888	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:15.040241957 CET	49888	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:15.040374041 CET	49888	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:15.040395021 CET	443	49888	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:15.040406942 CET	49888	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:15.040411949 CET	443	49888	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:15.042927980 CET	49893	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:15.042962074 CET	443	49893	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:15.043011904 CET	49893	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:15.043250084 CET	49893	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:15.043262005 CET	443	49893	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.531811953 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.532325983 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.532341003 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.532736063 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.532740116 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.687818050 CET	443	49890	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.688536882 CET	443	49891	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.688961029 CET	49890	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.688983917 CET	443	49890	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.689400911 CET	49890	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.689405918 CET	443	49890	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.689593077 CET	49891	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.689606905 CET	443	49891	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.689940929 CET	49891	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.689944983 CET	443	49891	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.718765020 CET	443	49892	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.719561100 CET	49892	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.719595909 CET	443	49892	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.720103979 CET	49892	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.720112085 CET	443	49892	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.768086910 CET	443	49893	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.768704891 CET	49893	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.768733978 CET	443	49893	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.769167900 CET	49893	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.769171953 CET	443	49893	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.966778040 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.966850996 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.966917992 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.967117071 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.967137098 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.967147112 CET	49889	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.967152119 CET	443	49889	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.969676971 CET	49895	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.969712973 CET	443	49895	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:16.969780922 CET	49895	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.969908953 CET	49895	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:16.969923973 CET	443	49895	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.124058962 CET	443	49890	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.124138117 CET	443	49890	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.124269009 CET	49890	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.124352932 CET	443	49891	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.124429941 CET	443	49891	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.124495983 CET	49890	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.124516964 CET	443	49890	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.124519110 CET	49891	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.124536037 CET	49890	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.124541998 CET	443	49890	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.125631094 CET	49891	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.125643969 CET	443	49891	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.125669956 CET	49891	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.125674009 CET	443	49891	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.128020048 CET	49896	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.128057957 CET	443	49896	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.128127098 CET	49896	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.128470898 CET	49896	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.128482103 CET	443	49896	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.129050970 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.129091024 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.129154921 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.129251003 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.129260063 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.162239075 CET	443	49892	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.162301064 CET	443	49892	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.162384987 CET	49892	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.162527084 CET	49892	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.162543058 CET	443	49892	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.162553072 CET	49892	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.162556887 CET	443	49892	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.164522886 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.164550066 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.164613962 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.164722919 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.164731979 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.202846050 CET	443	49893	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.202927113 CET	443	49893	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.202976942 CET	49893	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.203178883 CET	49893	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.203197002 CET	443	49893	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.203208923 CET	49893	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.203213930 CET	443	49893	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.206856012 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.206887960 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:17.206953049 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.207087040 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:17.207097054 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.700649977 CET	443	49895	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.701241016 CET	49895	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:18.701256037 CET	443	49895	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.701770067 CET	49895	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:18.701776028 CET	443	49895	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.848648071 CET	443	49896	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.849173069 CET	49896	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:18.849220991 CET	443	49896	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.849622965 CET	49896	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:18.849631071 CET	443	49896	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.890290022 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.890734911 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:18.890791893 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.891160965 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:18.891169071 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.926964045 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.927491903 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:18.927512884 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.927932978 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:18.927937031 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.940104008 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.940660954 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:18.940685034 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:18.940920115 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:18.940923929 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.136615992 CET	443	49895	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.136735916 CET	443	49895	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.137012959 CET	49895	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.137012959 CET	49895	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.137012959 CET	49895	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.139662027 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.139713049 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.139811993 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.139976978 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.139991999 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.284317017 CET	443	49896	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.284396887 CET	443	49896	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.284446955 CET	49896	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.284576893 CET	49896	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.284598112 CET	443	49896	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.284619093 CET	49896	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.284625053 CET	443	49896	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.287141085 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.287178040 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.287265062 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.287375927 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.287393093 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.326366901 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.326432943 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.326519012 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.326698065 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.326715946 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.326726913 CET	49898	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.326731920 CET	443	49898	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.329536915 CET	49902	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.329562902 CET	443	49902	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.329638958 CET	49902	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.329763889 CET	49902	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.329773903 CET	443	49902	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.362693071 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.362756968 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.362814903 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.362984896 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.363003969 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.363013983 CET	49899	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.363019943 CET	443	49899	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.365736008 CET	49903	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.365770102 CET	443	49903	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.365860939 CET	49903	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.366020918 CET	49903	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.366038084 CET	443	49903	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.375657082 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.375722885 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.375770092 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.375883102 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.375886917 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.375915051 CET	49897	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.375919104 CET	443	49897	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.378074884 CET	49904	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.378096104 CET	443	49904	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.378173113 CET	49904	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.378305912 CET	49904	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.378315926 CET	443	49904	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:19.449858904 CET	49895	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:19.449897051 CET	443	49895	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:20.027988911 CET	49813	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:18:20.028027058 CET	443	49813	34.196.207.207	192.168.2.4
Dec 6, 2024 17:18:20.866086960 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:20.866688013 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:20.866723061 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:20.867166996 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:20.867172956 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.040169001 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.040683031 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.040709972 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.041132927 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.041137934 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.100857973 CET	443	49903	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.101460934 CET	49903	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.101488113 CET	443	49903	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.101943970 CET	49903	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.101949930 CET	443	49903	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.105098009 CET	443	49904	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.105422020 CET	49904	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.105453014 CET	443	49904	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.105758905 CET	49904	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.105763912 CET	443	49904	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.306736946 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.306811094 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.306874037 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.307113886 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.307137012 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.307151079 CET	49900	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.307156086 CET	443	49900	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.310338020 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.310384035 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.310480118 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.311981916 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.311997890 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.476471901 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.476543903 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.476613045 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.476828098 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.476850033 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.476861954 CET	49901	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.476869106 CET	443	49901	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.479836941 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.479896069 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.479981899 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.480165005 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.480179071 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.537429094 CET	443	49903	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.537503958 CET	443	49903	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.537585020 CET	49903	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.537807941 CET	49903	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.537827015 CET	443	49903	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.537836075 CET	49903	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.537841082 CET	443	49903	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.540699959 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.540750980 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.540848017 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.541008949 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.541026115 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.541285038 CET	443	49904	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.541352987 CET	443	49904	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.541412115 CET	49904	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.541497946 CET	49904	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.541511059 CET	443	49904	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.541521072 CET	49904	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.541524887 CET	443	49904	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.543546915 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.543560982 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:21.543632984 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.543842077 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:21.543854952 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.062659979 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.063220024 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.063251019 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.063807011 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.063812017 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.203937054 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.204729080 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.204761028 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.205071926 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.205077887 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.288295031 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.288924932 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.288952112 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.289222956 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.289228916 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.361704111 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.365744114 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.365792990 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.366430044 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.366436005 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.498119116 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.498184919 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.498244047 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.498462915 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.498462915 CET	49905	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.498512030 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.498539925 CET	443	49905	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.501215935 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.501264095 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.501337051 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.501462936 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.501478910 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.638490915 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.638556957 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.638632059 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.638784885 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.638806105 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.638818026 CET	49906	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.638823032 CET	443	49906	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.641496897 CET	49910	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.641531944 CET	443	49910	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.641625881 CET	49910	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.641799927 CET	49910	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.641813993 CET	443	49910	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.723026991 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.723124981 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.723184109 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.723298073 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.723323107 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.723336935 CET	49908	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.723341942 CET	443	49908	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.725764036 CET	49911	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.725812912 CET	443	49911	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.725903988 CET	49911	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.726021051 CET	49911	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.726036072 CET	443	49911	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.799525023 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.799596071 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.799664021 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.799875975 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.799890995 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.799901009 CET	49907	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.799906015 CET	443	49907	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.802778959 CET	49912	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.802825928 CET	443	49912	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:23.802911997 CET	49912	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.803086042 CET	49912	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:23.803100109 CET	443	49912	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.201657057 CET	443	49902	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.202280998 CET	49902	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.202320099 CET	443	49902	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.202724934 CET	49902	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.202732086 CET	443	49902	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.218172073 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.218502998 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.218513966 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.218877077 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.218883991 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.258255005 CET	443	49911	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.258630991 CET	49911	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.258645058 CET	443	49911	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.258956909 CET	49911	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.258964062 CET	443	49911	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.364072084 CET	443	49910	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.364598036 CET	49910	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.364629030 CET	443	49910	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.365087986 CET	49910	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.365092039 CET	443	49910	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.520643950 CET	443	49912	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.521195889 CET	49912	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.521217108 CET	443	49912	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.521682024 CET	49912	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.521687031 CET	443	49912	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.636461020 CET	443	49902	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.636528969 CET	443	49902	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.636594057 CET	49902	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.636806011 CET	49902	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.636828899 CET	443	49902	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.636842012 CET	49902	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.636847973 CET	443	49902	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.639754057 CET	49913	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.639799118 CET	443	49913	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.639867067 CET	49913	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.640006065 CET	49913	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.640017986 CET	443	49913	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.652353048 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.652412891 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.652468920 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.652657032 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.652673006 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.652683973 CET	49909	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.652688980 CET	443	49909	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.655714035 CET	49914	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.655747890 CET	443	49914	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.655805111 CET	49914	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.655980110 CET	49914	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.655992031 CET	443	49914	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.696125984 CET	443	49911	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.696192026 CET	443	49911	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.696242094 CET	49911	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.696363926 CET	49911	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.696376085 CET	443	49911	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.696386099 CET	49911	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.696388960 CET	443	49911	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.699103117 CET	49915	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.699139118 CET	443	49915	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.699198961 CET	49915	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.699362993 CET	49915	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.699378014 CET	443	49915	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.815062046 CET	443	49910	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.815089941 CET	443	49910	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.815145016 CET	443	49910	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.815172911 CET	49910	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.815227985 CET	49910	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.815469027 CET	49910	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.815488100 CET	443	49910	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.815499067 CET	49910	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.815502882 CET	443	49910	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.818382978 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.818435907 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.818514109 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.818684101 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.818700075 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.955223083 CET	443	49912	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.955290079 CET	443	49912	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.955344915 CET	49912	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.955523968 CET	49912	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.955542088 CET	443	49912	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.955553055 CET	49912	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.955564022 CET	443	49912	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.958547115 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.958599091 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:25.958690882 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.958868027 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:25.958883047 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.359271049 CET	443	49913	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.359774113 CET	49913	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.359811068 CET	443	49913	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.360239029 CET	49913	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.360244036 CET	443	49913	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.383825064 CET	443	49914	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.384275913 CET	49914	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.384294987 CET	443	49914	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.384731054 CET	49914	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.384735107 CET	443	49914	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.414848089 CET	443	49915	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.415240049 CET	49915	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.415265083 CET	443	49915	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.415672064 CET	49915	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.415676117 CET	443	49915	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.552366972 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.552937031 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.552961111 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.553405046 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.553411007 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.678858042 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.679328918 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.679358006 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.679781914 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.679785967 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.793900013 CET	443	49913	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.793926954 CET	443	49913	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.794003010 CET	49913	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.794032097 CET	443	49913	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.794267893 CET	49913	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.794279099 CET	443	49913	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.794291973 CET	49913	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.794431925 CET	443	49913	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.794466019 CET	443	49913	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.794500113 CET	49913	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.797053099 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.797080040 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.797139883 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.797281027 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.797290087 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.855274916 CET	443	49915	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.855304003 CET	443	49915	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.855453014 CET	49915	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.855484009 CET	443	49915	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.855726957 CET	49915	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.855740070 CET	443	49915	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.855750084 CET	49915	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.856317043 CET	443	49915	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.856353045 CET	443	49915	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.856396914 CET	49915	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.858180046 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.858228922 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.858303070 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.858432055 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.858445883 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.989681005 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.993525028 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.993613005 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.993644953 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.993663073 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.993675947 CET	49916	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.993686914 CET	443	49916	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.996712923 CET	49921	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.996752024 CET	443	49921	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:27.996820927 CET	49921	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.996959925 CET	49921	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:27.996973038 CET	443	49921	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.024631977 CET	443	49914	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.024652958 CET	443	49914	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.024730921 CET	49914	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.024743080 CET	443	49914	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.024821997 CET	49914	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.024983883 CET	49914	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.024996042 CET	443	49914	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.025011063 CET	49914	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.025193930 CET	443	49914	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.025224924 CET	443	49914	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.025279045 CET	49914	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.027251005 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.027280092 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.027360916 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.027463913 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.027475119 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.117449999 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.120842934 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.120913982 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.120959044 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.120984077 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.121002913 CET	49917	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.121010065 CET	443	49917	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.123873949 CET	49923	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.123965025 CET	443	49923	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:28.124056101 CET	49923	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.124183893 CET	49923	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:28.124219894 CET	443	49923	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.519242048 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.519788027 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.519817114 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.520253897 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.520260096 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.599881887 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.600393057 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.600421906 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.600851059 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.600857019 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.713834047 CET	443	49921	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.714335918 CET	49921	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.714370012 CET	443	49921	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.714827061 CET	49921	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.714831114 CET	443	49921	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.745484114 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.745886087 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.745913029 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.746305943 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.746310949 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.763277054 CET	443	49813	34.196.207.207	192.168.2.4
Dec 6, 2024 17:18:29.763365984 CET	443	49813	34.196.207.207	192.168.2.4
Dec 6, 2024 17:18:29.763433933 CET	49813	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:18:29.826623917 CET	49813	443	192.168.2.4	34.196.207.207
Dec 6, 2024 17:18:29.826642036 CET	443	49813	34.196.207.207	192.168.2.4
Dec 6, 2024 17:18:29.839864016 CET	443	49923	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.840456009 CET	49923	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.840468884 CET	443	49923	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.841022968 CET	49923	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.841027975 CET	443	49923	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.955840111 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.967380047 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.967462063 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.967544079 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.967554092 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.967562914 CET	49919	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.967567921 CET	443	49919	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.970335007 CET	49924	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.970361948 CET	443	49924	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:29.970443010 CET	49924	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.970576048 CET	49924	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:29.970591068 CET	443	49924	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.042516947 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.042573929 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.042726994 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.042964935 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.042982101 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.042993069 CET	49920	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.042999029 CET	443	49920	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.045962095 CET	49925	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.045985937 CET	443	49925	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.046072006 CET	49925	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.046240091 CET	49925	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.046252012 CET	443	49925	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.148749113 CET	443	49921	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.152558088 CET	443	49921	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.152625084 CET	49921	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.152693033 CET	49921	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.152705908 CET	443	49921	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.152718067 CET	49921	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.152721882 CET	443	49921	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.155138969 CET	49926	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.155165911 CET	443	49926	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.155253887 CET	49926	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.155406952 CET	49926	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.155420065 CET	443	49926	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.199807882 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.199897051 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.199964046 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.200210094 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.200227976 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.200241089 CET	49922	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.200246096 CET	443	49922	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.202986002 CET	49927	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.203005075 CET	443	49927	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.203094959 CET	49927	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.203277111 CET	49927	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.203290939 CET	443	49927	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.297314882 CET	443	49923	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.297382116 CET	443	49923	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.297435999 CET	49923	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.297600031 CET	49923	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.297605038 CET	443	49923	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.297616959 CET	49923	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.297620058 CET	443	49923	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.300519943 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.300549030 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:30.300616980 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.300765038 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:30.300776005 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.714720011 CET	443	49924	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.715591908 CET	49924	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:31.715615988 CET	443	49924	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.716064930 CET	49924	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:31.716070890 CET	443	49924	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.772397995 CET	443	49925	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.772953033 CET	49925	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:31.772973061 CET	443	49925	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.773406029 CET	49925	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:31.773411036 CET	443	49925	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.877530098 CET	443	49926	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.878127098 CET	49926	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:31.878142118 CET	443	49926	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.878489017 CET	49926	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:31.878493071 CET	443	49926	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.930365086 CET	443	49927	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.931693077 CET	49927	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:31.931724072 CET	443	49927	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.932135105 CET	49927	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:31.932140112 CET	443	49927	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:31.997936964 CET	49929	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:18:31.997984886 CET	443	49929	142.250.181.68	192.168.2.4
Dec 6, 2024 17:18:31.998096943 CET	49929	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:18:31.998317003 CET	49929	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:18:31.998334885 CET	443	49929	142.250.181.68	192.168.2.4
Dec 6, 2024 17:18:32.030570984 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.031490088 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.031503916 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.031959057 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.031965017 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.149034977 CET	443	49924	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.152296066 CET	443	49924	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.152390003 CET	49924	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.152600050 CET	49924	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.152601004 CET	49924	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.152612925 CET	443	49924	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.152621031 CET	443	49924	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.155297041 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.155332088 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.155411005 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.155576944 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.155585051 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.207062960 CET	443	49925	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.210623980 CET	443	49925	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.210696936 CET	49925	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.210747957 CET	49925	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.210757971 CET	443	49925	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.210769892 CET	49925	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.210774899 CET	443	49925	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.213015079 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.213044882 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.213128090 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.213263035 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.213277102 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.316421986 CET	443	49926	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.319910049 CET	443	49926	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.319983006 CET	49926	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.331698895 CET	49926	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.331707001 CET	443	49926	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.331717014 CET	49926	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.331722021 CET	443	49926	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.334327936 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.334377050 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.334439993 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.334573030 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.334587097 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.364729881 CET	443	49927	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.368596077 CET	443	49927	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.368664026 CET	49927	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.368664980 CET	443	49927	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.368710041 CET	49927	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.368752003 CET	49927	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.368760109 CET	443	49927	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.368771076 CET	49927	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.368774891 CET	443	49927	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.370946884 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.370974064 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:32.371040106 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.371155024 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:32.371170044 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:33.691520929 CET	443	49929	142.250.181.68	192.168.2.4
Dec 6, 2024 17:18:33.691864967 CET	49929	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:18:33.691891909 CET	443	49929	142.250.181.68	192.168.2.4
Dec 6, 2024 17:18:33.692176104 CET	443	49929	142.250.181.68	192.168.2.4
Dec 6, 2024 17:18:33.692451954 CET	49929	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:18:33.692509890 CET	443	49929	142.250.181.68	192.168.2.4
