Edit tour

Windows Analysis Report
http://192.177.111.24

Overview

General Information

Sample URL:	http://192.177.111.24
Analysis ID:	1559460
Infos:

Errors URL not reachable

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

AI detected suspicious URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2580 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2036,i,4201370858838406440,1876458737403338155,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://192.177.111.24" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious URL

Source: Email

Joe Sandbox AI: AI detected IP in URL: http://192.177.111.24

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.9:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.9:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.9:49749 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3DDWeYvxN5kAWwg&MD=WtMWrc4d HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 192.177.111.24Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 192.177.111.24Connection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.9:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.9:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.9:49749 version: TLS 1.2

Source: classification engine

Classification label: sus20.win@18/6@2/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2036,i,4201370858838406440,1876458737403338155,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://192.177.111.24"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2036,i,4201370858838406440,1876458737403338155,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://192.177.111.24	0%	Avira URL Cloud	safe

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://192.177.111.24/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	172.217.21.36	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://192.177.111.24/	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.177.111.24	unknown	United States	18779	EGIHOSTINGUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.9

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559460
Start date and time:	2024-11-20 15:08:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://192.177.111.24
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus20.win@18/6@2/4
Cookbook Comments:	URL browsing timeout or error

Errors

URL not reachable

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 172.217.21.35, 64.233.165.84, 172.217.19.238, 34.104.35.123, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, edgedl.me.gvt1.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://192.177.111.24

Simulations

Behavior and APIs

⊘No simulations

Input	Output
URL: http://192.177.111.24 Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": true, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://192.177.111.24