Dec 6, 2024 17:18:33.746747971 CET	49929	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:18:33.873209953 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:33.873791933 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:33.873806000 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:33.874239922 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:33.874244928 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.056193113 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.056788921 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.056804895 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.057351112 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.057357073 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.086982012 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.087528944 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.087554932 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.088084936 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.088090897 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.309133053 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.309498072 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.309546947 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.309555054 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.309575081 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.309619904 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.309663057 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.309674978 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.309684992 CET	49930	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.309689999 CET	443	49930	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.312387943 CET	49934	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.312424898 CET	443	49934	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.312510014 CET	49934	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.312661886 CET	49934	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.312674999 CET	443	49934	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.494029045 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.497308969 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.497370005 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.497445107 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.497459888 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.497483969 CET	49932	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.497489929 CET	443	49932	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.500180960 CET	49935	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.500216961 CET	443	49935	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.500282049 CET	49935	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.500448942 CET	49935	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.500462055 CET	443	49935	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.523597956 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.526714087 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.526782990 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.526815891 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.526824951 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.526837111 CET	49933	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.526840925 CET	443	49933	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.529052019 CET	49936	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.529081106 CET	443	49936	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:34.529156923 CET	49936	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.529303074 CET	49936	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:34.529318094 CET	443	49936	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:35.293193102 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:35.296252966 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:35.296312094 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:35.296355963 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:35.296374083 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:35.296386003 CET	49928	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:35.296391010 CET	443	49928	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:35.299071074 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:35.299092054 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:35.299154997 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:35.299285889 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:35.299297094 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:35.921294928 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:35.921802998 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:35.921830893 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:35.922269106 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:35.922276974 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.039433002 CET	443	49934	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.039941072 CET	49934	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.039953947 CET	443	49934	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.040388107 CET	49934	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.040394068 CET	443	49934	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.249277115 CET	443	49935	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.249766111 CET	49935	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.249789000 CET	443	49935	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.250226021 CET	49935	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.250230074 CET	443	49935	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.272440910 CET	443	49936	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.272828102 CET	49936	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.272845030 CET	443	49936	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.273192883 CET	49936	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.273197889 CET	443	49936	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.359982014 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.363137007 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.363193035 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.363224983 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.363235950 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.363246918 CET	49931	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.363251925 CET	443	49931	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.365905046 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.365925074 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.365993023 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.366117954 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.366137028 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.473146915 CET	443	49934	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.477199078 CET	443	49934	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.477256060 CET	443	49934	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.477262974 CET	49934	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.477313995 CET	49934	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.477364063 CET	49934	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.477384090 CET	443	49934	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.477396011 CET	49934	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.477401972 CET	443	49934	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.480149031 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.480179071 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.480247974 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.480385065 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.480392933 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.688973904 CET	443	49935	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.689050913 CET	443	49935	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.689106941 CET	49935	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.689259052 CET	49935	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.689271927 CET	443	49935	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.689280987 CET	49935	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.689285994 CET	443	49935	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.692512035 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.692527056 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.692594051 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.692734957 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.692745924 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.707108021 CET	443	49936	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.710560083 CET	443	49936	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.710613966 CET	49936	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.710680962 CET	49936	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.710690975 CET	443	49936	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.713840008 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.713890076 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:36.713948965 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.714101076 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:36.714113951 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:37.185893059 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:37.186450005 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:37.186465979 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:37.186919928 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:37.186924934 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:37.720180988 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:37.720277071 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:37.720336914 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:37.720472097 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:37.720494032 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:37.720515013 CET	49937	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:37.720523119 CET	443	49937	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:37.723293066 CET	49942	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:37.723332882 CET	443	49942	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:37.723423958 CET	49942	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:37.723613977 CET	49942	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:37.723628044 CET	443	49942	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.275398016 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.276187897 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.276211977 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.276645899 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.276652098 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.299626112 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.300502062 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.300515890 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.301666975 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.301672935 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.491288900 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.491363049 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.491766930 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.491792917 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.492192984 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.492197990 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.492402077 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.492428064 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.492768049 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.492772102 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.712910891 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.718393087 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.718445063 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.718446016 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.718497038 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.718560934 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.718574047 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.718585968 CET	49938	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.718591928 CET	443	49938	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.721242905 CET	49943	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.721278906 CET	443	49943	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.721354961 CET	49943	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.721472025 CET	49943	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.721487045 CET	443	49943	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.735913992 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.739171028 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.739223003 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.739276886 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.739290953 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.739305019 CET	49939	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.739310026 CET	443	49939	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.741271973 CET	49944	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.741296053 CET	443	49944	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.741359949 CET	49944	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.741472006 CET	49944	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.741489887 CET	443	49944	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.926460981 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.929748058 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.929753065 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.929786921 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.929812908 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.929860115 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.929909945 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.929924011 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.929938078 CET	49940	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.929948092 CET	443	49940	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.932192087 CET	49945	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.932231903 CET	443	49945	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.932313919 CET	49945	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.932454109 CET	49945	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.932466984 CET	443	49945	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.932894945 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.932948112 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.932970047 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.932984114 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.932991982 CET	49941	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.932995081 CET	443	49941	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.934775114 CET	49946	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.934788942 CET	443	49946	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:38.934840918 CET	49946	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.934973955 CET	49946	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:38.934986115 CET	443	49946	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:39.443700075 CET	443	49942	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:39.444297075 CET	49942	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:39.444336891 CET	443	49942	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:39.444761992 CET	49942	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:39.444766998 CET	443	49942	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:39.878990889 CET	443	49942	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:39.882040024 CET	443	49942	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:39.882126093 CET	49942	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:39.882183075 CET	49942	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:39.882205009 CET	443	49942	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:39.882215977 CET	49942	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:39.882221937 CET	443	49942	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:39.884767056 CET	49947	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:39.884805918 CET	443	49947	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:39.884875059 CET	49947	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:39.885015965 CET	49947	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:39.885032892 CET	443	49947	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.473637104 CET	443	49943	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.474181890 CET	49943	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.474210978 CET	443	49943	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.474639893 CET	49943	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.474644899 CET	443	49943	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.484528065 CET	443	49944	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.484849930 CET	49944	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.484884977 CET	443	49944	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.485165119 CET	49944	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.485169888 CET	443	49944	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.681556940 CET	443	49945	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.681978941 CET	49945	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.682008028 CET	443	49945	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.682414055 CET	49945	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.682420015 CET	443	49945	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.714493990 CET	443	49946	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.714987040 CET	49946	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.715022087 CET	443	49946	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.715544939 CET	49946	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.715549946 CET	443	49946	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.908674002 CET	443	49943	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.911932945 CET	443	49943	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.912013054 CET	49943	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.912051916 CET	49943	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.912051916 CET	49943	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.912072897 CET	443	49943	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.912084103 CET	443	49943	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.914623022 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.914681911 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.914758921 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.914891005 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.914906979 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.918742895 CET	443	49944	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.922262907 CET	443	49944	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.922310114 CET	443	49944	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.922343969 CET	49944	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.922389984 CET	49944	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.925343990 CET	49944	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.925343990 CET	49944	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.925371885 CET	443	49944	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.925384998 CET	443	49944	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.927938938 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.927973986 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:40.928050995 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.928157091 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:40.928169966 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.116131067 CET	443	49945	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.116244078 CET	443	49945	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.116305113 CET	49945	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.116403103 CET	49945	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.116416931 CET	443	49945	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.116426945 CET	49945	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.116431952 CET	443	49945	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.120594025 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.120642900 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.120712996 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.120851040 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.120870113 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.149393082 CET	443	49946	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.153289080 CET	443	49946	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.153371096 CET	49946	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.153455973 CET	49946	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.153474092 CET	443	49946	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.153485060 CET	49946	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.153490067 CET	443	49946	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.157970905 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.157999992 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.158082962 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.158216953 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.158231974 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.617566109 CET	443	49947	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.618053913 CET	49947	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.618072033 CET	443	49947	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:41.618515015 CET	49947	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:41.618520021 CET	443	49947	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.051842928 CET	443	49947	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.055609941 CET	443	49947	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.055763960 CET	49947	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.055859089 CET	49947	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.055875063 CET	443	49947	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.055901051 CET	49947	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.055906057 CET	443	49947	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.058756113 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.058795929 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.058865070 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.058991909 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.059007883 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.650091887 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.650681019 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.650707960 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.651304007 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.651309013 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.659527063 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.659836054 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.659857035 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.660293102 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.660299063 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.871067047 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.871680975 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.871711016 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.872226954 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.872236013 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.877199888 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.877511024 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.877535105 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:42.878072977 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:42.878078938 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.085550070 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.089441061 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.089489937 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.089488029 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.089534044 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.089579105 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.089601994 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.089621067 CET	49948	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.089627028 CET	443	49948	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.092720032 CET	49953	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.092766047 CET	443	49953	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.092829943 CET	49953	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.092972040 CET	49953	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.092984915 CET	443	49953	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.096986055 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.100102901 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.100162983 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.100214958 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.100214958 CET	49949	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.100235939 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.100250006 CET	443	49949	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.102679014 CET	49954	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.102722883 CET	443	49954	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.102792025 CET	49954	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.102932930 CET	49954	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.102948904 CET	443	49954	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.306704998 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.309808016 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.309876919 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.309937954 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.309962034 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.309977055 CET	49950	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.309983969 CET	443	49950	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.310918093 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.312551975 CET	49955	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.312606096 CET	443	49955	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.312676907 CET	49955	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.312839985 CET	49955	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.312856913 CET	443	49955	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.314750910 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.314804077 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.314848900 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.314848900 CET	49951	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.314868927 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.314879894 CET	443	49951	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.317209959 CET	49956	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.317260981 CET	443	49956	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.317372084 CET	49956	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.317507982 CET	49956	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.317524910 CET	443	49956	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.397614002 CET	443	49929	142.250.181.68	192.168.2.4
Dec 6, 2024 17:18:43.397695065 CET	443	49929	142.250.181.68	192.168.2.4
Dec 6, 2024 17:18:43.397763014 CET	49929	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:18:43.776412964 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.776918888 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.776957989 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.777546883 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:43.777551889 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:43.826699972 CET	49929	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:18:43.826735973 CET	443	49929	142.250.181.68	192.168.2.4
Dec 6, 2024 17:18:44.217658043 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:44.220943928 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:44.220995903 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:44.221007109 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:44.221041918 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:44.221767902 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:44.221781969 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:44.221800089 CET	49952	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:44.221805096 CET	443	49952	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:44.237024069 CET	49957	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:44.237077951 CET	443	49957	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:44.237137079 CET	49957	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:44.237557888 CET	49957	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:44.237569094 CET	443	49957	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:44.844106913 CET	443	49954	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:44.844325066 CET	443	49953	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:44.844618082 CET	49954	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:44.844641924 CET	443	49954	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:44.845191002 CET	49954	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:44.845196962 CET	443	49954	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:44.845464945 CET	49953	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:44.845483065 CET	443	49953	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:44.845936060 CET	49953	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:44.845942974 CET	443	49953	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.028789997 CET	443	49955	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.029249907 CET	49955	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.029264927 CET	443	49955	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.029691935 CET	49955	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.029696941 CET	443	49955	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.034871101 CET	443	49956	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.036060095 CET	49956	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.036096096 CET	443	49956	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.036514997 CET	49956	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.036520004 CET	443	49956	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.282516956 CET	443	49953	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.286396027 CET	443	49953	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.286480904 CET	49953	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.286509991 CET	49953	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.286530972 CET	443	49953	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.286540985 CET	49953	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.286545992 CET	443	49953	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.289568901 CET	49958	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.289623976 CET	443	49958	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.289700031 CET	49958	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.289838076 CET	49958	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.289855957 CET	443	49958	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.299102068 CET	443	49954	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.299169064 CET	443	49954	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.299231052 CET	49954	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.299429893 CET	49954	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.299453020 CET	443	49954	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.299464941 CET	49954	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.299470901 CET	443	49954	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.302155972 CET	49959	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.302201986 CET	443	49959	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.302273989 CET	49959	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.302417040 CET	49959	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.302428961 CET	443	49959	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.470818996 CET	443	49955	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.470909119 CET	443	49955	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.470967054 CET	49955	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.471159935 CET	49955	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.471175909 CET	443	49955	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.471188068 CET	49955	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.471193075 CET	443	49955	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.474493980 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.474548101 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.474638939 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.474808931 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.474807024 CET	443	49956	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.474819899 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.478667974 CET	443	49956	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.478718996 CET	443	49956	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.478719950 CET	49956	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.478760004 CET	49956	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.478804111 CET	49956	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.478822947 CET	443	49956	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.478836060 CET	49956	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.478841066 CET	443	49956	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.481197119 CET	49961	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.481239080 CET	443	49961	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.481314898 CET	49961	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.481457949 CET	49961	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.481472015 CET	443	49961	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.955636024 CET	443	49957	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.956089020 CET	49957	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.956108093 CET	443	49957	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:45.956556082 CET	49957	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:45.956559896 CET	443	49957	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:46.396775961 CET	443	49957	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:46.400002956 CET	443	49957	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:46.400115013 CET	49957	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:46.400156975 CET	49957	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:46.400172949 CET	443	49957	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:46.400209904 CET	49957	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:46.400216103 CET	443	49957	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:46.403698921 CET	49962	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:46.403769970 CET	443	49962	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:46.403853893 CET	49962	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:46.404031992 CET	49962	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:46.404052973 CET	443	49962	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.016422033 CET	443	49959	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.017203093 CET	49959	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.017230034 CET	443	49959	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.018358946 CET	443	49958	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.018522024 CET	49959	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.018527985 CET	443	49959	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.018774033 CET	49958	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.018804073 CET	443	49958	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.019948959 CET	49958	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.019956112 CET	443	49958	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.196614981 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.197313070 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.197340965 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.198661089 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.198664904 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.201217890 CET	443	49961	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.201587915 CET	49961	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.201620102 CET	443	49961	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.202701092 CET	49961	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.202706099 CET	443	49961	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.456379890 CET	443	49958	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.457031012 CET	443	49959	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.459916115 CET	443	49958	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.459961891 CET	443	49958	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.459985018 CET	443	49959	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.459991932 CET	49958	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.460027933 CET	49958	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.460062981 CET	49959	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.460103035 CET	49958	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.460124969 CET	443	49958	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.460136890 CET	49958	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.460144043 CET	443	49958	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.461240053 CET	49959	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.461260080 CET	443	49959	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.461272001 CET	49959	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.461277962 CET	443	49959	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.468856096 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.468899965 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.468971014 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.469022989 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.469072104 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.469120026 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.469131947 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.469141006 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.469475031 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.469490051 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.632370949 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.635890007 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.635952950 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.635970116 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.636015892 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.636061907 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.636081934 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.636105061 CET	49960	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.636110067 CET	443	49960	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.637190104 CET	443	49961	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.640074968 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.640120983 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.640189886 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.640320063 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.640336990 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.643764973 CET	443	49961	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.643825054 CET	49961	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.643852949 CET	49961	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.643868923 CET	443	49961	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.643901110 CET	49961	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.643906116 CET	443	49961	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.647769928 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.647809982 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:47.647881985 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.647990942 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:47.648009062 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:48.127928019 CET	443	49962	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:48.128400087 CET	49962	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:48.128441095 CET	443	49962	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:48.128778934 CET	49962	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:48.128784895 CET	443	49962	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:48.567466021 CET	443	49962	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:48.570599079 CET	443	49962	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:48.570651054 CET	443	49962	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:48.570681095 CET	49962	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:48.570718050 CET	49962	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:48.570774078 CET	49962	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:48.570801973 CET	443	49962	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:48.570816994 CET	49962	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:48.570822954 CET	443	49962	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:48.573479891 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:48.573542118 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:48.573607922 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:48.573765039 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:48.573779106 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.185055017 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.185612917 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.185659885 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.186072111 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.186078072 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.188539028 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.188800097 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.188810110 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.189115047 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.189129114 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.191593885 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.191838026 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.191860914 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.192152023 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.192156076 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.376076937 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.376643896 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.376688957 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.377197981 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.377202988 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.622528076 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.625771999 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.626208067 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.626276016 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.626322031 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.626347065 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.626358986 CET	49966	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.626365900 CET	443	49966	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.629338980 CET	49968	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.629383087 CET	443	49968	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.629657030 CET	49968	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.629657030 CET	49968	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.629689932 CET	443	49968	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.630578995 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.630637884 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.630667925 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.630672932 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.630697012 CET	49964	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.630701065 CET	443	49964	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.632636070 CET	49969	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.632687092 CET	443	49969	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.632765055 CET	49969	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.632821083 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.632920027 CET	49969	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.632939100 CET	443	49969	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.636014938 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.636061907 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.636074066 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.636085033 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.636137009 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.636173964 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.636182070 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.636212111 CET	49963	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.636217117 CET	443	49963	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.638106108 CET	49970	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.638118029 CET	443	49970	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.638180017 CET	49970	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.638293982 CET	49970	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.638300896 CET	443	49970	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.812622070 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.812714100 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.812779903 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.813237906 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.813262939 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.813277960 CET	49965	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.813285112 CET	443	49965	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.816025019 CET	49971	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.816067934 CET	443	49971	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:49.816149950 CET	49971	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.816277981 CET	49971	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:49.816292048 CET	443	49971	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:50.291583061 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:50.292356014 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:50.292401075 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:50.292872906 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:50.292879105 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:50.728442907 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:50.731445074 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:50.731515884 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:50.731561899 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:50.731561899 CET	49967	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:50.731581926 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:50.731590986 CET	443	49967	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:50.734180927 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:50.734210014 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:50.734301090 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:50.734455109 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:50.734467983 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.358532906 CET	443	49969	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.359014988 CET	49969	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.359052896 CET	443	49969	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.359442949 CET	49969	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.359450102 CET	443	49969	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.368635893 CET	443	49970	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.368885040 CET	49970	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.368904114 CET	443	49970	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.369199038 CET	49970	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.369203091 CET	443	49970	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.538000107 CET	443	49971	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.538563967 CET	49971	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.538579941 CET	443	49971	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.539007902 CET	49971	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.539011002 CET	443	49971	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.794895887 CET	443	49969	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.797323942 CET	443	49969	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.797501087 CET	49969	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.797544003 CET	49969	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.797564983 CET	443	49969	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.797574043 CET	49969	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.797579050 CET	443	49969	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.799966097 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.800004005 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.800072908 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.800199986 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.800215006 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.805713892 CET	443	49970	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.809684992 CET	443	49970	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.809726954 CET	443	49970	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.809734106 CET	49970	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.809771061 CET	49970	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.809808016 CET	49970	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.809823036 CET	443	49970	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.809834957 CET	49970	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.809839010 CET	443	49970	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.811821938 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.811857939 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.811930895 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.812083960 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.812098026 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.974248886 CET	443	49971	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.974344015 CET	443	49971	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.974396944 CET	49971	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.974610090 CET	49971	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.974621058 CET	443	49971	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.974638939 CET	49971	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.974643946 CET	443	49971	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.977500916 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.977545977 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:51.977633953 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.977792025 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:51.977807045 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:52.454050064 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:52.454690933 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:52.454735994 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:52.455116034 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:52.455127001 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:52.694575071 CET	443	49968	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:52.695221901 CET	49968	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:52.695250034 CET	443	49968	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:52.695672035 CET	49968	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:52.695677996 CET	443	49968	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:52.897557020 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:52.900851965 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:52.900913000 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:52.900957108 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:52.900979042 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:52.900990009 CET	49972	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:52.900995970 CET	443	49972	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:52.903713942 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:52.903753996 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:52.903809071 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:52.903964043 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:52.903976917 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.139926910 CET	443	49968	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.143053055 CET	443	49968	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.143105984 CET	443	49968	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.143115997 CET	49968	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.143160105 CET	49968	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.143208981 CET	49968	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.143224955 CET	443	49968	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.143234968 CET	49968	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.143241882 CET	443	49968	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.147049904 CET	49977	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.147102118 CET	443	49977	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.147200108 CET	49977	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.147327900 CET	49977	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.147342920 CET	443	49977	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.535001040 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.535486937 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.535522938 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.535872936 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.535880089 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.538503885 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.538726091 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.538754940 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.538999081 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.539005995 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.693197012 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.693717003 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.693747044 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.694183111 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.694186926 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.972572088 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.974440098 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.974488020 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.974535942 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.974540949 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.974580050 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.977741003 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.977797985 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.978773117 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.978795052 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.978807926 CET	49974	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.978812933 CET	443	49974	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.980295897 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.980295897 CET	49973	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.980324030 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.980334997 CET	443	49973	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.987452030 CET	49978	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.987495899 CET	443	49978	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.987562895 CET	49978	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.987816095 CET	49978	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.987826109 CET	443	49978	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.988369942 CET	49979	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.988399982 CET	443	49979	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:53.988462925 CET	49979	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.988558054 CET	49979	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:53.988571882 CET	443	49979	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:54.127695084 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:54.127845049 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:54.127907991 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:54.127990007 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:54.128010035 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:54.128024101 CET	49975	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:54.128027916 CET	443	49975	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:54.130378962 CET	49980	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:54.130415916 CET	443	49980	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:54.130495071 CET	49980	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:54.130639076 CET	49980	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:54.130650997 CET	443	49980	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:54.638931036 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:54.639338970 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:54.639363050 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:54.639764071 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:54.639767885 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:54.871153116 CET	443	49977	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:54.871640921 CET	49977	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:54.871665955 CET	443	49977	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:54.872119904 CET	49977	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:54.872123957 CET	443	49977	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.075251102 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.078495979 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.078542948 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.078551054 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.078593969 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.078650951 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.078668118 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.078676939 CET	49976	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.078682899 CET	443	49976	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.081321955 CET	49981	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.081374884 CET	443	49981	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.081443071 CET	49981	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.081562996 CET	49981	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.081578970 CET	443	49981	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.312232018 CET	443	49977	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.312400103 CET	443	49977	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.312458992 CET	49977	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.312587976 CET	49977	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.312616110 CET	443	49977	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.312633038 CET	49977	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.312643051 CET	443	49977	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.315279007 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.315336943 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.315402031 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.315541029 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.315552950 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.706032991 CET	443	49978	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.707940102 CET	49978	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.707951069 CET	443	49978	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.708280087 CET	443	49979	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.708429098 CET	49978	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.708435059 CET	443	49978	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.708734989 CET	49979	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.708758116 CET	443	49979	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.709131956 CET	49979	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.709141016 CET	443	49979	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.847618103 CET	443	49980	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.847980976 CET	49980	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.848007917 CET	