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 13:09:24 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9750059352362963
Encrypted:	false
SSDEEP:	48:8cdQTwvHHidAKZdA1P4ehwiZUklqehqy+3:8nM1O9y
MD5:	1938747C7218E94F08AA5EC5D788BB87
SHA1:	8A7E240E42A8C66BC5D9CE6C058C6F2818D3C181
SHA-256:	134706EBA620F77AB6B155840E0DF2498A4BBEF248E1930ECA5B56B094EFA1E2
SHA-512:	A1BB94989DF54BD180573A2AFDACC1F11066CAFBF0352243DFF2FA12FDDAB3DF7061B7893E1D90626B413EF80BCAFD9966503DC8B2F2E94E00E0E5B764D2FA2C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...._/..U;....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.ItY(q....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY)q....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VtY)q....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VtY)q.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VtY-q...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............N.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 13:09:24 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.990321529701681
Encrypted:	false
SSDEEP:	48:8udQTwvHHidAKZdA1+4eh/iZUkAQkqehty+2:8RMEF9QAy
MD5:	682845BEEDC29D061597C745DF07F95E
SHA1:	B5E201862DD7C35B4B91FE37229123B54195324E
SHA-256:	A0C0AF92AE5DC6A48150B5170AD99E5977B31F51C3270EE221B7D47C4E7BC18B
SHA-512:	DFFADEE28C51B5ADD9BF07A5E0030DBEE8D2419DCE1DA9D1F85E4246340450473A56C51C11ABF817D017B11B3F08FE7B50AD1DD92B30AEB2EA8DEE053E710EEE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....h..U;....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.ItY(q....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY)q....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VtY)q....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VtY)q.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VtY-q...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............N.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.003267121241164
Encrypted:	false
SSDEEP:	48:8ZdQTwVHHidAKZdA1404eh7sFiZUkmgqeh7s7y+BX:8kMTInBy
MD5:	B65DC5528F35223F27BBBC36712684F5
SHA1:	0292A558B128AC5AF5E3127B58A0DF2F0B0D24BE
SHA-256:	8D54ECFA80B1056466D07C64387E269500BEFAD668282B3B265AC2BD2CE4861A
SHA-512:	2BC1B9BD9245EFB4812532B28BA608F8640CE0895B3FA4706141FB336A4004CB772377DBF7637903824166D82C432A211C0C845BC493A79F1EAB42E92ACF91E1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....<}.i.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.ItY(q....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY)q....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VtY)q....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VtY)q.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VEW.F...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............N.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 13:09:24 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.989031028027721
Encrypted:	false
SSDEEP:	48:8ddQTwvHHidAKZdA1p4ehDiZUkwqehpy+R:8AMT5Dy
MD5:	3B054B07B411EB3BC0DB7953489C6481
SHA1:	F89AB612230A638E74AEDE3EE78893B4DCC85647
SHA-256:	03FD48A06331336661713691F6E2F40F0A0812F60CF38D7436BF4888661AAD80
SHA-512:	531392439C4E01ADA7E799C3E2D17D2B19C597C718778BA42E57C6A651C5372115E59B13CDEC7F9F401CD8C2A5BBD3D2A94CB40CFCB2FBE4196EADEBD5972C72
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........U;....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.ItY(q....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY)q....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VtY)q....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VtY)q.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VtY-q...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............N.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 13:09:24 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.979131419329722
Encrypted:	false
SSDEEP:	48:8ydQTwvHHidAKZdA1X4ehBiZUk1W1qeh/y+C:8dMNb9fy
MD5:	9243CF65BD0CEC18E0363FDD49D41B4D
SHA1:	78CF4DA2CF4E6457F6C17D4747735D2F00DB4D5F
SHA-256:	3E2F9A9D2E54BA25EB26D2276D8F9EB9C817163EA03C75EC0DD03A28BC7462C1
SHA-512:	C423F77BB25E5E1F6D95D05787343F682116975D852C64C311FB6D0087A4921D1DC8909AD61919A9AE601BF43CFF678CA58F831D88D4E3ABAA698AC8788FF0F9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........U;....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.ItY(q....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY)q....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VtY)q....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VtY)q.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VtY-q...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............N.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Nov 20 13:09:24 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9876316508267493
Encrypted:	false
SSDEEP:	48:8CdQTwvHHidAKZdA1duTc4ehOuTbbiZUk5OjqehOuTbBy+yT+:8NMuTcJTbxWOvTbBy7T
MD5:	FD7B3F154765BD5C8B1DED4121437A4B
SHA1:	3C98B6499636487172B5340737093795844793DF
SHA-256:	50B319C4ECA57B06385FFAA5A6376B287D3D24C54FB7BEC6A2B54A3E67A32E29
SHA-512:	015736B979ACED7461C196339CD428C59815D9233BEC13BB9EC26B61C49960D11CC9A572AB364034C062AA59BB9C3FE73F5F363BC5CABF23DD3EDE3D08D132A5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....X...U;....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.ItY(q....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VtY)q....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VtY)q....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VtY)q.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VtY-q...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............N.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 15:09:13.295917034 CET	49677	443	192.168.2.9	20.189.173.11
Nov 20, 2024 15:09:13.311547041 CET	49673	443	192.168.2.9	204.79.197.203
Nov 20, 2024 15:09:14.499053001 CET	49677	443	192.168.2.9	20.189.173.11
Nov 20, 2024 15:09:15.623410940 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:15.623449087 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:15.623596907 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:15.623913050 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:15.623931885 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:16.905244112 CET	49677	443	192.168.2.9	20.189.173.11
Nov 20, 2024 15:09:16.983387947 CET	49675	443	192.168.2.9	23.206.229.209
Nov 20, 2024 15:09:16.983388901 CET	49676	443	192.168.2.9	23.206.229.209
Nov 20, 2024 15:09:17.202157021 CET	49674	443	192.168.2.9	23.206.229.209
Nov 20, 2024 15:09:17.482821941 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:17.482913017 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:17.489186049 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:17.489196062 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:17.489545107 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:17.504085064 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:17.551321030 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:17.995687962 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:17.995714903 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:17.995728970 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:17.995829105 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:17.995841026 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:17.995897055 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.190854073 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.190877914 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.190979004 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.190999985 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.191047907 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.240931034 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.240953922 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.241076946 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.241091967 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.241134882 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.375031948 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.375057936 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.375190020 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.375204086 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.375252962 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.407253981 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.407285929 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.407360077 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.407381058 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.407413006 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.407437086 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.427249908 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.427273989 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.427386999 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.427418947 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.427465916 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.445986032 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.446011066 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.446135998 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.446149111 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.446193933 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.571099997 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.571140051 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.571234941 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.571249008 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.571273088 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.571291924 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.586847067 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.586875916 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.586954117 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.586968899 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.586994886 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.587011099 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.604137897 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.604166031 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.604211092 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.604234934 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.604254007 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.604275942 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.620570898 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.620599031 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.620696068 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.620711088 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.620728970 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.620750904 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.637989044 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.638015985 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.638149023 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.638163090 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.638215065 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.652940989 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.652962923 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.653028965 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.653047085 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.653083086 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.653098106 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.812078953 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.812179089 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:18.812185049 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:18.812233925 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:19.212706089 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:19.212985039 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:19.442440987 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:19.442466021 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:19.442477942 CET	49706	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:19.442483902 CET	443	49706	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:21.827168941 CET	49677	443	192.168.2.9	20.189.173.11