443	49980	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:55.848376989 CET	49980	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:55.848381996 CET	443	49980	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.141422033 CET	443	49978	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.143126965 CET	443	49979	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.143915892 CET	443	49978	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.143990993 CET	49978	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.144036055 CET	49978	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.144047976 CET	443	49978	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.144057989 CET	49978	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.144062996 CET	443	49978	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.146146059 CET	443	49979	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.146213055 CET	49979	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.146280050 CET	49979	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.146297932 CET	443	49979	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.146311045 CET	49979	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.146317005 CET	443	49979	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.147726059 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.147758007 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.147836924 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.148247004 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.148262978 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.149991989 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.150000095 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.150068998 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.150209904 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.150218010 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.284133911 CET	443	49980	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.287697077 CET	443	49980	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.287784100 CET	49980	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.287813902 CET	49980	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.287831068 CET	443	49980	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.287839890 CET	49980	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.287844896 CET	443	49980	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.290798903 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.290824890 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.290883064 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.291043043 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.291054964 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.805169106 CET	443	49981	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.805686951 CET	49981	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.805715084 CET	443	49981	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:56.806102991 CET	49981	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:56.806107998 CET	443	49981	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.038408041 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.038902044 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.038918972 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.039343119 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.039347887 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.241646051 CET	443	49981	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.241714001 CET	443	49981	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.241765022 CET	49981	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.241957903 CET	49981	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.241957903 CET	49981	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.241981983 CET	443	49981	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.241991043 CET	443	49981	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.244890928 CET	49987	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.244925022 CET	443	49987	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.245006084 CET	49987	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.245176077 CET	49987	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.245187998 CET	443	49987	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.474376917 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.478857994 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.478929043 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.479054928 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.479079008 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.479093075 CET	49982	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.479098082 CET	443	49982	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.481616974 CET	49988	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.481659889 CET	443	49988	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.481719971 CET	49988	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.481949091 CET	49988	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.481966019 CET	443	49988	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.871429920 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.871437073 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.872077942 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.872104883 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.872150898 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.872159004 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.872558117 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.872562885 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:57.872612953 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:57.872617006 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.006088972 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.006412029 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.006443977 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.006745100 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.006751060 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.307188034 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.307264090 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.307334900 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.307495117 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.307514906 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.307526112 CET	49983	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.307531118 CET	443	49983	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.307890892 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.310331106 CET	49989	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.310359001 CET	443	49989	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.310606003 CET	49989	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.310606003 CET	49989	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.310632944 CET	443	49989	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.311156034 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.311206102 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.311213970 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.311227083 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.311273098 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.311326981 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.311332941 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.311342001 CET	49984	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.311346054 CET	443	49984	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.313457966 CET	49990	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.313498974 CET	443	49990	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.313574076 CET	49990	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.313718081 CET	49990	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.313733101 CET	443	49990	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.443499088 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.447412968 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.447483063 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.447519064 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.447519064 CET	49985	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.447535038 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.447544098 CET	443	49985	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.449835062 CET	49991	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.449867010 CET	443	49991	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.449945927 CET	49991	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.450145006 CET	49991	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.450159073 CET	443	49991	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.973227024 CET	443	49987	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.973761082 CET	49987	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.973794937 CET	443	49987	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:58.974210978 CET	49987	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:58.974222898 CET	443	49987	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.203305006 CET	443	49988	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.203732967 CET	49988	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.203773022 CET	443	49988	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.204157114 CET	49988	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.204165936 CET	443	49988	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.410068989 CET	443	49987	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.412929058 CET	443	49987	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.412990093 CET	49987	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.413043976 CET	49987	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.413059950 CET	443	49987	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.413069963 CET	49987	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.413074970 CET	443	49987	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.415872097 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.415925980 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.416047096 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.416225910 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.416244030 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.645673990 CET	443	49988	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.648821115 CET	443	49988	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.648876905 CET	49988	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.648917913 CET	49988	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.648938894 CET	443	49988	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.648953915 CET	49988	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.648960114 CET	443	49988	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.651469946 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.651510954 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 17:18:59.651571989 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.651704073 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:18:59.651717901 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.026376963 CET	443	49989	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.026921988 CET	49989	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.026937008 CET	443	49989	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.027344942 CET	49989	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.027349949 CET	443	49989	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.030289888 CET	443	49990	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.030556917 CET	49990	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.030581951 CET	443	49990	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.030854940 CET	49990	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.030864954 CET	443	49990	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.166637897 CET	443	49991	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.167151928 CET	49991	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.167198896 CET	443	49991	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.167655945 CET	49991	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.167665005 CET	443	49991	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.463125944 CET	443	49989	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.463155031 CET	443	49989	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.463228941 CET	49989	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.463242054 CET	443	49989	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.463500977 CET	49989	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.463506937 CET	443	49989	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.463521004 CET	49989	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.463674068 CET	443	49989	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.463707924 CET	443	49989	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.463742018 CET	49989	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.466310978 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.466350079 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.466445923 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.466547012 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.466558933 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.466701984 CET	443	49990	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.470766068 CET	443	49990	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.470805883 CET	443	49990	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.470829964 CET	49990	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.470863104 CET	49990	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.470918894 CET	49990	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.470932961 CET	443	49990	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.470947981 CET	49990	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.470952988 CET	443	49990	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.472893000 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.472925901 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.472991943 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.473093987 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.473105907 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.640870094 CET	443	49991	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.643943071 CET	443	49991	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.643990993 CET	443	49991	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.644000053 CET	49991	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.644037962 CET	49991	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.644084930 CET	49991	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.644103050 CET	443	49991	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.644114971 CET	49991	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.644119978 CET	443	49991	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.646383047 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.646414995 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:00.646475077 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.646627903 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:00.646641016 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.160268068 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.160784960 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.160832882 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.161211967 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.161220074 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.367724895 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.368243933 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.368277073 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.368684053 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.368689060 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.599066973 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.599148035 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.599211931 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.599385023 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.599416018 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.599427938 CET	49992	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.599433899 CET	443	49992	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.602319002 CET	49997	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.602366924 CET	443	49997	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.602452040 CET	49997	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.602617025 CET	49997	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.602631092 CET	443	49997	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.812640905 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.815753937 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.815799952 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.815819979 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.815860987 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.815901995 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.815933943 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.815958977 CET	49993	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.815963984 CET	443	49993	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.818732023 CET	49998	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.818774939 CET	443	49998	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:01.818861961 CET	49998	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.819016933 CET	49998	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:01.819032907 CET	443	49998	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.189265013 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.189765930 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.189802885 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.190171003 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.190180063 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.194034100 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.194268942 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.194293022 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.194550037 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.194556952 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.369980097 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.370438099 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.370476961 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.370877028 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.370882034 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.624449015 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.627409935 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.627473116 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.627507925 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.627507925 CET	49994	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.627527952 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.627537012 CET	443	49994	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.630258083 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.630291939 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.630359888 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.630497932 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.630511045 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.635853052 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.635879040 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.635936022 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.635963917 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.636058092 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.636064053 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.636077881 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.636214972 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.636245012 CET	443	49995	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.636293888 CET	49995	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.638219118 CET	50000	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.638242006 CET	443	50000	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.638304949 CET	50000	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.638436079 CET	50000	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.638446093 CET	443	50000	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.804058075 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.808109999 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.808161974 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.808168888 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.808214903 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.808264017 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.808283091 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.808293104 CET	49996	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.808298111 CET	443	49996	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.811052084 CET	50001	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.811088085 CET	443	50001	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:02.811157942 CET	50001	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.811280966 CET	50001	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:02.811295033 CET	443	50001	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.324553013 CET	443	49997	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.325212002 CET	49997	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.325243950 CET	443	49997	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.325660944 CET	49997	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.325665951 CET	443	49997	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.550035000 CET	443	49998	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.550527096 CET	49998	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.550575018 CET	443	49998	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.550935984 CET	49998	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.550940990 CET	443	49998	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.761065006 CET	443	49997	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.763998985 CET	443	49997	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.764041901 CET	443	49997	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.764061928 CET	49997	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.764100075 CET	49997	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.764148951 CET	49997	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.764168024 CET	443	49997	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.764180899 CET	49997	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.764184952 CET	443	49997	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.766607046 CET	50002	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.766644001 CET	443	50002	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.766721964 CET	50002	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.766927958 CET	50002	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.766942024 CET	443	50002	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.985765934 CET	443	49998	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.989861012 CET	443	49998	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.989932060 CET	49998	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.989978075 CET	49998	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.989978075 CET	49998	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.990000963 CET	443	49998	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.990012884 CET	443	49998	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.992468119 CET	50003	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.992518902 CET	443	50003	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:03.992585897 CET	50003	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.992721081 CET	50003	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:03.992737055 CET	443	50003	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.353502989 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.353969097 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.354000092 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.354620934 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.354625940 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.366630077 CET	443	50000	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.366949081 CET	50000	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.366987944 CET	443	50000	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.367317915 CET	50000	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.367322922 CET	443	50000	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.527090073 CET	443	50001	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.527780056 CET	50001	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.527796984 CET	443	50001	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.528119087 CET	50001	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.528122902 CET	443	50001	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.788284063 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.791707993 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.791924000 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.791924000 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.791924000 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.794600010 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.794631958 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.794717073 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.794914961 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.794925928 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.803802967 CET	443	50000	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.806755066 CET	443	50000	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.806808949 CET	50000	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.806968927 CET	50000	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.806968927 CET	50000	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.806993008 CET	443	50000	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.807003975 CET	443	50000	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.809246063 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.809283972 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.809345007 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.809463024 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.809478998 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.971486092 CET	443	50001	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.971518040 CET	443	50001	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.971563101 CET	50001	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.971576929 CET	443	50001	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.971621037 CET	50001	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.971734047 CET	50001	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.971755028 CET	443	50001	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.971764088 CET	50001	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.971770048 CET	443	50001	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.977480888 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.977511883 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:04.977574110 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.977787971 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:04.977798939 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.106223106 CET	49999	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:05.106247902 CET	443	49999	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.483845949 CET	443	50002	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.484432936 CET	50002	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:05.484461069 CET	443	50002	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.484886885 CET	50002	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:05.484893084 CET	443	50002	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.729582071 CET	443	50003	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.730132103 CET	50003	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:05.730171919 CET	443	50003	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.730550051 CET	50003	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:05.730557919 CET	443	50003	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.918169022 CET	443	50002	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.918247938 CET	443	50002	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.918307066 CET	50002	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:05.918483019 CET	50002	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:05.918504000 CET	443	50002	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.918517113 CET	50002	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:05.918521881 CET	443	50002	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.921257973 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:05.921307087 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:05.921396017 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:05.921551943 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:05.921569109 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.514756918 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.515371084 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.515402079 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.515820026 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.515825987 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.526602983 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.526880980 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.526901007 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.527189970 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.527195930 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.575803041 CET	443	50003	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.575879097 CET	443	50003	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.575922012 CET	50003	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.575932026 CET	443	50003	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.575978994 CET	50003	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.576143980 CET	50003	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.576155901 CET	443	50003	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.576167107 CET	50003	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.576172113 CET	443	50003	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.578876972 CET	50008	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.578915119 CET	443	50008	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.578988075 CET	50008	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.579137087 CET	50008	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.579150915 CET	443	50008	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.693079948 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.696031094 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.696054935 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.697046041 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.697051048 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.954217911 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.957165003 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.957227945 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.957262039 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.957278967 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.957287073 CET	50004	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.957292080 CET	443	50004	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.959991932 CET	50009	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.960037947 CET	443	50009	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.960124016 CET	50009	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.960266113 CET	50009	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.960279942 CET	443	50009	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.989443064 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.989475965 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.989520073 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.989545107 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.989582062 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.989754915 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.989779949 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.989792109 CET	50005	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.989798069 CET	443	50005	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.992036104 CET	50010	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.992069006 CET	443	50010	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:06.992300987 CET	50010	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.992300987 CET	50010	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:06.992327929 CET	443	50010	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:07.128938913 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:07.132051945 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:07.132123947 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:07.132164955 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:07.132164955 CET	50006	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:07.132180929 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:07.132189035 CET	443	50006	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:07.134697914 CET	50011	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:07.134723902 CET	443	50011	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:07.134810925 CET	50011	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:07.134931087 CET	50011	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:07.134943962 CET	443	50011	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:07.641843081 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:07.642663956 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:07.642697096 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:07.643064976 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:07.643070936 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.078315973 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.078394890 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.078474998 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.083623886 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.083647966 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.083657980 CET	50007	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.083662987 CET	443	50007	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.086802006 CET	50012	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.086846113 CET	443	50012	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.086920977 CET	50012	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.087071896 CET	50012	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.087085009 CET	443	50012	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.301502943 CET	443	50008	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.302042961 CET	50008	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.302081108 CET	443	50008	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.302516937 CET	50008	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.302521944 CET	443	50008	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.683403015 CET	443	50009	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.683965921 CET	50009	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.683998108 CET	443	50009	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.684453964 CET	50009	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.684459925 CET	443	50009	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.709966898 CET	443	50010	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.710534096 CET	50010	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.710557938 CET	443	50010	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.710972071 CET	50010	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.710978031 CET	443	50010	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.737840891 CET	443	50008	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.741008043 CET	443	50008	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.741123915 CET	50008	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.741163015 CET	50008	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.741179943 CET	443	50008	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.741197109 CET	50008	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.741202116 CET	443	50008	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.743920088 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.743972063 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.744044065 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.744188070 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.744204998 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.868999958 CET	443	50011	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.869553089 CET	50011	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.869580030 CET	443	50011	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:08.870027065 CET	50011	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:08.870032072 CET	443	50011	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.120049953 CET	443	50009	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.123541117 CET	443	50009	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.123616934 CET	50009	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.123661995 CET	50009	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.123684883 CET	443	50009	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.123696089 CET	50009	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.123701096 CET	443	50009	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.126285076 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.126315117 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.126385927 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.126539946 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.126547098 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.272192001 CET	443	50010	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.272262096 CET	443	50010	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.272309065 CET	50010	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.272428989 CET	50010	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.272444963 CET	443	50010	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.272469044 CET	50010	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.272474051 CET	443	50010	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.274813890 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.274862051 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.274943113 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.275079966 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.275094986 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.304332018 CET	443	50011	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.307729006 CET	443	50011	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.307779074 CET	50011	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.307790995 CET	443	50011	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.307836056 CET	50011	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.307879925 CET	50011	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.307892084 CET	443	50011	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.307899952 CET	50011	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.307904005 CET	443	50011	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.309839010 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.309886932 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.309962034 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.310091972 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.310107946 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.805918932 CET	443	50012	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.806457043 CET	50012	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.806473970 CET	443	50012	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:09.806960106 CET	50012	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:09.806965113 CET	443	50012	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.239949942 CET	443	50012	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.283226013 CET	443	50012	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.283310890 CET	50012	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.283349037 CET	50012	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.283365965 CET	443	50012	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.283375025 CET	50012	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.283380985 CET	443	50012	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.286050081 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.286101103 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.286179066 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.286341906 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.286356926 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.460865021 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.461744070 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.461771965 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.462179899 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.462184906 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.844770908 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.845410109 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.845423937 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.845844984 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.845849991 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.895131111 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.898519993 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.898576021 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.898587942 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.898636103 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.898680925 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.898699045 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.898718119 CET	50013	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.898724079 CET	443	50013	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.901348114 CET	50018	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.901386976 CET	443	50018	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.901479959 CET	50018	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.901607990 CET	50018	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.901621103 CET	443	50018	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.989214897 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.989795923 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.989819050 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:10.990266085 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:10.990272045 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.025304079 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.025772095 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.025800943 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.026254892 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.026259899 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.283190012 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.286048889 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.286098003 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.286175966 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.286187887 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.286204100 CET	50014	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.286209106 CET	443	50014	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.288832903 CET	50019	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.288893938 CET	443	50019	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.288964987 CET	50019	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.289089918 CET	50019	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.289105892 CET	443	50019	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.424120903 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.427258015 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.427321911 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.427346945 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.427381992 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.427432060 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.427454948 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.427469015 CET	50015	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.427474976 CET	443	50015	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.430253983 CET	50020	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.430304050 CET	443	50020	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.430365086 CET	50020	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.430502892 CET	50020	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.430512905 CET	443	50020	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.460856915 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.463932991 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.464061022 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.464148998 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.464173079 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.464194059 CET	50016	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.464200020 CET	443	50016	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.467308998 CET	50021	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.467351913 CET	443	50021	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:11.467418909 CET	50021	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.467570066 CET	50021	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:11.467582941 CET	443	50021	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.011311054 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.011801958 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:12.011842012 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.012242079 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:12.012247086 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.446367025 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.450572014 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.450639963 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.450647116 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:12.450694084 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:12.450720072 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:12.450741053 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.450752020 CET	50017	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:12.450757980 CET	443	50017	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.453517914 CET	50022	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:12.453552008 CET	443	50022	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.453608990 CET	50022	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:12.453787088 CET	50022	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:12.453799963 CET	443	50022	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.619860888 CET	443	50018	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.620616913 CET	50018	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:12.620646000 CET	443	50018	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:12.621047974 CET	50018	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:12.621052980 CET	443	50018	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.005878925 CET	443	50019	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.006405115 CET	50019	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.006434917 CET	443	50019	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.007045031 CET	50019	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.007050991 CET	443	50019	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.054177999 CET	443	50018	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.057388067 CET	443	50018	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.057459116 CET	50018	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.057497025 CET	50018	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.057497025 CET	50018	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.057517052 CET	443	50018	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.057524920 CET	443	50018	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.060008049 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.060053110 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.060125113 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.060312986 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.060328960 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.148020029 CET	443	50020	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.148350954 CET	50020	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.148370981 CET	443	50020	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.148699999 CET	50020	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.148705006 CET	443	50020	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.183756113 CET	443	50021	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.184062004 CET	50021	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.184075117 CET	443	50021	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.184458017 CET	50021	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.184463024 CET	443	50021	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.445229053 CET	443	50019	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.445257902 CET	443	50019	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.445343971 CET	443	50019	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.445344925 CET	50019	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.445395947 CET	50019	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.445600033 CET	50019	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.445624113 CET	443	50019	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.445642948 CET	50019	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.445648909 CET	443	50019	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.448579073 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.448620081 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.448890924 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.448890924 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.448920965 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.583399057 CET	443	50020	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.583425045 CET	443	50020	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.583482981 CET	50020	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.583503962 CET	443	50020	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.583739042 CET	50020	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.583755970 CET	443	50020	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.583767891 CET	50020	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.583911896 CET	443	50020	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.583951950 CET	443	50020	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.583992958 CET	50020	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.586775064 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.586817026 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.586884975 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.587028980 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.587048054 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.619786024 CET	443	50021	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.623023033 CET	443	50021	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.623074055 CET	443	50021	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.623086929 CET	50021	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.623126984 CET	50021	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.623174906 CET	50021	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.623192072 CET	443	50021	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.623205900 CET	50021	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.623210907 CET	443	50021	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.625237942 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.625278950 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:13.625344038 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.625452042 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:13.625463963 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:14.187484026 CET	443	50022	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:14.188041925 CET	50022	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:14.188067913 CET	443	50022	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:14.188564062 CET	50022	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:14.188568115 CET	443	50022	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:14.624085903 CET	443	50022	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:14.627502918 CET	443	50022	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:14.627573967 CET	50022	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:14.627602100 CET	50022	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:14.627619982 CET	443	50022	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:14.627630949 CET	50022	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:14.627636909 CET	443	50022	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:14.630533934 CET	50027	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:14.630583048 CET	443	50027	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:14.630675077 CET	50027	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:14.630834103 CET	50027	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:14.630846024 CET	443	50027	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:14.799221992 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:14.799659014 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:14.799690962 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:14.800235987 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:14.800240993 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.178127050 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.178508043 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.178534031 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.178957939 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.178962946 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.233488083 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.237010002 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.237063885 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.237076998 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.237109900 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.237176895 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.237200975 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.237220049 CET	50023	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.237225056 CET	443	50023	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.239784956 CET	50028	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.239821911 CET	443	50028	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.239891052 CET	50028	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.240025997 CET	50028	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.240036964 CET	443	50028	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.312092066 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.313956976 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.313997984 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.314452887 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.314459085 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.353302956 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.353655100 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.353682995 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.354042053 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.354048967 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.615287066 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.618583918 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.618637085 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.618668079 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.618690014 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.618699074 CET	50024	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.618704081 CET	443	50024	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.621305943 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.621351004 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.621433020 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.621567965 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.621583939 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.746958971 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.750185013 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.750248909 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.750257015 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.750303030 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.750355005 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.750380039 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.750395060 CET	50025	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.750400066 CET	443	50025	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.752957106 CET	50030	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.752985954 CET	443	50030	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.753051996 CET	50030	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.753176928 CET	50030	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.753187895 CET	443	50030	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.787667990 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.791105032 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.791157961 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.791191101 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.791203022 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.791224957 CET	50026	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.791229010 CET	443	50026	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.793215036 CET	50031	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.793241024 CET	443	50031	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:15.793302059 CET	50031	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.793436050 CET	50031	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:15.793447018 CET	443	50031	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.363735914 CET	443	50027	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.364243984 CET	50027	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:16.364276886 CET	443	50027	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.364715099 CET	50027	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:16.364723921 CET	443	50027	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.798614025 CET	443	50027	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.801768064 CET	443	50027	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.801810026 CET	443	50027	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.801835060 CET	50027	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:16.801886082 CET	50027	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:16.801913023 CET	50027	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:16.801935911 CET	443	50027	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.801949978 CET	50027	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:16.801955938 CET	443	50027	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.804474115 CET	50032	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:16.804510117 CET	443	50032	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.804615974 CET	50032	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:16.804781914 CET	50032	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:16.804800034 CET	443	50032	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.973761082 CET	443	50028	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.974186897 CET	50028	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:16.974219084 CET	443	50028	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:16.974586964 CET	50028	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:16.974591970 CET	443	50028	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.341909885 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.342644930 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.342679024 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.345861912 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.345866919 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.409060955 CET	443	50028	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.412950039 CET	443	50028	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.413067102 CET	50028	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.413111925 CET	50028	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.413126945 CET	443	50028	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.413136959 CET	50028	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.413141966 CET	443	50028	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.415735960 CET	50033	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.415770054 CET	443	50033	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.415834904 CET	50033	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.415955067 CET	50033	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.415966988 CET	443	50033	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.481733084 CET	443	50030	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.482414007 CET	50030	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.482422113 CET	443	50030	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.482947111 CET	50030	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.482952118 CET	443	50030	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.509171963 CET	443	50031	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.509784937 CET	50031	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.509809017 CET	443	50031	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.510140896 CET	50031	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.510144949 CET	443	50031	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.780056953 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.780864000 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.780914068 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.780921936 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.780962944 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.780999899 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.781016111 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.781024933 CET	50029	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.781029940 CET	443	50029	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.783718109 CET	50034	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.783759117 CET	443	50034	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.783842087 CET	50034	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.783987999 CET	50034	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.784003019 CET	443	50034	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.916728973 CET	443	50030	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.916794062 CET	443	50030	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.916848898 CET	50030	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.917011023 CET	50030	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.917026043 CET	443	50030	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.917045116 CET	50030	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.917051077 CET	443	50030	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.919612885 CET	50035	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.919650078 CET	443	50035	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.919709921 CET	50035	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.919840097 CET	50035	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.919852972 CET	443	50035	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.944868088 CET	443	50031	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.944991112 CET	443	50031	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.945050955 CET	50031	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.945101023 CET	50031	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.945118904 CET	443	50031	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.945128918 CET	50031	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.945133924 CET	443	50031	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.947180986 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.947201014 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:17.947273016 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.947386026 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:17.947397947 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:18.566875935 CET	443	50032	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:18.567379951 CET	50032	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:18.567435980 CET	443	50032	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:18.567842960 CET	50032	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:18.567851067 CET	443	50032	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.002387047 CET	443	50032	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.005508900 CET	443	50032	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.005553007 CET	443	50032	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.005561113 CET	50032	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.005597115 CET	50032	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.005645990 CET	50032	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.005670071 CET	443	50032	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.005681038 CET	50032	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.005686998 CET	443	50032	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.008172989 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.008200884 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.008261919 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.008388042 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.008399963 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.147842884 CET	443	50033	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.148422956 CET	50033	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.148438931 CET	443	50033	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.148890018 CET	50033	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.148895979 CET	443	50033	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.500175953 CET	443	50034	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.500686884 CET	50034	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.500724077 CET	443	50034	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.501125097 CET	50034	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.501132011 CET	443	50034	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.582480907 CET	443	50033	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.585692883 CET	443	50033	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.585753918 CET	50033	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.585782051 CET	50033	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.585793018 CET	443	50033	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.585804939 CET	50033	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.585809946 CET	443	50033	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.588419914 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.588488102 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.588553905 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.588670015 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.588685989 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.645354033 CET	443	50035	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.645719051 CET	50035	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.645745993 CET	443	50035	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.646075964 CET	50035	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.646080971 CET	443	50035	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.664566994 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.664846897 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.664874077 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.665191889 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.665196896 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.934418917 CET	443	50034	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.937587976 CET	443	50034	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.937652111 CET	50034	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.937728882 CET	50034	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.937751055 CET	443	50034	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.937763929 CET	50034	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.937768936 CET	443	50034	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.940273046 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.940296888 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:19.940383911 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.940505028 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:19.940511942 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.079979897 CET	443	50035	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.083575964 CET	443	50035	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.083620071 CET	443	50035	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.083637953 CET	50035	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.083800077 CET	50035	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.083800077 CET	50035	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.083800077 CET	50035	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.086029053 CET	50040	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.086080074 CET	443	50040	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.086150885 CET	50040	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.086286068 CET	50040	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.086301088 CET	443	50040	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.100225925 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.103354931 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.103413105 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.103446007 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.103446007 CET	50036	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.103462934 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.103471994 CET	443	50036	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.106029987 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.106061935 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.106148958 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.106453896 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.106466055 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.387490988 CET	50035	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.387512922 CET	443	50035	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.725434065 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.725991964 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.726016998 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:20.726392984 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:20.726397991 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.167049885 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.170363903 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.170409918 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.170458078 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.170517921 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.170517921 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.173109055 CET	50037	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.173113108 CET	50042	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.173121929 CET	443	50037	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.173157930 CET	443	50042	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.173214912 CET	50042	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.173360109 CET	50042	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.173374891 CET	443	50042	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.306664944 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.307212114 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.307240963 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.307683945 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.307689905 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.657331944 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.657766104 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.657773972 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.658240080 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.658252001 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.746222019 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.750061989 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.750123978 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.750169039 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.750189066 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.750199080 CET	50038	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.750204086 CET	443	50038	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.752722025 CET	50043	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.752767086 CET	443	50043	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.752827883 CET	50043	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.752957106 CET	50043	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.752970934 CET	443	50043	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.809497118 CET	443	50040	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.809884071 CET	50040	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.809911013 CET	443	50040	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.810318947 CET	50040	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.810324907 CET	443	50040	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.838304043 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.838686943 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.838710070 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:21.839083910 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:21.839088917 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.155757904 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.155822992 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.155968904 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.156080008 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.156091928 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.156105042 CET	50039	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.156110048 CET	443	50039	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.158684015 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.158725023 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.158819914 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.158957958 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.158973932 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.245120049 CET	443	50040	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.249613047 CET	443	50040	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.249659061 CET	50040	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.249661922 CET	443	50040	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.249711990 CET	50040	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.249799967 CET	50040	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.249819994 CET	443	50040	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.249845028 CET	50040	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.249850035 CET	443	50040	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.252376080 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.252417088 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.252520084 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.252628088 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.252641916 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.305660963 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.305835009 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.305896997 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.305937052 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.305937052 CET	50041	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.305953979 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.305962086 CET	443	50041	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.308063030 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.308098078 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.308171988 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.308295012 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.308309078 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.898880959 CET	443	50042	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.899377108 CET	50042	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.899403095 CET	443	50042	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:22.899835110 CET	50042	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:22.899838924 CET	443	50042	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.335547924 CET	443	50042	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.336133957 CET	443	50042	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.336227894 CET	50042	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.336278915 CET	50042	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.336278915 CET	50042	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.336299896 CET	443	50042	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.336311102 CET	443	50042	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.339008093 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.339056015 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.339127064 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.339277983 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.339289904 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.472958088 CET	443	50043	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.473452091 CET	50043	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.473475933 CET	443	50043	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.473901033 CET	50043	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.473906040 CET	443	50043	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.882134914 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.882678032 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.882776022 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.883112907 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.883130074 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.910424948 CET	443	50043	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.910454035 CET	443	50043	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.910511017 CET	443	50043	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.910535097 CET	50043	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.910571098 CET	50043	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.910788059 CET	50043	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.910809040 CET	443	50043	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.910819054 CET	50043	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.910824060 CET	443	50043	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.913741112 CET	50048	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.913784981 CET	443	50048	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.913866997 CET	50048	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.914037943 CET	50048	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.914048910 CET	443	50048	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.976231098 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.976721048 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.976737022 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:23.977271080 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:23.977274895 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.033519983 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.033900023 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.033930063 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.034307003 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.034311056 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.318788052 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.318881035 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.318937063 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.319144011 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.319169044 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.319180965 CET	50044	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.319186926 CET	443	50044	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.322175026 CET	50049	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.322218895 CET	443	50049	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.322314978 CET	50049	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.322478056 CET	50049	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.322491884 CET	443	50049	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.412167072 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.413598061 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.413654089 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.413655996 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.413707018 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.413757086 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.413773060 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.413790941 CET	50045	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.413795948 CET	443	50045	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.416356087 CET	50050	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.416407108 CET	443	50050	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.416477919 CET	50050	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.416609049 CET	50050	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.416621923 CET	443	50050	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.468987942 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.471975088 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.472052097 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.472081900 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.472098112 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.472109079 CET	50046	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.472114086 CET	443	50046	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.474497080 CET	50051	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.474533081 CET	443	50051	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:24.474606037 CET	50051	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.474733114 CET	50051	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:24.474745989 CET	443	50051	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:25.061553001 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:25.062051058 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:25.062072992 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:25.062501907 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:25.062506914 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:25.498872042 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:25.501339912 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:25.501399994 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:25.501446009 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:25.501468897 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:25.501482964 CET	50047	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:25.501487970 CET	443	50047	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:25.504139900 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:25.504183054 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:25.504252911 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:25.504385948 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:25.504399061 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:25.656692982 CET	443	50048	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:25.657340050 CET	50048	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:25.657377958 CET	443	50048	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:25.657777071 CET	50048	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:25.657780886 CET	443	50048	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.039232969 CET	443	50049	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.039773941 CET	50049	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.039812088 CET	443	50049	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.040215015 CET	50049	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.040220022 CET	443	50049	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.092317104 CET	443	50048	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.095460892 CET	443	50048	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.095520020 CET	50048	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.095582962 CET	50048	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.095599890 CET	443	50048	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.095614910 CET	50048	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.095619917 CET	443	50048	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.098136902 CET	50053	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.098181009 CET	443	50053	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.098253012 CET	50053	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.098416090 CET	50053	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.098428965 CET	443	50053	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.153093100 CET	443	50050	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.153589964 CET	50050	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.153614998 CET	443	50050	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.153995037 CET	50050	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.154000998 CET	443	50050	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.190351963 CET	443	50051	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.190737963 CET	50051	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.190758944 CET	443	50051	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.191117048 CET	50051	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.191121101 CET	443	50051	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.479341984 CET	443	50049	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.479559898 CET	443	50049	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.479603052 CET	443	50049	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.479617119 CET	50049	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.479650974 CET	50049	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.479804993 CET	50049	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.479819059 CET	443	50049	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.479826927 CET	50049	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.479831934 CET	443	50049	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.482434988 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.482525110 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.482599020 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.482722998 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.482758045 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.595223904 CET	443	50050	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.595293999 CET	443	50050	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.595339060 CET	50050	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.595451117 CET	50050	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.595468044 CET	443	50050	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.595479965 CET	50050	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.595485926 CET	443	50050	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.597688913 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.597721100 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.597796917 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.597939968 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.597950935 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.630918980 CET	443	50051	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.634027958 CET	443	50051	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.634072065 CET	443	50051	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.634083033 CET	50051	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.634119034 CET	50051	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.634162903 CET	50051	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.634170055 CET	443	50051	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.634179115 CET	50051	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.634183884 CET	443	50051	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.636334896 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.636370897 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:26.636454105 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.636559010 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:26.636573076 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:27.234666109 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:27.235275984 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:27.235311031 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:27.235761881 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:27.235768080 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:27.687849998 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:27.690853119 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:27.690922022 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:27.690968037 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:27.690968037 CET	50052	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:27.690989971 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:27.690998077 CET	443	50052	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:27.693696022 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:27.693742990 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:27.693815947 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:27.693967104 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:27.693979979 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:27.815789938 CET	443	50053	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:27.816296101 CET	50053	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:27.816323996 CET	443	50053	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:27.816719055 CET	50053	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:27.816724062 CET	443	50053	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.201116085 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.201808929 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.201832056 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.202403069 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.202408075 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.249670982 CET	443	50053	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.253350019 CET	443	50053	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.253395081 CET	443	50053	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.253407001 CET	50053	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.253453016 CET	50053	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.253490925 CET	50053	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.253508091 CET	443	50053	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.253520012 CET	50053	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.253525019 CET	443	50053	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.256175041 CET	50058	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.256287098 CET	443	50058	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.256377935 CET	50058	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.256500959 CET	50058	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.256537914 CET	443	50058	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.322817087 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.323384047 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.323410034 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.323826075 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.323831081 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.364660978 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.365273952 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.365304947 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.365720987 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.365725040 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.636200905 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.639303923 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.639374971 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.639422894 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.639422894 CET	50054	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.639445066 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.639457941 CET	443	50054	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.642370939 CET	50059	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.642416000 CET	443	50059	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.642476082 CET	50059	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.642620087 CET	50059	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.642630100 CET	443	50059	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.757982016 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.760960102 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.761025906 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.761074066 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.761096001 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.761110067 CET	50055	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.761116982 CET	443	50055	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.763823032 CET	50060	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.763875008 CET	443	50060	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.763958931 CET	50060	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.764137983 CET	50060	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.764148951 CET	443	50060	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.799042940 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.802326918 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.802390099 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.802437067 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.802437067 CET	50056	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.802459955 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.802473068 CET	443	50056	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.804838896 CET	50061	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.804871082 CET	443	50061	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:28.804940939 CET	50061	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.805061102 CET	50061	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:28.805074930 CET	443	50061	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.411533117 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.412043095 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:29.412059069 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.412504911 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:29.412509918 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.847244024 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.850300074 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.850349903 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.850354910 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:29.850390911 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:29.850440979 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:29.850459099 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.850469112 CET	50057	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:29.850475073 CET	443	50057	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.853167057 CET	50062	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:29.853214025 CET	443	50062	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.853286982 CET	50062	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:29.853449106 CET	50062	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:29.853462934 CET	443	50062	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.975440979 CET	443	50058	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.975975037 CET	50058	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:29.976037025 CET	443	50058	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:29.976425886 CET	50058	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:29.976444960 CET	443	50058	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.362999916 CET	443	50059	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.363435984 CET	50059	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.363457918 CET	443	50059	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.363853931 CET	50059	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.363859892 CET	443	50059	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.410265923 CET	443	50058	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.410711050 CET	443	50058	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.410787106 CET	50058	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.410876036 CET	50058	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.410876036 CET	50058	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.410923958 CET	443	50058	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.410950899 CET	443	50058	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.413507938 CET	50063	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.413552999 CET	443	50063	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.413640022 CET	50063	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.413780928 CET	50063	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.413793087 CET	443	50063	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.482822895 CET	443	50060	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.483324051 CET	50060	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.483340979 CET	443	50060	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.483773947 CET	50060	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.483778954 CET	443	50060	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.520663023 CET	443	50061	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.521142006 CET	50061	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.521162033 CET	443	50061	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.521574020 CET	50061	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.521579027 CET	443	50061	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.801177979 CET	443	50059	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.804153919 CET	443	50059	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.804214001 CET	50059	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.804275990 CET	50059	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.804294109 CET	443	50059	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.804306030 CET	50059	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.804311037 CET	443	50059	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.807060003 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.807087898 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.807157040 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.807288885 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.807301044 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.917701960 CET	443	50060	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.920802116 CET	443	50060	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.920877934 CET	50060	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.920918941 CET	50060	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.920933008 CET	443	50060	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.920943022 CET	50060	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.920948982 CET	443	50060	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.924045086 CET	50065	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.924113035 CET	443	50065	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.924185991 CET	50065	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.924346924 CET	50065	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.924381018 CET	443	50065	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.955419064 CET	443	50061	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.959723949 CET	443	50061	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.959778070 CET	50061	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.959830999 CET	50061	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.959851980 CET	443	50061	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.959867001 CET	50061	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.959872961 CET	443	50061	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.962224007 CET	50066	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.962254047 CET	443	50066	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:30.962322950 CET	50066	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.962481976 CET	50066	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:30.962493896 CET	443	50066	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:31.625030994 CET	443	50062	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:31.625534058 CET	50062	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:31.625570059 CET	443	50062	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:31.625993967 CET	50062	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:31.625998974 CET	443	50062	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.059565067 CET	443	50062	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.062206984 CET	50067	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:19:32.062262058 CET	443	50067	142.250.181.68	192.168.2.4
Dec 6, 2024 17:19:32.062340021 CET	50067	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:19:32.062624931 CET	50067	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:19:32.062639952 CET	443	50067	142.250.181.68	192.168.2.4
Dec 6, 2024 17:19:32.062666893 CET	443	50062	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.062761068 CET	50062	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.062802076 CET	50062	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.062823057 CET	443	50062	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.062834978 CET	50062	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.062839985 CET	443	50062	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.065306902 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.065347910 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.065578938 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.065767050 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.065776110 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.136243105 CET	443	50063	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.136656046 CET	50063	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.136666059 CET	443	50063	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.137085915 CET	50063	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.137089968 CET	443	50063	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.523580074 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.524070978 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.524096966 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.524564981 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.524570942 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.573400021 CET	443	50063	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.576602936 CET	443	50063	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.576694012 CET	50063	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.576760054 CET	50063	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.576781988 CET	443	50063	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.576792955 CET	50063	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.576798916 CET	443	50063	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.579493999 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.579547882 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.579636097 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.579782009 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.579807043 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.644890070 CET	443	50065	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.645375013 CET	50065	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.645462990 CET	443	50065	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.645847082 CET	50065	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.645862103 CET	443	50065	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.685261011 CET	443	50066	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.685966969 CET	50066	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.685993910 CET	443	50066	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.686398029 CET	50066	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.686403990 CET	443	50066	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.959853888 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.959929943 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.960024118 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.960305929 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.960326910 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.960339069 CET	50064	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.960344076 CET	443	50064	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.963001013 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.963049889 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:32.963135004 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.963269949 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:32.963285923 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.079791069 CET	443	50065	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.082882881 CET	443	50065	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.082930088 CET	443	50065	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.082967043 CET	50065	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.083028078 CET	50065	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.083058119 CET	50065	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.083091021 CET	443	50065	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.083108902 CET	50065	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.083117962 CET	443	50065	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.085777044 CET	50071	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.085828066 CET	443	50071	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.085907936 CET	50071	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.086085081 CET	50071	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.086100101 CET	443	50071	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.122958899 CET	443	50066	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.126162052 CET	443	50066	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.126246929 CET	50066	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.126283884 CET	50066	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.126300097 CET	443	50066	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.126311064 CET	50066	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.126316071 CET	443	50066	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.128664970 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.128712893 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.128794909 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.128916025 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.128932953 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.754407883 CET	443	50067	142.250.181.68	192.168.2.4
Dec 6, 2024 17:19:33.757612944 CET	50067	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:19:33.757643938 CET	443	50067	142.250.181.68	192.168.2.4
Dec 6, 2024 17:19:33.757955074 CET	443	50067	142.250.181.68	192.168.2.4
Dec 6, 2024 17:19:33.759727001 CET	50067	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:19:33.759807110 CET	443	50067	142.250.181.68	192.168.2.4
Dec 6, 2024 17:19:33.790069103 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.814188004 CET	50067	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:19:33.821465015 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.821491957 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:33.821949005 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:33.821959972 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.224212885 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.229209900 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.229245901 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.229260921 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.229275942 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.229317904 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.229372025 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.229388952 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.229398012 CET	50068	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.229403019 CET	443	50068	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.232263088 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.232306004 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.232383013 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.232605934 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.232620001 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.297679901 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.298130989 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.298161983 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.298604012 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.298609018 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.690885067 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.691587925 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.691601992 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.692028999 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.692033052 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.732598066 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.735966921 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.736052036 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.736237049 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.736254930 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.736263037 CET	50069	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.736272097 CET	443	50069	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.738893032 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.738940954 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.739008904 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.739145994 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.739160061 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.826157093 CET	443	50071	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.826628923 CET	50071	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.826668024 CET	443	50071	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.827079058 CET	50071	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.827084064 CET	443	50071	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.847748995 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.848217010 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.848239899 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:34.848614931 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:34.848619938 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.126382113 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.129602909 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.129657984 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.129663944 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.129705906 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.129754066 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.129776955 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.129790068 CET	50070	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.129796028 CET	443	50070	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.132697105 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.132742882 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.132829905 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.132991076 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.133003950 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.260642052 CET	443	50071	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.260740995 CET	443	50071	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.260791063 CET	50071	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.260970116 CET	50071	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.260991096 CET	443	50071	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.261003017 CET	50071	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.261008024 CET	443	50071	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.266005993 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.266047955 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.266112089 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.266262054 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.266282082 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.332501888 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.335639000 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.335715055 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.335762978 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.335783958 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.335793972 CET	50072	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.335798979 CET	443	50072	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.338087082 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.338130951 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.338207960 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.338356018 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.338366985 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.954843044 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.955393076 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.955420971 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:35.955840111 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:35.955845118 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.390141010 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.393204927 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.393285990 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.406836987 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.406862974 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.406877041 CET	50073	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.406882048 CET	443	50073	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.409985065 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.410051107 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.410146952 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.410279989 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.410295010 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.462759972 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.471086025 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.471117973 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.471829891 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.471836090 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.851227045 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.851744890 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.851777077 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.852191925 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.852196932 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.899069071 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.902235985 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.902288914 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.902296066 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.902338028 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.902379990 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.902400970 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.902410984 CET	50074	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.902415991 CET	443	50074	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.905025959 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.905071020 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.905136108 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.905262947 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.905277967 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.981076002 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.981647968 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.981676102 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:36.982049942 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:36.982059956 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.068310022 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.068911076 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.068931103 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.069365025 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.069367886 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.285368919 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.288656950 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.288703918 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.288758993 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.288783073 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.288796902 CET	50075	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.288801908 CET	443	50075	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.293018103 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.293056965 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.293109894 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.293514013 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.293526888 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.415997028 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.416070938 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.416218996 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.416260004 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.416260004 CET	50076	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.416274071 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.416282892 CET	443	50076	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.419680119 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.419735909 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.419797897 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.419945002 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.419962883 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.510946989 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.510973930 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.511030912 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.511055946 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.511339903 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.511339903 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.511353016 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.511535883 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.511573076 CET	443	50077	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.511668921 CET	50077	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.514473915 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.514508963 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:37.514733076 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.515111923 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:37.515125990 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:38.126019001 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:38.126565933 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:38.126590014 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:38.127042055 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:38.127047062 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:38.567641973 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:38.567723036 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:38.567787886 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:38.567965984 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:38.567982912 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:38.567996025 CET	50078	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:38.568001986 CET	443	50078	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:38.570538998 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:38.570602894 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:38.570688009 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:38.570805073 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:38.570822954 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:38.626398087 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:38.627624035 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:38.627667904 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:38.628102064 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:38.628108025 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.010732889 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.011601925 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.011621952 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.011979103 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.011987925 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.066417933 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.066442013 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.066529989 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.066564083 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.067332029 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.067346096 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.067358971 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.067496061 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.067524910 CET	443	50079	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.067569017 CET	50079	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.069897890 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.069931984 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.070020914 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.070177078 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.070189953 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.136250973 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.143157005 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.143203974 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.143635035 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.143640995 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.232112885 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.232510090 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.232539892 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.232974052 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.232980967 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.447489977 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.447516918 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.447568893 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.447587967 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.447798014 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.447812080 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.447818995 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.447968006 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.447997093 CET	443	50080	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.448035002 CET	50080	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.450681925 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.450730085 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.450788975 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.451165915 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.451181889 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.571420908 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.571445942 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.571502924 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.571537018 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.571702003 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.571719885 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.571729898 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.571850061 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.571880102 CET	443	50081	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.571914911 CET	50081	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.573971033 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.574004889 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.574067116 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.574196100 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.574209929 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.667697906 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.667723894 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.667804956 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.667820930 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.668003082 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.668015957 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.668024063 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.668195963 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.668231010 CET	443	50082	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.668275118 CET	50082	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.670150042 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.670202017 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:39.670279026 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.670396090 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:39.670411110 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:40.293874025 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:40.294338942 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:40.294383049 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:40.294792891 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:40.294800043 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:40.735464096 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:40.735527039 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:40.735578060 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:40.735764980 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:40.735796928 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:40.735814095 CET	50083	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:40.735821962 CET	443	50083	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:40.738724947 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:40.738781929 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:40.738883018 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:40.739063978 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:40.739078999 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:40.786017895 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:40.786427021 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:40.786447048 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:40.786956072 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:40.786961079 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.181296110 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.223181963 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.223263979 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.223320007 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.236169100 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.262931108 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.262947083 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.270348072 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.270354986 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.277591944 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.277615070 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.277625084 CET	50084	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.277632952 CET	443	50084	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.303613901 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.303668976 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.303730011 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.303972006 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.303986073 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.309434891 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.325371981 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.325381994 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.327224016 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.327229977 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.386804104 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.387152910 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.387178898 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.387787104 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.387790918 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.617933035 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.618001938 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.618060112 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.618227959 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.618247032 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.618257046 CET	50085	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.618263006 CET	443	50085	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.620810032 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.620857954 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.620940924 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.621081114 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.621097088 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.745179892 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.748049021 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.748209000 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.748209000 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.748209000 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.750613928 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.750662088 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.750735998 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.750874043 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.750890017 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.821840048 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.821867943 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.822072983 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.822097063 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.822141886 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.822176933 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.822181940 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.822196007 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.822369099 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.822400093 CET	443	50087	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.822438955 CET	50087	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.832242012 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.832300901 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:41.832376003 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.832503080 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:41.832516909 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:42.059753895 CET	50086	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:42.059782028 CET	443	50086	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:42.455101967 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:42.455568075 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:42.455602884 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:42.456021070 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:42.456026077 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:42.912108898 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:42.912163019 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:42.912225008 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:42.912275076 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:42.912306070 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:42.912560940 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:42.912583113 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:42.912599087 CET	50088	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:42.912605047 CET	443	50088	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:42.915251970 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:42.915299892 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:42.915371895 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:42.915530920 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:42.915545940 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.019774914 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.020239115 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.020271063 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.020704985 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.020710945 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.337939024 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.338417053 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.338443995 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.338867903 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.338872910 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.467063904 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.467516899 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.467539072 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.468030930 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.468036890 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.470468044 CET	443	50067	142.250.181.68	192.168.2.4
Dec 6, 2024 17:19:43.470535040 CET	443	50067	142.250.181.68	192.168.2.4
Dec 6, 2024 17:19:43.470580101 CET	50067	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:19:43.498910904 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.498931885 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.498946905 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.499017954 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.499030113 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.499078989 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.550764084 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.551225901 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.551256895 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.551657915 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.551662922 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.652407885 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.652513981 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.652618885 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.652618885 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.652618885 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.652618885 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.652654886 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.655739069 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.655776978 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.655848980 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.655978918 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.655989885 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.773137093 CET	50067	443	192.168.2.4	142.250.181.68
Dec 6, 2024 17:19:43.773150921 CET	443	50067	142.250.181.68	192.168.2.4
Dec 6, 2024 17:19:43.773926973 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.773947954 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.774100065 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.774108887 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.774323940 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.774327993 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.774343014 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.774497986 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.774530888 CET	443	50090	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.774571896 CET	50090	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.776607990 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.776634932 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.776715040 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.776850939 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.776865005 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.948998928 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.949031115 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.949047089 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.949124098 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.949155092 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:43.949204922 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.965401888 CET	50089	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:43.965415955 CET	443	50089	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.003985882 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.004009008 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.004065990 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.004081964 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.004122972 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.004273891 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.004290104 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.004307985 CET	50092	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.004312992 CET	443	50092	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.006959915 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.006983995 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.007055998 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.007201910 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.007213116 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.121372938 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.121419907 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.121460915 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.121654034 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.121855021 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.121861935 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.121875048 CET	50091	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.121879101 CET	443	50091	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.124602079 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.124635935 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.124720097 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.124890089 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.124902964 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.632460117 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.633121014 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.633148909 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:44.633455038 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:44.633460999 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.072175026 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.072205067 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.072264910 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.072278976 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.072640896 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.072640896 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.072654963 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.072850943 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.072884083 CET	443	50093	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.072923899 CET	50093	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.075536966 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.075571060 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.075630903 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.075865984 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.075880051 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.378427029 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.379230022 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.379259109 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.379679918 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.379684925 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.500071049 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.500461102 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.500505924 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.500912905 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.500919104 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.690942049 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.731159925 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.740015030 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.793648958 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.813183069 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.816298008 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.816462994 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.825850964 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.825864077 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.826294899 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.826299906 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.829684973 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.829695940 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.833658934 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.833662987 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.859105110 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.859132051 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.859143019 CET	50094	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:45.859148979 CET	443	50094	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.935713053 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.935781002 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:45.935837030 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.017543077 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.017561913 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.017580032 CET	50095	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.017585993 CET	443	50095	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.043067932 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.043102026 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.043164015 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.044224977 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.044243097 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.044303894 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.048176050 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.048190117 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.048533916 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.048547983 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.141490936 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.144474030 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.144535065 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.144582033 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.144593000 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.144603014 CET	50097	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.144608021 CET	443	50097	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.147243977 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.147288084 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.147357941 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.147486925 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.147499084 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.176171064 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.179375887 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.179440975 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.179491997 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.179502964 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.179513931 CET	50096	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.179517984 CET	443	50096	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.181775093 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.181787968 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.181869030 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.182029009 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.182039976 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.793067932 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.793766022 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.793800116 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:46.794249058 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:46.794254065 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.227962971 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.231237888 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.231307983 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.231309891 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:47.231354952 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:47.231425047 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:47.231442928 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.231453896 CET	50098	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:47.231460094 CET	443	50098	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.765306950 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.765697956 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.766180992 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:47.766206026 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.766638041 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:47.766644001 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.766855001 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:47.766892910 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.767185926 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:47.767190933 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.876732111 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.877326012 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:47.877352953 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.877793074 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:47.877798080 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.908143997 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.908626080 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:47.908643007 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:47.909039974 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:47.909044981 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.200295925 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.200364113 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.200561047 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:48.200822115 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:48.200839996 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.200858116 CET	50100	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:48.200862885 CET	443	50100	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.311691999 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.314639091 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.314706087 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:48.314744949 CET	50101	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:48.314760923 CET	443	50101	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.343195915 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.343264103 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.344671011 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:48.403028965 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:48.403045893 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.403055906 CET	50102	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:48.403062105 CET	443	50102	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.410259008 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.413326979 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.413387060 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:48.493392944 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:48.493421078 CET	443	50099	13.107.246.63	192.168.2.4
Dec 6, 2024 17:19:48.493436098 CET	50099	443	192.168.2.4	13.107.246.63
Dec 6, 2024 17:19:48.493441105 CET	443	50099	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 17:17:03.010849953 CET	49471	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:03.641761065 CET	53	49471	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:10.504098892 CET	138	138	192.168.2.4	192.168.2.255
Dec 6, 2024 17:17:27.713819981 CET	53	64213	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:27.808558941 CET	53	59578	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:30.045721054 CET	53	52970	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:31.935889959 CET	51381	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:31.935964108 CET	60307	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:32.073577881 CET	53	51381	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:32.073612928 CET	53	60307	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:33.552094936 CET	49752	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:33.552154064 CET	60321	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:33.690656900 CET	53	49752	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:33.883543015 CET	53	60321	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:35.566639900 CET	54381	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:35.566836119 CET	60049	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:35.922909975 CET	53	54381	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:35.923877001 CET	53	60049	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:40.222608089 CET	53306	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:40.222748041 CET	51018	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:40.223264933 CET	54591	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:40.223417044 CET	58685	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:40.533468962 CET	53	58685	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:40.533541918 CET	53	54591	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:42.437341928 CET	59293	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:42.437484026 CET	57050	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:42.456679106 CET	58493	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:42.456877947 CET	55089	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:42.540719032 CET	50963	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:42.540877104 CET	58058	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:42.588896036 CET	53	57050	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:42.590150118 CET	53	59293	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:42.636485100 CET	53	55089	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:42.687988997 CET	53	58493	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:43.615159988 CET	53914	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:43.615295887 CET	57740	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:43.757230997 CET	53	53914	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:43.757860899 CET	53	57740	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:44.841027021 CET	61706	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:44.841178894 CET	54819	53	192.168.2.4	1.1.1.1
Dec 6, 2024 17:17:44.978815079 CET	53	54819	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:44.979345083 CET	53	61706	1.1.1.1	192.168.2.4
Dec 6, 2024 17:17:46.903332949 CET	53	52891	1.1.1.1	192.168.2.4
Dec 6, 2024 17:18:05.670058012 CET	53	58407	1.1.1.1	192.168.2.4
Dec 6, 2024 17:18:27.462996006 CET	53	52911	1.1.1.1	192.168.2.4
Dec 6, 2024 17:18:28.677488089 CET	53	58517	1.1.1.1	192.168.2.4
Dec 6, 2024 17:18:59.696208000 CET	53	65226	1.1.1.1	192.168.2.4
Dec 6, 2024 17:19:44.006524086 CET	53	56771	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 6, 2024 17:17:27.808643103 CET	192.168.2.4	1.1.1.1	c22c	(Port unreachable)	Destination Unreachable
Dec 6, 2024 17:17:33.883644104 CET	192.168.2.4	1.1.1.1	c265	(Port unreachable)	Destination Unreachable
Dec 6, 2024 17:18:27.463073015 CET	192.168.2.4	1.1.1.1	c224	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 17:17:03.010849953 CET	192.168.2.4	1.1.1.1	0x6294	Standard query (0)	2fa.com-token-auth.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:31.935889959 CET	192.168.2.4	1.1.1.1	0xff6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:31.935964108 CET	192.168.2.4	1.1.1.1	0x3458	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 6, 2024 17:17:33.552094936 CET	192.168.2.4	1.1.1.1	0x44b1	Standard query (0)	2fa.com-token-auth.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:33.552154064 CET	192.168.2.4	1.1.1.1	0xa8c1	Standard query (0)	2fa.com-token-auth.com	65	IN (0x0001)	false
Dec 6, 2024 17:17:35.566639900 CET	192.168.2.4	1.1.1.1	0x8f69	Standard query (0)	secured-login.net	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:35.566836119 CET	192.168.2.4	1.1.1.1	0xc41f	Standard query (0)	secured-login.net	65	IN (0x0001)	false
Dec 6, 2024 17:17:40.222608089 CET	192.168.2.4	1.1.1.1	0xed19	Standard query (0)	www.hallcounty.org	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:40.222748041 CET	192.168.2.4	1.1.1.1	0x84a6	Standard query (0)	www.hallcounty.org	65	IN (0x0001)	false
Dec 6, 2024 17:17:40.223264933 CET	192.168.2.4	1.1.1.1	0x203e	Standard query (0)	static.thenounproject.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:40.223417044 CET	192.168.2.4	1.1.1.1	0x63ab	Standard query (0)	static.thenounproject.com	65	IN (0x0001)	false
Dec 6, 2024 17:17:42.437341928 CET	192.168.2.4	1.1.1.1	0xf89f	Standard query (0)	secured-login.net	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:42.437484026 CET	192.168.2.4	1.1.1.1	0x1eda	Standard query (0)	secured-login.net	65	IN (0x0001)	false
Dec 6, 2024 17:17:42.456679106 CET	192.168.2.4	1.1.1.1	0xa4af	Standard query (0)	upload.wikimedia.org	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:42.456877947 CET	192.168.2.4	1.1.1.1	0xe94d	Standard query (0)	upload.wikimedia.org	65	IN (0x0001)	false
Dec 6, 2024 17:17:42.540719032 CET	192.168.2.4	1.1.1.1	0xa911	Standard query (0)	www.hallcounty.org	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:42.540877104 CET	192.168.2.4	1.1.1.1	0xe61e	Standard query (0)	www.hallcounty.org	65	IN (0x0001)	false
Dec 6, 2024 17:17:43.615159988 CET	192.168.2.4	1.1.1.1	0x3856	Standard query (0)	static.thenounproject.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:43.615295887 CET	192.168.2.4	1.1.1.1	0x1bd8	Standard query (0)	static.thenounproject.com	65	IN (0x0001)	false
Dec 6, 2024 17:17:44.841027021 CET	192.168.2.4	1.1.1.1	0x5e1d	Standard query (0)	upload.wikimedia.org	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:44.841178894 CET	192.168.2.4	1.1.1.1	0xd884	Standard query (0)	upload.wikimedia.org	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 17:17:03.641761065 CET	1.1.1.1	192.168.2.4	0x6294	No error (0)	2fa.com-token-auth.com	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:17:03.641761065 CET	1.1.1.1	192.168.2.4	0x6294	No error (0)	landing.training.knowbe4.com		34.196.207.207	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:03.641761065 CET	1.1.1.1	192.168.2.4	0x6294	No error (0)	landing.training.knowbe4.com		52.200.18.75	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:03.641761065 CET	1.1.1.1	192.168.2.4	0x6294	No error (0)	landing.training.knowbe4.com		52.205.74.90	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:03.641761065 CET	1.1.1.1	192.168.2.4	0x6294	No error (0)	landing.training.knowbe4.com		54.85.18.81	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:03.641761065 CET	1.1.1.1	192.168.2.4	0x6294	No error (0)	landing.training.knowbe4.com		54.87.209.204	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:03.641761065 CET	1.1.1.1	192.168.2.4	0x6294	No error (0)	landing.training.knowbe4.com		98.82.63.153	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:11.110455990 CET	1.1.1.1	192.168.2.4	0x6317	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:17:32.073577881 CET	1.1.1.1	192.168.2.4	0xff6	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:32.073612928 CET	1.1.1.1	192.168.2.4	0x3458	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 6, 2024 17:17:33.690656900 CET	1.1.1.1	192.168.2.4	0x44b1	No error (0)	2fa.com-token-auth.com	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:17:33.690656900 CET	1.1.1.1	192.168.2.4	0x44b1	No error (0)	landing.training.knowbe4.com		34.196.207.207	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:33.690656900 CET	1.1.1.1	192.168.2.4	0x44b1	No error (0)	landing.training.knowbe4.com		52.200.18.75	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:33.690656900 CET	1.1.1.1	192.168.2.4	0x44b1	No error (0)	landing.training.knowbe4.com		54.87.209.204	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:33.690656900 CET	1.1.1.1	192.168.2.4	0x44b1	No error (0)	landing.training.knowbe4.com		54.85.18.81	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:33.690656900 CET	1.1.1.1	192.168.2.4	0x44b1	No error (0)	landing.training.knowbe4.com		98.82.63.153	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:33.690656900 CET	1.1.1.1	192.168.2.4	0x44b1	No error (0)	landing.training.knowbe4.com		52.205.74.90	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:33.883543015 CET	1.1.1.1	192.168.2.4	0xa8c1	No error (0)	2fa.com-token-auth.com	landing.training.knowbe4.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:17:35.922909975 CET	1.1.1.1	192.168.2.4	0x8f69	No error (0)	secured-login.net		52.205.74.90	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:35.922909975 CET	1.1.1.1	192.168.2.4	0x8f69	No error (0)	secured-login.net		98.82.63.153	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:35.922909975 CET	1.1.1.1	192.168.2.4	0x8f69	No error (0)	secured-login.net		52.200.18.75	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:35.922909975 CET	1.1.1.1	192.168.2.4	0x8f69	No error (0)	secured-login.net		54.87.209.204	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:35.922909975 CET	1.1.1.1	192.168.2.4	0x8f69	No error (0)	secured-login.net		54.85.18.81	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:35.922909975 CET	1.1.1.1	192.168.2.4	0x8f69	No error (0)	secured-login.net		34.196.207.207	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:40.533541918 CET	1.1.1.1	192.168.2.4	0x203e	No error (0)	static.thenounproject.com		18.66.161.97	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:40.533541918 CET	1.1.1.1	192.168.2.4	0x203e	No error (0)	static.thenounproject.com		18.66.161.20	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:40.533541918 CET	1.1.1.1	192.168.2.4	0x203e	No error (0)	static.thenounproject.com		18.66.161.17	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:40.533541918 CET	1.1.1.1	192.168.2.4	0x203e	No error (0)	static.thenounproject.com		18.66.161.35	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:40.758029938 CET	1.1.1.1	192.168.2.4	0xed19	No error (0)	www.hallcounty.org	www.hallcounty.org.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:17:40.758047104 CET	1.1.1.1	192.168.2.4	0x84a6	No error (0)	www.hallcounty.org	www.hallcounty.org.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:17:42.590150118 CET	1.1.1.1	192.168.2.4	0xf89f	No error (0)	secured-login.net		52.205.74.90	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:42.590150118 CET	1.1.1.1	192.168.2.4	0xf89f	No error (0)	secured-login.net		98.82.63.153	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:42.590150118 CET	1.1.1.1	192.168.2.4	0xf89f	No error (0)	secured-login.net		52.200.18.75	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:42.590150118 CET	1.1.1.1	192.168.2.4	0xf89f	No error (0)	secured-login.net		34.196.207.207	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:42.590150118 CET	1.1.1.1	192.168.2.4	0xf89f	No error (0)	secured-login.net		54.85.18.81	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:42.590150118 CET	1.1.1.1	192.168.2.4	0xf89f	No error (0)	secured-login.net		54.87.209.204	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:42.678597927 CET	1.1.1.1	192.168.2.4	0xa911	No error (0)	www.hallcounty.org	www.hallcounty.org.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:17:42.678951025 CET	1.1.1.1	192.168.2.4	0xe61e	No error (0)	www.hallcounty.org	www.hallcounty.org.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:17:42.687988997 CET	1.1.1.1	192.168.2.4	0xa4af	No error (0)	upload.wikimedia.org		185.15.58.240	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:43.757230997 CET	1.1.1.1	192.168.2.4	0x3856	No error (0)	static.thenounproject.com		18.66.161.97	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:43.757230997 CET	1.1.1.1	192.168.2.4	0x3856	No error (0)	static.thenounproject.com		18.66.161.20	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:43.757230997 CET	1.1.1.1	192.168.2.4	0x3856	No error (0)	static.thenounproject.com		18.66.161.35	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:43.757230997 CET	1.1.1.1	192.168.2.4	0x3856	No error (0)	static.thenounproject.com		18.66.161.17	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:17:44.979345083 CET	1.1.1.1	192.168.2.4	0x5e1d	No error (0)	upload.wikimedia.org		185.15.58.240	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

2fa.com-token-auth.com

slscr.update.microsoft.com

https:

secured-login.net

static.thenounproject.com

upload.wikimedia.org

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49738	20.190.177.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:03 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-12-06 16:17:03 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-06 16:17:03 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 06 Dec 2024 16:16:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: 3591196e-169a-4431-a7e8-3f64dfec780e PPServer: PPV: 30 H: PH1PEPF00011FE5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 06 Dec 2024 16:17:03 GMT Connection: close Content-Length: 1276
2024-12-06 16:17:03 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	34.196.207.207	443	7680	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:05 UTC	427	OUT	GET /XVDgwdGo3UEdyNUtJaForT3FEQm91N3hlOE9NcFZ6OENoV0hYTHlTZFhqYldkOU00M2xhU29RUk1iai9RTnpIZDZTdHZXNUR5VExPQmpBV1ZybEtJQnBUUVpsSEJwampiTmdVbXFoNTR6eEpkKzFGNXVzM2ZaakUxbllEbE5BPT0tLXdKcGVOUk5FQ3RGRnNHd1UtLVdJZXZzd2VpR1VQdittK1E4QWc2a0E9PQ==?cid=2306703812 HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16) Accept-Encoding: gzip, deflate Host: 2fa.com-token-auth.com Connection: Keep-Alive
2024-12-06 16:17:05 UTC	486	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:05 GMT Content-Type: text/html Content-Length: 0 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Cache-Control: no-cache Content-Security-Policy: X-Request-Id: e756f2bd-fd21-4ef4-8340-77b977b0242c X-Runtime: 0.089610 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	49743	20.190.177.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:05 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-12-06 16:17:05 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 69 66 71 6b 70 72 78 63 67 71 6c 67 7a 6a 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 6d 71 75 25 5f 75 52 57 56 67 44 76 23 6b 66 78 41 36 3a 28 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02ifqkprxcgqlgzj</Membername><Password>mqu%_uRWVgDv#kfxA6:(</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-12-06 16:17:13 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Fri, 06 Dec 2024 16:16:06 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_SN1 x-ms-request-id: 87913a84-c68e-4998-ad45-5a469d71da30 PPServer: PPV: 30 H: SN1PEPF0002FAAE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 06 Dec 2024 16:17:12 GMT Connection: close Content-Length: 17166
2024-12-06 16:17:13 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 38 30 31 30 37 32 35 34 38 37 34 34 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 37 63 62 33 36 38 37 64 2d 63 30 36 35 2d 34 35 63 62 2d 62 65 34 35 2d 63 34 32 33 32 38 31 37 66 38 65 37 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018801072548744</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="7cb3687d-c065-45cb-be45-c4232817f8e7" LicenseID="3252b20c-d425-4711
2024-12-06 16:17:13 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49746	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:08 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=d3GAufgwYKWyRyo&MD=NwwuSXF6 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-06 16:17:08 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f13bdeee-9407-4227-ba31-e63121da56b7 MS-RequestId: 8d68483e-52b3-49f8-8c05-f532e8dd97c1 MS-CV: 90bTJE7Fbk+6NK0T.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Dec 2024 16:17:07 GMT Connection: close Content-Length: 24490
2024-12-06 16:17:08 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-06 16:17:08 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49749	20.190.177.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:14 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-12-06 16:17:14 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-06 16:17:15 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 06 Dec 2024 16:16:15 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_SN1 x-ms-request-id: 1a730ee2-567d-44fb-9e1e-2af7b6d26abf PPServer: PPV: 30 H: SN1PEPF0002F182 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 06 Dec 2024 16:17:15 GMT Connection: close Content-Length: 11390
2024-12-06 16:17:15 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49803	20.190.177.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:17 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-12-06 16:17:17 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-06 16:17:18 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 06 Dec 2024 16:16:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: 3f7b714f-76f8-4e15-8daf-9d780d902f27 PPServer: PPV: 30 H: PH1PEPF00011F84 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 06 Dec 2024 16:17:18 GMT Connection: close Content-Length: 1918
2024-12-06 16:17:18 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49804	20.190.177.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:20 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-12-06 16:17:20 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-06 16:17:21 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 06 Dec 2024 16:16:21 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_SN1 x-ms-request-id: 1ca5e019-b542-4a9e-88ec-edf119b07924 PPServer: PPV: 30 H: SN1PEPF0002F174 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 06 Dec 2024 16:17:20 GMT Connection: close Content-Length: 11410
2024-12-06 16:17:21 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49805	20.190.177.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:23 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-12-06 16:17:23 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-06 16:17:24 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 06 Dec 2024 16:16:23 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_SN1 x-ms-request-id: b08bf259-f439-4b96-aa2d-87cfe614646e PPServer: PPV: 30 H: SN1PEPF0002F07F V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 06 Dec 2024 16:17:23 GMT Connection: close Content-Length: 11410
2024-12-06 16:17:24 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49806	20.190.177.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:25 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4762 Host: login.live.com
2024-12-06 16:17:25 UTC	4762	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-06 16:17:26 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 06 Dec 2024 16:16:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_BAY x-ms-request-id: c30f3f08-697f-4235-833a-4769ab4bcd07 PPServer: PPV: 30 H: PH1PEPF0001B8D9 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 06 Dec 2024 16:17:25 GMT Connection: close Content-Length: 10197
2024-12-06 16:17:26 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49812	34.196.207.207	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:34 UTC	1025	OUT	GET /XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==?cid=2306703812 HTTP/1.1 Host: 2fa.com-token-auth.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:35 UTC	574	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 513 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade ETag: W/"c22c643904dcb3e3a1bb470687d731ab" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: ac9f642c-1109-498a-94ab-46501ed9b2d7 X-Runtime: 0.123646 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-06 16:17:35 UTC	513	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 20 3d 20 27 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 64 2d 6c 6f 67 69 6e 2e 6e 65 74 2f 70 61 67 65 73 2f 33 61 65 66 34 39 30 62 64 64 66 32 31 36 63 61 31 35 37 34 62 36 33 66 36 34 35 63 30 34 61 64 2f 58 59 6b 63 31 53 55 31 53 5a 30 52 78 63 30 74 5a 59 32 4a 42 5a 48 4a 4d 61 47 4a 47 57 6c 4d 32 5a 32 45 77 4d 58 6c 53 64 57 39 61 51 33 52 42 65 47 35 45 56 45 4a 57 62 6e 64 4e 65 54 59 30 62 54 52 34 55 56 42 53 63 43 74 30 4e 6e 46 42 54 69 39 4e 5a 45 67 35 63 31 51 34 54 6a 46 4e 61 6d 4e 71 56 48 68 4e 63 44 5a 45 52 7a 4e 6e 51 53 39 4d 54 55 46 69 64 45 4a 48 51 57 5a 75 59 7a 68 49 63 45 52 Data Ascii: <html> <head> <script>window.location.href = 'https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49815	52.205.74.90	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:37 UTC	1432	OUT	GET /pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ== HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://2fa.com-token-auth.com/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==?cid=2306703812 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:39 UTC	954	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 10610 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Link: </assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css>; rel=preload; as=style; nopush,</assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css>; rel=preload; as=style; nopush,</assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js>; rel=preload; as=script; nopush ETag: W/"b56520e7ac024efdaef02d0a38fe7ab5" Cache-Control: max-age=0, private, must-revalidate Content-Security-Policy: X-Request-Id: 2b985ba2-d4b9-4df6-8535-0d28bc8b3f0b X-Runtime: 1.602080 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-06 16:17:39 UTC	10610	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 49 4d 50 4f 52 54 41 4e 54 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 70 61 67 65 20 69 73 20 70 61 72 74 20 6f 66 20 61 20 73 69 6d 75 6c 61 74 65 64 20 70 68 69 73 68 69 6e 67 20 61 74 74 61 63 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"> <meta name="IMPORTANT" content="This page is part of a simulated phishing attac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49814	52.205.74.90	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:39 UTC	1010	OUT	GET /assets/landing-watermark-8487e36eef1bec74f06631f19fea0aa171c208e2976373cda5bd0a4b9e230903.css HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:40 UTC	263	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:40 GMT Content-Type: text/css Content-Length: 1471 Connection: close Last-Modified: Fri, 06 Dec 2024 15:39:33 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-06 16:17:40 UTC	1471	IN	Data Raw: 2f 2a 20 6c 69 6e 65 20 31 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 74 65 72 6d 61 72 6b 2e 73 63 73 73 20 2a 2f 0a 2e 77 61 74 65 72 6d 61 72 6b 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 20 20 20 20 2d 6d 73 2d 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 74 62 2d 72 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 77 72 69 74 69 6e 67 2d 6d 6f 64 65 3a 20 76 65 72 74 69 63 61 6c 2d 72 6c 3b 0a 20 20 74 65 78 74 2d 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 73 69 64 65 77 61 79 73 3b 0a 7d 0a 0a 2f 2a 20 6c 69 6e 65 20 34 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 6c 61 6e 64 69 6e 67 2d 77 61 Data Ascii: /* line 1, app/assets/stylesheets/landing-watermark.scss /.watermark { -webkit-writing-mode: vertical-rl; -ms-writing-mode: tb-rl; writing-mode: vertical-rl; text-orientation: sideways;}/ line 4, app/assets/stylesheets/landing-wa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49816	52.205.74.90	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:40 UTC	1003	OUT	GET /assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:41 UTC	263	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:41 GMT Content-Type: text/css Content-Length: 5934 Connection: close Last-Modified: Fri, 06 Dec 2024 15:39:33 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-06 16:17:41 UTC	5934	IN	Data Raw: 2f 2a 20 6c 69 6e 65 20 32 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 73 65 69 2d 73 74 79 6c 65 73 2e 73 63 73 73 20 2a 2f 0a 78 2d 73 65 69 2e 73 65 69 2d 66 6c 61 67 20 7b 0a 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 6f 6d 61 74 6f 3b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 33 70 78 3b 0a 7d 0a 0a 2f 2a 20 6c 69 6e 65 20 36 2c 20 61 70 70 2f 61 73 73 65 74 73 2f 73 74 79 6c 65 73 68 65 65 74 73 2f 73 65 69 2d 73 74 79 6c 65 73 2e 73 63 73 73 20 2a 2f 0a 78 2d 73 65 69 2e 73 65 69 2d 66 6c 61 67 3a 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 27 20 27 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 62 61 63 6b 67 Data Ascii: /* line 2, app/assets/stylesheets/sei-styles.scss /x-sei.sei-flag { border-bottom: 2px solid tomato; padding-left: 3px;}/ line 6, app/assets/stylesheets/sei-styles.scss */x-sei.sei-flag::before { content: ' '; display: inline-block; backg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49817	52.205.74.90	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:40 UTC	989	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:41 UTC	279	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:41 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Fri, 06 Dec 2024 15:39:33 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-06 16:17:41 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-06 16:17:41 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-12-06 16:17:41 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-12-06 16:17:41 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-12-06 16:17:41 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-12-06 16:17:41 UTC	16384	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-12-06 16:17:42 UTC	16384	IN	Data Raw: 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 3d 21 31 21 3d 3d 65 2e 6a 73 6f 6e 70 26 26 28 5a 74 2e 74 65 73 74 28 65 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 61 74 61 26 26 30 3d 3d 3d 28 65 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 5a 74 2e 74 65 73 74 28 65 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 61 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 65 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 72 3d 65 2e 6a 73 6f 6e 70 43 61 6c Data Ascii: efilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Zt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Zt.test(e.data)&&"data");if(a\|\|"jsonp"===e.dataTypes[0])return r=e.jsonpCal
2024-12-06 16:17:42 UTC	16384	IN	Data Raw: 74 65 72 22 2c 69 5b 31 5d 3d 6c 2e 74 65 73 74 28 69 5b 31 5d 29 3f 69 5b 31 5d 3a 22 63 65 6e 74 65 72 22 2c 74 3d 68 2e 65 78 65 63 28 69 5b 30 5d 29 2c 65 3d 68 2e 65 78 65 63 28 69 5b 31 5d 29 2c 77 5b 74 68 69 73 5d 3d 5b 74 3f 74 5b 30 5d 3a 30 2c 65 3f 65 5b 30 5d 3a 30 5d 2c 75 5b 74 68 69 73 5d 3d 5b 63 2e 65 78 65 63 28 69 5b 30 5d 29 5b 30 5d 2c 63 2e 65 78 65 63 28 69 5b 31 5d 29 5b 30 5d 5d 7d 29 2c 31 3d 3d 3d 79 2e 6c 65 6e 67 74 68 26 26 28 79 5b 31 5d 3d 79 5b 30 5d 29 2c 22 72 69 67 68 74 22 3d 3d 3d 75 2e 61 74 5b 30 5d 3f 6d 2e 6c 65 66 74 2b 3d 70 3a 22 63 65 6e 74 65 72 22 3d 3d 3d 75 2e 61 74 5b 30 5d 26 26 28 6d 2e 6c 65 66 74 2b 3d 70 2f 32 29 2c 22 62 6f 74 74 6f 6d 22 3d 3d 3d 75 2e 61 74 5b 31 5d 3f 6d 2e 74 6f 70 2b 3d 66 3a Data Ascii: ter",i[1]=l.test(i[1])?i[1]:"center",t=h.exec(i[0]),e=h.exec(i[1]),w[this]=[t?t[0]:0,e?e[0]:0],u[this]=[c.exec(i[0])[0],c.exec(i[1])[0]]}),1===y.length&&(y[1]=y[0]),"right"===u.at[0]?m.left+=p:"center"===u.at[0]&&(m.left+=p/2),"bottom"===u.at[1]?m.top+=f:
2024-12-06 16:17:42 UTC	16384	IN	Data Raw: 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 2e 6f 66 66 73 65 74 28 29 2c 65 3d 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 3b 72 65 74 75 72 6e 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 21 3d 3d 65 26 26 56 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 2c 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 5b 30 5d 29 26 26 28 74 2e 6c 65 66 74 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 2c 74 2e 74 6f 70 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 Data Ascii: ffset:function(){var t=this.offsetParent.offset(),e=this.document[0];return"absolute"===this.cssPosition&&this.scrollParent[0]!==e&&V.contains(this.scrollParent[0],this.offsetParent[0])&&(t.left+=this.scrollParent.scrollLeft(),t.top+=this.scrollParent.scr
2024-12-06 16:17:42 UTC	16384	IN	Data Raw: 74 2e 6f 66 66 73 65 74 28 29 2c 6e 5b 69 5d 2e 70 72 6f 70 6f 72 74 69 6f 6e 73 28 7b 77 69 64 74 68 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 68 65 69 67 68 74 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7d 29 29 7d 7d 2c 64 72 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 56 2e 65 61 63 68 28 28 56 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 6f 70 70 61 62 6c 65 73 5b 74 2e 6f 70 74 69 6f 6e 73 2e 73 63 6f 70 65 5d 7c 7c 5b 5d 29 2e 73 6c 69 63 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 26 26 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 Data Ascii: t.offset(),n[i].proportions({width:n[i].element[0].offsetWidth,height:n[i].element[0].offsetHeight}))}},drop:function(t,e){var i=!1;return V.each((V.ui.ddmanager.droppables[t.options.scope]\|\|[]).slice(),function(){this.options&&(!this.options.disabled&&th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49818	18.66.161.97	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:42 UTC	988	OUT	GET /png/113149-200.png HTTP/1.1 Host: static.thenounproject.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:43 UTC	510	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 3299 Connection: close Date: Fri, 06 Dec 2024 16:17:44 GMT Last-Modified: Fri, 07 Aug 2015 16:01:17 GMT ETag: "1e158165ab6a84e827cede6f6ddbd053" Cache-Control: max-age=604800, public x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 4cc1f4a5fc43c9a7209c93d5255b40b0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH52-C1 X-Amz-Cf-Id: WQdqAAtBzHlV-5mQzX72Y_nikut6SE8YdAnRHyetVFHIOttPHsZ3Eg==
2024-12-06 16:17:43 UTC	3299	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 08 06 00 00 00 ad 58 ae 9e 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0c 85 49 44 41 54 78 9c ed dd 79 90 1d 55 15 c7 f1 ef 24 21 09 61 8d ec 60 10 24 20 62 c0 02 03 88 20 18 14 11 94 25 ec 5a a0 22 96 4a a1 85 82 14 a0 82 bb 22 4a 19 05 2d 14 41 14 97 52 88 04 28 40 50 16 01 11 49 04 41 59 64 4f 20 06 02 26 40 20 90 99 24 e3 1f 77 86 4c 3a 6f de 74 df 73 7a b9 f3 7e 9f aa f3 e7 dc be a7 fb dc 79 ef 75 df be 17 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 8a e9 2a b9 fd 31 Data Ascii: PNGIHDRXsBIT\|dpHYsIDATxyU$!a`$ b %Z"J"J-AR(@PIAYdO &@ $wL:otsz~yuDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD*1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49821	52.205.74.90	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:43 UTC	427	OUT	GET /assets/application-237cb5c4f318687625f8ccf2f42de3fc20238bfe267384653491a6bba8c8f6f5.js HTTP/1.1 Host: secured-login.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:44 UTC	279	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:44 GMT Content-Type: application/javascript Content-Length: 380848 Connection: close Last-Modified: Fri, 06 Dec 2024 15:39:33 GMT Vary: accept-encoding Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-06 16:17:44 UTC	16105	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 37 2e 31 20 7c 20 28 63 29 20 4f 70 65 6e 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 Data Ascii: /! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQu
2024-12-06 16:17:44 UTC	16384	IN	Data Raw: 4e 61 6d 65 29 7d 2c 69 6e 70 75 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 4e 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7d 2c 62 75 74 74 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 62 75 74 74 6f 6e 22 3d 3d 3d 65 2e 74 79 70 65 7c 7c 66 65 28 65 2c 22 62 75 74 74 6f 6e 22 29 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 66 65 28 65 2c 22 69 6e 70 75 74 22 29 26 26 22 74 65 78 74 22 3d 3d 3d 65 2e 74 79 70 65 26 26 28 6e 75 6c 6c 3d 3d 28 74 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 29 7c 7c 22 74 65 78 74 22 3d 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7d 2c 66 69 72 Data Ascii: Name)},input:function(e){return N.test(e.nodeName)},button:function(e){return fe(e,"input")&&"button"===e.type\|\|fe(e,"button")},text:function(e){var t;return fe(e,"input")&&"text"===e.type&&(null==(t=e.getAttribute("type"))\|\|"text"===t.toLowerCase())},fir
2024-12-06 16:17:44 UTC	56	IN	Data Raw: 28 65 2c 6e 29 7c 7c 5f 2e 61 63 63 65 73 73 28 65 2c 6e 2c 7b 65 6d 70 74 79 3a 63 65 2e 43 61 6c 6c 62 61 63 6b 73 28 22 6f 6e 63 65 20 6d 65 6d 6f 72 79 22 29 2e 61 Data Ascii: (e,n)\|\|_.access(e,n,{empty:ce.Callbacks("once memory").a
2024-12-06 16:17:44 UTC	16384	IN	Data Raw: 64 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 2e 72 65 6d 6f 76 65 28 65 2c 5b 74 2b 22 71 75 65 75 65 22 2c 6e 5d 29 7d 29 7d 29 7d 7d 29 2c 63 65 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 71 75 65 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 76 61 72 20 65 3d 32 3b 72 65 74 75 72 6e 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 74 26 26 28 6e 3d 74 2c 74 3d 22 66 78 22 2c 65 2d 2d 29 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 65 3f 63 65 2e 71 75 65 75 65 28 74 68 69 73 5b 30 5d 2c 74 29 3a 76 6f 69 64 20 30 3d 3d 3d 6e 3f 74 68 69 73 3a 74 68 69 73 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 63 65 2e 71 75 65 75 65 28 74 68 69 73 2c 74 2c 6e 29 3b 63 65 2e 5f 71 75 65 75 65 48 6f 6f 6b 73 28 74 68 69 73 2c 74 29 Data Ascii: dd(function(){_.remove(e,[t+"queue",n])})})}}),ce.fn.extend({queue:function(t,n){var e=2;return"string"!=typeof t&&(n=t,t="fx",e--),arguments.length<e?ce.queue(this[0],t):void 0===n?this:this.each(function(){var e=ce.queue(this,t,n);ce._queueHooks(this,t)
2024-12-06 16:17:44 UTC	16384	IN	Data Raw: 74 68 69 73 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 63 65 2e 69 6e 41 72 72 61 79 28 74 68 69 73 2c 6e 29 3c 30 26 26 28 63 65 2e 63 6c 65 61 6e 44 61 74 61 28 53 65 28 74 68 69 73 29 29 2c 74 26 26 74 2e 72 65 70 6c 61 63 65 43 68 69 6c 64 28 65 2c 74 68 69 73 29 29 7d 2c 6e 29 7d 7d 29 2c 63 65 2e 65 61 63 68 28 7b 61 70 70 65 6e 64 54 6f 3a 22 61 70 70 65 6e 64 22 2c 70 72 65 70 65 6e 64 54 6f 3a 22 70 72 65 70 65 6e 64 22 2c 69 6e 73 65 72 74 42 65 66 6f 72 65 3a 22 62 65 66 6f 72 65 22 2c 69 6e 73 65 72 74 41 66 74 65 72 3a 22 61 66 74 65 72 22 2c 72 65 70 6c 61 63 65 41 6c 6c 3a 22 72 65 70 6c 61 63 65 57 69 74 68 22 7d 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 63 65 2e 66 6e 5b 65 5d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: this.parentNode;ce.inArray(this,n)<0&&(ce.cleanData(Se(this)),t&&t.replaceChild(e,this))},n)}}),ce.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(e,a){ce.fn[e]=function(e){for(var t
2024-12-06 16:17:44 UTC	16384	IN	Data Raw: 28 72 3d 69 2e 73 65 74 28 65 2c 6e 2c 74 29 29 3f 72 3a 65 5b 74 5d 3d 6e 3a 69 26 26 22 67 65 74 22 69 6e 20 69 26 26 6e 75 6c 6c 21 3d 3d 28 72 3d 69 2e 67 65 74 28 65 2c 74 29 29 3f 72 3a 65 5b 74 5d 7d 2c 70 72 6f 70 48 6f 6f 6b 73 3a 7b 74 61 62 49 6e 64 65 78 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 63 65 2e 66 69 6e 64 2e 61 74 74 72 28 65 2c 22 74 61 62 69 6e 64 65 78 22 29 3b 72 65 74 75 72 6e 20 74 3f 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 62 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7c 7c 77 74 2e 74 65 73 74 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 65 2e 68 72 65 66 3f 30 3a 2d 31 7d 7d 7d 2c 70 72 6f 70 46 69 78 3a 7b 22 66 6f 72 22 3a 22 68 74 6d 6c 46 6f 72 22 2c 22 63 6c 61 73 73 22 3a 22 Data Ascii: (r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=ce.find.attr(e,"tabindex");return t?parseInt(t,10):bt.test(e.nodeName)\|\|wt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"
2024-12-06 16:17:44 UTC	16384	IN	Data Raw: 65 66 69 6c 74 65 72 28 22 6a 73 6f 6e 20 6a 73 6f 6e 70 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 3d 21 31 21 3d 3d 65 2e 6a 73 6f 6e 70 26 26 28 5a 74 2e 74 65 73 74 28 65 2e 75 72 6c 29 3f 22 75 72 6c 22 3a 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 2e 64 61 74 61 26 26 30 3d 3d 3d 28 65 2e 63 6f 6e 74 65 6e 74 54 79 70 65 7c 7c 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 29 26 26 5a 74 2e 74 65 73 74 28 65 2e 64 61 74 61 29 26 26 22 64 61 74 61 22 29 3b 69 66 28 61 7c 7c 22 6a 73 6f 6e 70 22 3d 3d 3d 65 2e 64 61 74 61 54 79 70 65 73 5b 30 5d 29 72 65 74 75 72 6e 20 72 3d 65 2e 6a 73 6f 6e 70 43 61 6c Data Ascii: efilter("json jsonp",function(e,t,n){var r,i,o,a=!1!==e.jsonp&&(Zt.test(e.url)?"url":"string"==typeof e.data&&0===(e.contentType\|\|"").indexOf("application/x-www-form-urlencoded")&&Zt.test(e.data)&&"data");if(a\|\|"jsonp"===e.dataTypes[0])return r=e.jsonpCal
2024-12-06 16:17:44 UTC	16384	IN	Data Raw: 74 65 72 22 2c 69 5b 31 5d 3d 6c 2e 74 65 73 74 28 69 5b 31 5d 29 3f 69 5b 31 5d 3a 22 63 65 6e 74 65 72 22 2c 74 3d 68 2e 65 78 65 63 28 69 5b 30 5d 29 2c 65 3d 68 2e 65 78 65 63 28 69 5b 31 5d 29 2c 77 5b 74 68 69 73 5d 3d 5b 74 3f 74 5b 30 5d 3a 30 2c 65 3f 65 5b 30 5d 3a 30 5d 2c 75 5b 74 68 69 73 5d 3d 5b 63 2e 65 78 65 63 28 69 5b 30 5d 29 5b 30 5d 2c 63 2e 65 78 65 63 28 69 5b 31 5d 29 5b 30 5d 5d 7d 29 2c 31 3d 3d 3d 79 2e 6c 65 6e 67 74 68 26 26 28 79 5b 31 5d 3d 79 5b 30 5d 29 2c 22 72 69 67 68 74 22 3d 3d 3d 75 2e 61 74 5b 30 5d 3f 6d 2e 6c 65 66 74 2b 3d 70 3a 22 63 65 6e 74 65 72 22 3d 3d 3d 75 2e 61 74 5b 30 5d 26 26 28 6d 2e 6c 65 66 74 2b 3d 70 2f 32 29 2c 22 62 6f 74 74 6f 6d 22 3d 3d 3d 75 2e 61 74 5b 31 5d 3f 6d 2e 74 6f 70 2b 3d 66 3a Data Ascii: ter",i[1]=l.test(i[1])?i[1]:"center",t=h.exec(i[0]),e=h.exec(i[1]),w[this]=[t?t[0]:0,e?e[0]:0],u[this]=[c.exec(i[0])[0],c.exec(i[1])[0]]}),1===y.length&&(y[1]=y[0]),"right"===u.at[0]?m.left+=p:"center"===u.at[0]&&(m.left+=p/2),"bottom"===u.at[1]?m.top+=f:
2024-12-06 16:17:44 UTC	16384	IN	Data Raw: 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 2e 6f 66 66 73 65 74 28 29 2c 65 3d 74 68 69 73 2e 64 6f 63 75 6d 65 6e 74 5b 30 5d 3b 72 65 74 75 72 6e 22 61 62 73 6f 6c 75 74 65 22 3d 3d 3d 74 68 69 73 2e 63 73 73 50 6f 73 69 74 69 6f 6e 26 26 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 21 3d 3d 65 26 26 56 2e 63 6f 6e 74 61 69 6e 73 28 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 5b 30 5d 2c 74 68 69 73 2e 6f 66 66 73 65 74 50 61 72 65 6e 74 5b 30 5d 29 26 26 28 74 2e 6c 65 66 74 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 6f 6c 6c 4c 65 66 74 28 29 2c 74 2e 74 6f 70 2b 3d 74 68 69 73 2e 73 63 72 6f 6c 6c 50 61 72 65 6e 74 2e 73 63 72 Data Ascii: ffset:function(){var t=this.offsetParent.offset(),e=this.document[0];return"absolute"===this.cssPosition&&this.scrollParent[0]!==e&&V.contains(this.scrollParent[0],this.offsetParent[0])&&(t.left+=this.scrollParent.scrollLeft(),t.top+=this.scrollParent.scr
2024-12-06 16:17:44 UTC	16384	IN	Data Raw: 74 2e 6f 66 66 73 65 74 28 29 2c 6e 5b 69 5d 2e 70 72 6f 70 6f 72 74 69 6f 6e 73 28 7b 77 69 64 74 68 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 57 69 64 74 68 2c 68 65 69 67 68 74 3a 6e 5b 69 5d 2e 65 6c 65 6d 65 6e 74 5b 30 5d 2e 6f 66 66 73 65 74 48 65 69 67 68 74 7d 29 29 7d 7d 2c 64 72 6f 70 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 56 2e 65 61 63 68 28 28 56 2e 75 69 2e 64 64 6d 61 6e 61 67 65 72 2e 64 72 6f 70 70 61 62 6c 65 73 5b 74 2e 6f 70 74 69 6f 6e 73 2e 73 63 6f 70 65 5d 7c 7c 5b 5d 29 2e 73 6c 69 63 65 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 26 26 28 21 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 64 69 73 61 62 6c 65 64 26 26 74 68 Data Ascii: t.offset(),n[i].proportions({width:n[i].element[0].offsetWidth,height:n[i].element[0].offsetHeight}))}},drop:function(t,e){var i=!1;return V.each((V.ui.ddmanager.droppables[t.options.scope]\|\|[]).slice(),function(){this.options&&(!this.options.disabled&&th

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49820	52.205.74.90	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:43 UTC	749	OUT	GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/assets/sei-styles-1837e0b6e1baaf1af90438028a176241b70a365a8a09ff4bf668cf3bf9e3c759.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:44 UTC	241	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:44 GMT Content-Type: image/png Content-Length: 3168 Connection: close Last-Modified: Fri, 06 Dec 2024 15:39:33 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-06 16:17:44 UTC	3168	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f0 00 00 00 f0 08 06 00 00 00 3e 55 e9 92 00 00 0c 27 49 44 41 54 78 da ed 9d 5d 88 5c e5 19 80 65 09 21 88 48 90 10 42 2f 4a 08 22 22 22 52 8a 84 52 a4 88 14 e9 45 29 22 d2 0b 2f 8a 17 22 e2 85 48 10 11 33 73 e6 cc 99 99 9d cc fe 26 ec 4f c2 0e 9b dd 64 0d 51 4a 13 4c 8c 89 11 11 1b ac 50 ed 85 6d a5 55 bb 8d 75 b3 51 b3 99 24 9b ec ee fc ad 7d bf 35 17 a9 4d 9c dd ec ec bc df 7b f6 79 e0 21 41 e2 ce 9c ef 7c cf 7c df d9 d9 33 7b cb 2d 4d e6 db ed db bf 6d a6 cd 7e 7e 00 f0 03 10 30 80 61 08 18 c0 30 04 0c 60 18 02 06 30 0c 01 03 18 86 80 01 0c 43 c0 00 86 21 60 00 c3 10 30 80 61 08 18 c0 30 04 bc 3c fe 7a fc f8 ba 0b 03 03 77 cd 74 74 3c 58 ce 66 1f ab 66 b3 4f cd 66 b3 2f d6 a2 28 51 4b 26 73 e5 Data Ascii: PNGIHDR>U'IDATx]\e!HB/J"""RRE)"/"H3s&OdQJLPmUuQ$}5M{y!A\|\|3{-Mm~~0a0`0C!`0a0<zwtt<XffOf/(QK&s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49823	185.15.58.240	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:44 UTC	1076	OUT	GET /wikipedia/commons/thumb/3/36/Chevron-down%2C_Web_Fundamentals.svg/10px-Chevron-down%2C_Web_Fundamentals.svg.png HTTP/1.1 Host: upload.wikimedia.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:44 UTC	1071	IN	HTTP/1.1 200 OK content-type: image/png content-disposition: inline;filename=UTF-8''Chevron-down%2C_Web_Fundamentals.svg.png last-modified: Wed, 17 Jul 2024 18:04:33 GMT content-length: 379 date: Fri, 06 Dec 2024 16:12:32 GMT server: envoy etag: cb6887b44d515927ff81a5292c94d783 age: 312 x-cache: cp6006 hit, cp6003 hit/2 x-cache-status: hit-front server-timing: cache;desc="hit-front", host;desc="cp6003" strict-transport-security: max-age=106384710; includeSubDomains; preload report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} x-client-ip: 8.46.123.228 x-content-type-options: nosniff access-control-allow-origin: access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache timing-allow-origin: * accept-ranges: bytes connection: close
2024-12-06 16:17:44 UTC	379	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0a 00 00 00 07 08 04 00 00 00 9b a5 14 e8 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 00 07 74 49 4d 45 07 e8 07 11 12 04 20 2c e6 4d 77 00 00 00 83 49 44 41 54 08 d7 63 f0 5d 14 ca c9 80 04 42 d9 7c 67 32 31 c4 fe 3c ec 2b 07 13 f2 93 fa 71 80 21 8d 89 81 e1 bf 31 c3 19 1f 07 06 06 06 06 7f ab ff 67 18 2c 19 18 98 35 9e 33 b8 33 f0 31 46 69 bc 52 37 fe bf 92 41 80 e1 17 63 16 23 03 83 b7 31 d3 3a 06 98 01 cf fe 87 6c 39 ce c4 c0 b0 f5 ec 1f 13 86 03 0c 0c 0c 0c ff 8f b1 9a 6c 39 ce c0 c0 08 b3 f3 c7 64 06 06 8e dc d5 Data Ascii: PNGIHDRgAMAa cHRMz&u0`:pQ<bKGDtIME ,MwIDATc]B\|g21<+q!1g,5331FiR7Ac#1:l9l9d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49824	18.66.161.97	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:45 UTC	367	OUT	GET /png/113149-200.png HTTP/1.1 Host: static.thenounproject.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:46 UTC	510	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 3299 Connection: close Date: Fri, 06 Dec 2024 16:17:47 GMT Last-Modified: Fri, 07 Aug 2015 16:01:17 GMT ETag: "1e158165ab6a84e827cede6f6ddbd053" Cache-Control: max-age=604800, public x-amz-version-id: null Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 62f08065c1f082b40f47b381b6d213ca.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH52-C1 X-Amz-Cf-Id: il_mn7d-ZQacYtV0fEv7MCJ9T5Dks72LLcIsAxhNNllQcu2F7HTIRw==
2024-12-06 16:17:46 UTC	3299	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 c8 00 00 00 c8 08 06 00 00 00 ad 58 ae 9e 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0c 85 49 44 41 54 78 9c ed dd 79 90 1d 55 15 c7 f1 ef 24 21 09 61 8d ec 60 10 24 20 62 c0 02 03 88 20 18 14 11 94 25 ec 5a a0 22 96 4a a1 85 82 14 a0 82 bb 22 4a 19 05 2d 14 41 14 97 52 88 04 28 40 50 16 01 11 49 04 41 59 64 4f 20 06 02 26 40 20 90 99 24 e3 1f 77 86 4c 3a 6f de 74 df 73 7a b9 f3 7e 9f aa f3 e7 dc be a7 fb dc 79 ef 75 df be 17 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 44 8a e9 2a b9 fd 31 Data Ascii: PNGIHDRXsBIT\|dpHYsIDATxyU$!a`$ b %Z"J"J-AR(@PIAYdO &@ $wL:otsz~yuDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD*1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49825	52.205.74.90	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:46 UTC	425	OUT	GET /assets/sei-flag-90af55d793544fe1893f26677661a4252761afbe811fab0eced85c67bc82f984.png HTTP/1.1 Host: secured-login.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:46 UTC	241	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:46 GMT Content-Type: image/png Content-Length: 3168 Connection: close Last-Modified: Fri, 06 Dec 2024 15:39:33 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload
2024-12-06 16:17:46 UTC	3168	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 f0 00 00 00 f0 08 06 00 00 00 3e 55 e9 92 00 00 0c 27 49 44 41 54 78 da ed 9d 5d 88 5c e5 19 80 65 09 21 88 48 90 10 42 2f 4a 08 22 22 22 52 8a 84 52 a4 88 14 e9 45 29 22 d2 0b 2f 8a 17 22 e2 85 48 10 11 33 73 e6 cc 99 99 9d cc fe 26 ec 4f c2 0e 9b dd 64 0d 51 4a 13 4c 8c 89 11 11 1b ac 50 ed 85 6d a5 55 bb 8d 75 b3 51 b3 99 24 9b ec ee fc ad 7d bf 35 17 a9 4d 9c dd ec ec bc df 7b f6 79 e0 21 41 e2 ce 9c ef 7c cf 7c df d9 d9 33 7b cb 2d 4d e6 db ed db bf 6d a6 cd 7e 7e 00 f0 03 10 30 80 61 08 18 c0 30 04 0c 60 18 02 06 30 0c 01 03 18 86 80 01 0c 43 c0 00 86 21 60 00 c3 10 30 80 61 08 18 c0 30 04 bc 3c fe 7a fc f8 ba 0b 03 03 77 cd 74 74 3c 58 ce 66 1f ab 66 b3 4f cd 66 b3 2f d6 a2 28 51 4b 26 73 e5 Data Ascii: PNGIHDR>U'IDATx]\e!HB/J"""RRE)"/"H3s&OdQJLPmUuQ$}5M{y!A\|\|3{-Mm~~0a0`0C!`0a0<zwtt<XffOf/(QK&s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49826	52.205.74.90	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:46 UTC	974	OUT	GET /favicon.ico HTTP/1.1 Host: secured-login.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://secured-login.net/pages/3aef490bddf216ca1574b63f645c04ad/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ== Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:46 UTC	253	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:46 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Fri, 06 Dec 2024 15:40:17 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49828	185.15.58.240	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:46 UTC	455	OUT	GET /wikipedia/commons/thumb/3/36/Chevron-down%2C_Web_Fundamentals.svg/10px-Chevron-down%2C_Web_Fundamentals.svg.png HTTP/1.1 Host: upload.wikimedia.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:47 UTC	1071	IN	HTTP/1.1 200 OK content-type: image/png content-disposition: inline;filename=UTF-8''Chevron-down%2C_Web_Fundamentals.svg.png last-modified: Wed, 17 Jul 2024 18:04:33 GMT content-length: 379 date: Fri, 06 Dec 2024 16:12:32 GMT server: envoy etag: cb6887b44d515927ff81a5292c94d783 age: 314 x-cache: cp6006 hit, cp6003 hit/3 x-cache-status: hit-front server-timing: cache;desc="hit-front", host;desc="cp6003" strict-transport-security: max-age=106384710; includeSubDomains; preload report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} x-client-ip: 8.46.123.228 x-content-type-options: nosniff access-control-allow-origin: access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache timing-allow-origin: * accept-ranges: bytes connection: close
2024-12-06 16:17:47 UTC	379	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 0a 00 00 00 07 08 04 00 00 00 9b a5 14 e8 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 02 62 4b 47 44 00 ff 87 8f cc bf 00 00 00 07 74 49 4d 45 07 e8 07 11 12 04 20 2c e6 4d 77 00 00 00 83 49 44 41 54 08 d7 63 f0 5d 14 ca c9 80 04 42 d9 7c 67 32 31 c4 fe 3c ec 2b 07 13 f2 93 fa 71 80 21 8d 89 81 e1 bf 31 c3 19 1f 07 06 06 06 06 7f ab ff 67 18 2c 19 18 98 35 9e 33 b8 33 f0 31 46 69 bc 52 37 fe bf 92 41 80 e1 17 63 16 23 03 83 b7 31 d3 3a 06 98 01 cf fe 87 6c 39 ce c4 c0 b0 f5 ec 1f 13 86 03 0c 0c 0c 0c ff 8f b1 9a 6c 39 ce c0 c0 08 b3 f3 c7 64 06 06 8e dc d5 Data Ascii: PNGIHDRgAMAa cHRMz&u0`:pQ<bKGDtIME ,MwIDATc]B\|g21<+q!1g,5331FiR7Ac#1:l9l9d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49829	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:46 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=d3GAufgwYKWyRyo&MD=NwwuSXF6 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-06 16:17:47 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 9df13bd6-39aa-418b-a5d8-334cb05ab62d MS-RequestId: 2c5e97ea-88f8-4ada-8b8c-46241b2870ca MS-CV: Z4u7OhlXLkmXR0xD.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 06 Dec 2024 16:17:46 GMT Connection: close Content-Length: 30005
2024-12-06 16:17:47 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-06 16:17:47 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49830	52.205.74.90	443	5904	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:47 UTC	352	OUT	GET /favicon.ico HTTP/1.1 Host: secured-login.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 16:17:48 UTC	253	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:48 GMT Content-Type: image/vnd.microsoft.icon Content-Length: 0 Connection: close Last-Modified: Fri, 06 Dec 2024 15:40:17 GMT Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49831	34.196.207.207	443	7680	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:48 UTC	427	OUT	GET /XVDgwdGo3UEdyNUtJaForT3FEQm91N3hlOE9NcFZ6OENoV0hYTHlTZFhqYldkOU00M2xhU29RUk1iai9RTnpIZDZTdHZXNUR5VExPQmpBV1ZybEtJQnBUUVpsSEJwampiTmdVbXFoNTR6eEpkKzFGNXVzM2ZaakUxbllEbE5BPT0tLXdKcGVOUk5FQ3RGRnNHd1UtLVdJZXZzd2VpR1VQdittK1E4QWc2a0E9PQ==?cid=2306703812 HTTP/1.1 Accept: / User-Agent: Mozilla/4.0 (compatible; ms-office; MSOffice 16) Accept-Encoding: gzip, deflate Host: 2fa.com-token-auth.com Connection: Keep-Alive
2024-12-06 16:17:48 UTC	486	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:48 GMT Content-Type: text/html Content-Length: 0 Connection: close X-Frame-Options: SAMEORIGIN X-XSS-Protection: 0 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer-when-downgrade Cache-Control: no-cache Content-Security-Policy: X-Request-Id: 4919fe84-2914-424e-b15b-ebb7c9b77093 X-Runtime: 0.125301 Strict-Transport-Security: max-age=63113904; includeSubDomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:49 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:50 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:50 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 05 Dec 2024 15:18:57 GMT ETag: "0x8DD1540234F33E7" x-ms-request-id: c4b28cbf-a01e-0053-235f-478603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161750Z-1746fd949bdwt8wrhC1EWRu6rg00000004n000000000byq4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:50 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-06 16:17:50 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-06 16:17:50 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-06 16:17:50 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-06 16:17:50 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-06 16:17:50 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-06 16:17:50 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-06 16:17:50 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-06 16:17:50 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-06 16:17:50 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:52 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:53 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:52 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 40031d31-601e-005c-53c5-45f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161752Z-1746fd949bdb8xvchC1EWRmbd4000000049g00000000urpv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:53 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:52 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:52 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c4831996-901e-0016-39ce-45efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161752Z-1746fd949bdtlp5chC1EWRq1v400000004f0000000005ss8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:53 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:52 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:53 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:52 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: efe15fe4-901e-0048-7098-46b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161752Z-1746fd949bdnq7x2hC1EWRpxr0000000045000000000uwbr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:53 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:52 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:53 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:52 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 667c147a-501e-0016-34cc-45181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161752Z-1746fd949bdmv56chC1EWRypnn00000004q0000000003694 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:53 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:52 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:52 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 9ac3d201-201e-0000-03c5-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161752Z-1746fd949bd7wvgbhC1EWR0rgs00000004g000000000eyv6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:53 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:54 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:55 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4628c04c-d01e-0017-18cc-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161755Z-1746fd949bddgsvjhC1EWRum2c00000004s000000000appp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:55 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:54 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:55 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: d3611829-901e-007b-22c2-45ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161755Z-1746fd949bdkw94lhC1EWRxuz400000004f000000000xcvn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:55 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:54 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:55 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 4a622c55-e01e-0099-7fc1-45da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161755Z-1746fd949bdl6zq5hC1EWRf3ws000000043000000000hsxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:55 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:54 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:55 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: c2908fd4-501e-00a0-4ac8-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161755Z-1746fd949bdqpttnhC1EWRe1wg000000042g00000000tymm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:55 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:54 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:55 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:55 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: d431d6df-c01e-008d-65c2-462eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161755Z-1746fd949bdkw94lhC1EWRxuz400000004n000000000cr5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:55 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:57 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:57 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2b878731-501e-008c-34ce-45cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161757Z-1746fd949bdjzh7thC1EWR3g6400000004gg00000000aw91 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:57 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:57 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:57 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 6223bc78-401e-0015-38b6-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161757Z-1746fd949bdmv56chC1EWRypnn00000004hg00000000me71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:57 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:57 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:57 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: c2a94a43-501e-00a0-7dd0-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161757Z-1746fd949bdqpttnhC1EWRe1wg000000044g00000000kur6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:57 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:57 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:57 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 864f0b94-901e-00a0-42cc-456a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161757Z-1746fd949bdnq7x2hC1EWRpxr0000000045000000000uwp9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:57 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:57 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:57 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:57 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6818e2c2-d01e-0065-16d2-45b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161757Z-1746fd949bdmv56chC1EWRypnn00000004mg00000000dc0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:57 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:59 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:59 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: b5189c33-801e-008c-34cb-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161759Z-1746fd949bdkw94lhC1EWRxuz400000004q00000000043uw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:59 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:59 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:59 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: de914170-201e-0000-68ad-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161759Z-1746fd949bdlqd7fhC1EWR6vt000000004g000000000ryzc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:59 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:59 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:59 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 16655d81-601e-0084-07c4-456b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161759Z-1746fd949bdjrnwqhC1EWRpg2800000004g000000000fgzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:59 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:59 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:59 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 9b0204ab-501e-0047-62c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161759Z-1746fd949bd77mkmhC1EWR5efc00000004n000000000t03r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:59 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:17:59 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:17:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:17:59 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 431871c3-501e-0047-55cc-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161759Z-1746fd949bdzd2qvhC1EWRcygw000000045000000000k27t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:17:59 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:01 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 1b86d58a-f01e-0071-54ce-45431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161801Z-1746fd949bdmv56chC1EWRypnn00000004hg00000000mefc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:01 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:01 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1e40fce6-401e-0078-1bd2-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161801Z-1746fd949bdhk6hphC1EWRaw3c00000004a000000000243g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:01 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:01 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 76d3483c-401e-00a3-2bcc-458b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161801Z-1746fd949bdwt8wrhC1EWRu6rg00000004qg00000000100r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:01 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: dbf7ebc2-101e-00a2-0ac7-459f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161801Z-1746fd949bd6zq92hC1EWRry4800000004bg00000000mvx1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:01 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:01 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c29bf332-501e-00a0-0ccb-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161801Z-1746fd949bdzd2qvhC1EWRcygw000000044g00000000mpd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:01 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:03 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:03 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 167d53f1-601e-0084-47cc-456b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161803Z-1746fd949bd77mkmhC1EWR5efc00000004kg00000000y846 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:03 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:03 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 490c4061-c01e-000b-75c3-45e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161803Z-1746fd949bddgsvjhC1EWRum2c00000004n000000000tw76 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:03 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: daea1f5e-401e-005b-68d1-459c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161803Z-1746fd949bdqpttnhC1EWRe1wg000000048g0000000044kd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:04 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:03 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:03 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 4dff0f8d-e01e-0085-4694-47c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161803Z-1746fd949bddgsvjhC1EWRum2c00000004s000000000aq8p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:04 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:03 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: e4103400-101e-008e-08d4-45cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161803Z-1746fd949bd77mkmhC1EWR5efc00000004qg00000000fnsp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:05 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:05 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: de9014ac-301e-0051-7cc5-4538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161805Z-1746fd949bdlnsqphC1EWRurw000000004d0000000000qtp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:06 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:05 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 4626c155-d01e-0017-0ecc-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161806Z-1746fd949bdmv56chC1EWRypnn00000004q00000000036z5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:05 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:06 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ddae3c3f-c01e-008d-3acb-452eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161806Z-1746fd949bdqpttnhC1EWRe1wg000000047000000000abbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:06 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:05 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:06 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 85a33a74-901e-005b-1ccd-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161806Z-1746fd949bd4w8sthC1EWR7004000000043000000000v4xq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:06 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:05 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:06 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 27b3b8ef-901e-0083-6b8f-46bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161806Z-1746fd949bd9x4mhhC1EWRb76n00000004gg00000000c5xg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:06 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:07 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:08 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9009c19b-701e-0053-74c6-453a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161808Z-1746fd949bddgsvjhC1EWRum2c00000004n000000000twk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:08 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:08 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:08 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 7eb0f396-d01e-0066-0ac6-45ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161808Z-1746fd949bdl6zq5hC1EWRf3ws00000004700000000018gg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:08 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:08 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:08 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 4ebe80de-801e-0047-51c8-457265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161808Z-1746fd949bdjzh7thC1EWR3g6400000004dg00000000prax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:08 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:08 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 00b51f18-a01e-000d-6fcc-45d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161808Z-1746fd949bdzd2qvhC1EWRcygw000000043g00000000qezk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:08 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:08 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:08 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 46349be7-d01e-0017-71d1-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161808Z-1746fd949bdlqd7fhC1EWR6vt000000004ng000000009uvv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:08 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:10 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:10 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: b4eb9512-b01e-0070-57b6-471cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161810Z-1746fd949bdkw94lhC1EWRxuz400000004ng00000000arq6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:10 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:10 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:10 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 935017b2-001e-0017-80c6-450c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161810Z-1746fd949bdl6zq5hC1EWRf3ws000000041g00000000rdxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:10 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:10 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:10 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 6baa9d1a-801e-0048-02ce-45f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161810Z-1746fd949bdkw94lhC1EWRxuz400000004p0000000008qkv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:10 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:10 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:10 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 715419d5-801e-0078-38c7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161810Z-1746fd949bd9x4mhhC1EWRb76n00000004eg00000000mfqh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:10 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:10 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:10 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 0e2e5981-501e-0035-17c1-45c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161810Z-1746fd949bd77mkmhC1EWR5efc00000004ng00000000rgag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:10 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:12 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:12 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: c73ff22a-601e-0097-54c1-45f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161812Z-1746fd949bdw2rg8hC1EWR11u400000004rg00000000bzwn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:12 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:12 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:12 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 4da954f1-f01e-003f-58cd-45d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161812Z-1746fd949bdjzh7thC1EWR3g6400000004gg00000000awym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:12 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:12 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9b021dfd-501e-0047-60c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161812Z-1746fd949bdzd2qvhC1EWRcygw000000043g00000000qf9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:12 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 686307fb-901e-0029-3dcc-45274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161812Z-1746fd949bdqpttnhC1EWRe1wg000000048g00000000452f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:12 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:12 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bbae04f8-a01e-0032-80cc-451949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161812Z-1746fd949bdmv56chC1EWRypnn00000004mg00000000dd2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:12 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:14 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 71541f9e-801e-0078-2fc7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161814Z-1746fd949bdtlp5chC1EWRq1v400000004g0000000001b6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:14 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 901a75be-701e-0053-76cb-453a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161814Z-1746fd949bd77mkmhC1EWR5efc00000004n000000000t11w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:14 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:14 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f87bd39b-701e-0097-59cc-45b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161814Z-1746fd949bdfg4slhC1EWR34t0000000046g00000000wckb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:14 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:14 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:14 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5cfda45f-901e-00ac-3dce-45b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161814Z-1746fd949bd7wvgbhC1EWR0rgs00000004fg00000000gqn0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:14 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:15 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 2accf417-001e-0014-64cb-455151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161814Z-1746fd949bd4w8sthC1EWR7004000000048g000000006exg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:15 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:16 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:16 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:16 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9e061bd1-d01e-0066-12ef-46ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161816Z-1746fd949bdzd2qvhC1EWRcygw000000048g0000000056cg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:16 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:16 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:16 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 83b3619d-801e-0015-258f-46f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161816Z-1746fd949bddgsvjhC1EWRum2c00000004m000000000wb3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:17 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:16 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:16 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8c60988c-801e-00a3-08c1-457cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161816Z-1746fd949bd7wvgbhC1EWR0rgs00000004gg00000000dfz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:17 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:16 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:16 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 1a0f4f93-001e-0049-61cb-455bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161816Z-1746fd949bd7wvgbhC1EWR0rgs00000004gg00000000dfzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:16 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:17 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 6be23244-101e-00a2-2d9c-479f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161817Z-1746fd949bdqpttnhC1EWRe1wg000000046g00000000cyv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:17 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:18 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:18 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 7057cc02-501e-008f-16cc-459054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161818Z-1746fd949bd7wvgbhC1EWR0rgs00000004gg00000000dg7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:19 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:18 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 859db5fc-901e-005b-23cb-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161819Z-1746fd949bdwt8wrhC1EWRu6rg00000004fg00000000tuyc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:19 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:18 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:19 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: bcf9f347-101e-007a-60d2-45047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161819Z-1746fd949bdzd2qvhC1EWRcygw000000047000000000abv4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:19 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:18 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:19 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 6fa1ab5c-701e-0021-54c1-463d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161819Z-1746fd949bdb8xvchC1EWRmbd4000000049g00000000uu4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:19 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:18 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:19 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:19 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 68175a90-d01e-0065-3ed1-45b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161819Z-1746fd949bd6zq92hC1EWRry4800000004gg000000001dgk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:20 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:21 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 26f79bf1-901e-0083-7ec4-45bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161821Z-1746fd949bd77mkmhC1EWR5efc00000004ng00000000rgzv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:21 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:21 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:21 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 0312aba8-e01e-0085-12cc-45c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161821Z-1746fd949bdjzh7thC1EWR3g6400000004e000000000msx2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:21 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:21 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 1e2c2913-401e-0078-28cc-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161821Z-1746fd949bdhk6hphC1EWRaw3c000000045g00000000ky8k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:21 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:21 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 85a1d3f6-901e-005b-3ecd-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161821Z-1746fd949bd4w8sthC1EWR7004000000043g00000000suwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:23 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 859f66ca-901e-005b-0ccc-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161823Z-1746fd949bd4w8sthC1EWR7004000000049g000000002f0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:23 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 72953a3b-301e-0000-41cd-45eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161823Z-1746fd949bd4w8sthC1EWR7004000000049g000000002f13 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:23 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 626f2b07-401e-0015-15d1-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161823Z-1746fd949bdtlp5chC1EWRq1v400000004ag00000000qhap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:23 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:23 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:23 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:23 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 0fd45478-901e-00ac-658b-47b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161823Z-1746fd949bd9x4mhhC1EWRb76n00000004m00000000014u3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:23 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:25 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:25 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 5e84b1af-e01e-0071-205c-4708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161825Z-1746fd949bdlnsqphC1EWRurw000000004a000000000dhpp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:25 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:25 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:25 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: e8edc24c-801e-0083-0ecc-45f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161825Z-1746fd949bdqpttnhC1EWRe1wg000000046000000000eekz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:25 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:25 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:25 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4927bbd2-c01e-000b-53cc-45e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161825Z-1746fd949bd77mkmhC1EWR5efc00000004p000000000nr4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:25 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:25 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:25 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:25 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 3e1c70e6-d01e-0028-76c3-457896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161825Z-1746fd949bddgsvjhC1EWRum2c00000004m000000000wbu8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:25 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:25 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:25 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:25 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: d1823508-801e-008c-16d3-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161825Z-1746fd949bdl6zq5hC1EWRf3ws000000041000000000t15w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:25 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:27 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:27 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8db94728-c01e-0034-79d1-452af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161827Z-1746fd949bdl6zq5hC1EWRf3ws000000042g00000000ns3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:27 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:27 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:28 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:27 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: c43eeb18-901e-008f-6ecb-4567a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161827Z-1746fd949bdkw94lhC1EWRxuz400000004q000000000463w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:28 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:27 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:27 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dea1083a-301e-0051-14cb-4538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161827Z-1746fd949bd9x4mhhC1EWRb76n00000004h0000000009gcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:27 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:27 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:27 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:27 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 5bdbb5de-801e-0067-47cb-45fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161827Z-1746fd949bd77mkmhC1EWR5efc00000004kg00000000y9p9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:27 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:27 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:28 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:27 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 55cb7248-101e-0017-4fd4-4547c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161827Z-1746fd949bdqpttnhC1EWRe1wg000000048g00000000461v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:28 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:29 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:29 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:29 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 2e94d759-201e-005d-705f-47afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161829Z-1746fd949bdb8xvchC1EWRmbd400000004ag00000000ru82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:29 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:29 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:30 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:29 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 5ce939f7-901e-00ac-7ec7-45b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161829Z-1746fd949bd4w8sthC1EWR7004000000048g000000006g2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:30 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:29 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:30 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:29 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 4ebcc1fc-101e-0028-09cb-458f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161829Z-1746fd949bdjzh7thC1EWR3g6400000004h0000000008pr4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:29 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:30 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:30 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 0b7a0bcb-d01e-0082-68c5-45e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161830Z-1746fd949bdb8xvchC1EWRmbd400000004ag00000000ru9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:30 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:29 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:30 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 2e27a562-801e-00a0-79cb-452196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161830Z-1746fd949bdhk6hphC1EWRaw3c000000046000000000hubc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:31 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:32 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:31 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 76609676-a01e-0070-74cc-45573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161831Z-1746fd949bdnq7x2hC1EWRpxr0000000048g00000000gmf9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:32 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:31 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:32 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:32 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 6b7594f7-701e-001e-76bc-46f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161832Z-1746fd949bdmv56chC1EWRypnn00000004f000000000urvn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:32 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:31 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:32 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:32 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 88657856-001e-008d-2ccc-45d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161832Z-1746fd949bdkw94lhC1EWRxuz400000004fg00000000xqyz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:32 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:31 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:32 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:32 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: c77b1400-401e-0048-71d2-450409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161832Z-1746fd949bdmv56chC1EWRypnn00000004h000000000nt0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:32 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:32 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:35 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:35 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 4edcd523-801e-0047-60d3-457265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161835Z-1746fd949bdlnsqphC1EWRurw000000004b00000000096s3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:35 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:33 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:34 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:34 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d3398a04-c01e-007a-0bce-45b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161834Z-1746fd949bd4w8sthC1EWR700400000004900000000054b9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:34 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:34 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:34 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:34 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c8e56ad6-f01e-005d-13cc-4513ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161834Z-1746fd949bdlqd7fhC1EWR6vt000000004r0000000000qs2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:34 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:34 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:34 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:34 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: e0cd6956-c01e-0082-4299-46af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161834Z-1746fd949bdkw94lhC1EWRxuz400000004fg00000000xr4a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:34 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:35 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:36 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:36 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 4ddf438b-c01e-0049-57cd-45ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161836Z-1746fd949bdlnsqphC1EWRurw000000004c00000000059gp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:36 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:36 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:36 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: e40b0455-101e-008e-19d2-45cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161836Z-1746fd949bdzd2qvhC1EWRcygw0000000490000000002zzm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:36 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:36 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:36 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:36 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: f7184125-501e-0064-68d4-451f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161836Z-1746fd949bdb8xvchC1EWRmbd400000004ag00000000ruse x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:36 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:36 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:36 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:36 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 8863b02e-001e-008d-5ccb-45d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161836Z-1746fd949bdw2rg8hC1EWR11u400000004ng00000000qczm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:36 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:37 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:37 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:37 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 0cb9a159-001e-0079-71ce-4512e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161837Z-1746fd949bdlnsqphC1EWRurw0000000048000000000pd0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:37 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:38 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:38 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:38 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 626f3694-401e-0015-30d1-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161838Z-1746fd949bdqpttnhC1EWRe1wg000000045g00000000hb6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:38 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:38 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:38 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:38 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: d954f12c-201e-000c-55cb-4579c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161838Z-1746fd949bdqpttnhC1EWRe1wg000000044000000000pk3x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:38 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:38 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:38 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:38 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 0db49ca6-a01e-001e-68d9-4549ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161838Z-1746fd949bd9x4mhhC1EWRb76n00000004fg00000000fncu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:38 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:38 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:38 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:38 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 0fb30add-f01e-003c-5394-478cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161838Z-1746fd949bdnq7x2hC1EWRpxr0000000047000000000pczb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:38 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:39 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:39 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:39 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 35b13c92-d01e-00a1-6483-4735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161839Z-1746fd949bdjzh7thC1EWR3g6400000004fg00000000e012 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:39 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49943	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:40 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:40 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:40 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8dafbd59-c01e-0034-0bce-452af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161840Z-1746fd949bdlqd7fhC1EWR6vt000000004n000000000cp6b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:40 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:40 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:40 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:40 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: daf0ea0f-401e-005b-1ad4-459c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161840Z-1746fd949bdnq7x2hC1EWRpxr000000004b0000000006xgy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:40 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49945	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:40 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:41 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 77d68196-001e-0066-56cc-45561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161840Z-1746fd949bdb8xvchC1EWRmbd4000000049g00000000uw0v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:41 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49946	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:40 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:41 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:40 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 4885a0d8-201e-0096-65c7-45ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161840Z-1746fd949bdmv56chC1EWRypnn00000004q00000000038uf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:41 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49947	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:41 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:42 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:41 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: b15ffdf0-e01e-0051-2acd-4584b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161841Z-1746fd949bd4w8sthC1EWR700400000004a00000000005a6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:42 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49948	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:42 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:43 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:42 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: eed2a8f6-b01e-0001-60d2-4546e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161842Z-1746fd949bdl6zq5hC1EWRf3ws000000040g00000000ven0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:43 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49949	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:42 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:43 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:42 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 46703850-c01e-002b-03cc-456e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161842Z-1746fd949bd7wvgbhC1EWR0rgs00000004h000000000caeg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:43 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49950	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:42 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:43 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:43 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: a6a36225-101e-000b-71ce-455e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161843Z-1746fd949bd6zq92hC1EWRry4800000004f0000000006qrb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:43 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49951	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:42 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:43 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:43 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: b50e8154-301e-0052-6684-4665d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161843Z-1746fd949bdl6zq5hC1EWRf3ws000000041000000000t2ap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:43 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49952	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:43 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:44 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:43 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 77ea0a00-001e-0066-6ed3-45561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161843Z-1746fd949bd2cq7chC1EWRnx9g000000043000000000d8rg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:44 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49954	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:44 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:45 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:45 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 22bd9730-c01e-00a2-0a99-462327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161845Z-1746fd949bd2cq7chC1EWRnx9g0000000450000000005sch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:45 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49953	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:44 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:45 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:45 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 52797c88-801e-00ac-33cb-45fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161845Z-1746fd949bdtlp5chC1EWRq1v400000004bg00000000ksuh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:45 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49955	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:45 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:45 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:45 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 8c86af4e-801e-00a3-6fcc-457cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161845Z-1746fd949bdlnsqphC1EWRurw000000004cg000000002wvq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:45 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49956	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:45 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:45 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:45 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 6982f097-a01e-0021-7491-46814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161845Z-1746fd949bdkw94lhC1EWRxuz400000004qg000000001qwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:45 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49957	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:45 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:46 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:46 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 2b71c36d-501e-008c-14c5-45cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161846Z-1746fd949bdfg4slhC1EWR34t000000004c0000000007t2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:46 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49959	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:47 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:47 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:47 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 00b55cb5-a01e-000d-73cc-45d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161847Z-1746fd949bd7wvgbhC1EWR0rgs00000004dg00000000ta9p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:47 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49958	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:47 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:47 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:47 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 1e2a9e05-401e-0078-21cb-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161847Z-1746fd949bdl6zq5hC1EWRf3ws000000041000000000t2mg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:47 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49960	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:18:47 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-06 16:18:47 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:18:47 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 4a855f25-e01e-0099-02ce-45da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241206T161847Z-1746fd949bdqpttnhC1EWRe1wg000000047000000000aebr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-06 16:18:47 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Target ID:	0
Start time:	11:16:52
Start date:	06/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0xd10000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:17:25
Start date:	06/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	11:17:26
Start date:	06/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=2044,i,2785491444657298548,8132415658689016922,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:17:32
Start date:	06/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://2fa.com-token-auth.com/XYkc1SU1SZ0Rxc0tZY2JBZHJMaGJGWlM2Z2EwMXlSdW9aQ3RBeG5EVEJWbndNeTY0bTR4UVBScCt0NnFBTi9NZEg5c1Q4TjFNamNqVHhNcDZERzNnQS9MTUFidEJHQWZuYzhIcER5ZmhEbjRURXBQZnJwOGMzeEhQRmpZTmtmNEZSMXZaRlg0UHFQak02Q2VUZzlMTGhLdW9YL1U3SkpybldzbnRvdXFwVTVqc3p6SkFxVUoyQWJlSG9iaXp5V3VIaWhLRCtPbG56T01RVGlnTVd4bnMtLW5lYmN6YUdXdUhOQWRzMUYtLWtMM2tLOWFoaEhaeC9FL3IzVUxra0E9PQ==?cid=2306703812"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Platinum Hall County, Georgia Proposal (16.6 KB).docx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\63534831.jpeg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{EAA8276B-2E93-4C9C-8B2D-B9CD5E7CD592}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{4F1984A5-4312-49A7-9155-4E7DEC480E0A}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{FB6653F0-A1A5-4B11-B275-635DE211F946}.tmp

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1733501813671989200_2D19354F-AE74-4435-90CA-88A30FB6DED6.log

C:\Users\user\AppData\Local\Temp\TCD40D.tmp\Main_Event.thmx

C:\Users\user\AppData\Local\Temp\TCD40D.tmp\content.inf

C:\Users\user\AppData\Local\Temp\TCD43.tmp\Damask.thmx

C:\Users\user\AppData\Local\Temp\TCD43.tmp\content.inf

C:\Users\user\AppData\Local\Temp\TCD48C.tmp\Mesh.thmx

C:\Users\user\AppData\Local\Temp\TCD48C.tmp\content.inf

C:\Users\user\AppData\Local\Temp\TCD896.tmp\Vapor_Trail.thmx

C:\Users\user\AppData\Local\Temp\TCD896.tmp\content.inf

C:\Users\user\AppData\Local\Temp\TCD934.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCD934.tmp\Insight design set.dotx

C:\Users\user\AppData\Local\Temp\TCDF370.tmp\Content.inf

C:\Users\user\AppData\Local\Temp\TCDF370.tmp\chevronaccent.glox

Windows Analysis Report
Platinum Hall County, Georgia Proposal (16.6 KB).docx