Nov 20, 2024 15:09:21.907218933 CET	49707	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.907264948 CET	443	49707	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:21.907327890 CET	49707	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.909194946 CET	49708	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.909240007 CET	443	49708	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:21.909292936 CET	49708	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.913181067 CET	49709	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.913208961 CET	443	49709	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:21.913263083 CET	49709	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.915966988 CET	49710	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.915978909 CET	443	49710	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:21.916042089 CET	49710	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.916829109 CET	49707	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.916843891 CET	443	49707	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:21.916999102 CET	49708	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.917016983 CET	443	49708	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:21.917485952 CET	49709	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.917499065 CET	443	49709	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:21.917855024 CET	49710	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.917870998 CET	443	49710	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:21.919153929 CET	49711	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.919164896 CET	443	49711	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:21.919213057 CET	49711	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.919357061 CET	49711	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:21.919364929 CET	443	49711	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:22.936482906 CET	49673	443	192.168.2.9	204.79.197.203
Nov 20, 2024 15:09:23.642343998 CET	443	49708	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.643512011 CET	49708	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:23.643522024 CET	443	49708	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.644330025 CET	49708	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:23.644335985 CET	443	49708	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.645493984 CET	443	49707	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.645836115 CET	49707	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:23.645869970 CET	443	49707	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.646294117 CET	49707	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:23.646301031 CET	443	49707	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.744278908 CET	443	49711	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.744946003 CET	49711	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:23.744966030 CET	443	49711	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.745768070 CET	49711	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:23.745774031 CET	443	49711	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.747281075 CET	443	49710	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.747729063 CET	49710	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:23.747745991 CET	443	49710	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.748189926 CET	49710	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:23.748209953 CET	443	49710	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.818932056 CET	443	49709	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.819538116 CET	49709	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:23.819555044 CET	443	49709	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:23.820314884 CET	49709	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:23.820319891 CET	443	49709	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.079627991 CET	443	49708	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.079710007 CET	443	49708	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.079862118 CET	49708	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.087596893 CET	49708	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.087596893 CET	49708	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.087613106 CET	443	49708	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.087624073 CET	443	49708	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.088083029 CET	443	49707	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.088109016 CET	443	49707	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.088159084 CET	49707	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.088169098 CET	443	49707	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.088274002 CET	49707	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.094434023 CET	443	49707	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.094501972 CET	443	49707	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.094572067 CET	49707	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.121982098 CET	49707	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.122010946 CET	443	49707	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.122045040 CET	49707	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.122052908 CET	443	49707	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.168811083 CET	49717	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.168848038 CET	443	49717	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.172969103 CET	49717	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.178766966 CET	49718	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.178806067 CET	443	49718	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.178879023 CET	49718	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.181986094 CET	49717	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.182009935 CET	443	49717	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.182054996 CET	49718	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.182069063 CET	443	49718	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.198038101 CET	443	49710	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.198101044 CET	443	49710	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.198240995 CET	49710	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.198254108 CET	443	49710	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.199286938 CET	49710	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.201457024 CET	443	49710	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.201582909 CET	443	49710	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.201641083 CET	49710	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.203995943 CET	49710	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.203995943 CET	49710	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.204009056 CET	443	49710	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.204019070 CET	443	49710	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.227161884 CET	49719	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.227197886 CET	443	49719	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.227334023 CET	49719	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.227437019 CET	49719	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.227446079 CET	443	49719	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.251885891 CET	443	49711	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.251960993 CET	443	49711	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.252028942 CET	49711	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.254255056 CET	49711	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.254277945 CET	443	49711	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.254328966 CET	49711	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.254334927 CET	443	49711	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.266617060 CET	49720	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.266664028 CET	443	49720	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.266724110 CET	49720	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.266851902 CET	49720	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.266868114 CET	443	49720	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.281894922 CET	443	49709	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.281920910 CET	443	49709	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.282001972 CET	49709	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.282012939 CET	443	49709	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.282286882 CET	49709	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.282286882 CET	49709	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.282301903 CET	443	49709	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.282454967 CET	443	49709	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.282485008 CET	443	49709	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.282555103 CET	49709	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.285124063 CET	49721	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.285156965 CET	443	49721	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.285214901 CET	49721	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.285399914 CET	49721	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:24.285412073 CET	443	49721	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:24.562057018 CET	49722	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:24.562194109 CET	49723	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:24.682271004 CET	80	49722	192.177.111.24	192.168.2.9
Nov 20, 2024 15:09:24.682312965 CET	80	49723	192.177.111.24	192.168.2.9
Nov 20, 2024 15:09:24.682354927 CET	49722	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:24.682384014 CET	49723	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:24.682717085 CET	49723	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:24.803289890 CET	80	49723	192.177.111.24	192.168.2.9
Nov 20, 2024 15:09:26.192082882 CET	443	49718	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.192781925 CET	49718	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.192802906 CET	443	49718	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.193301916 CET	49718	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.193308115 CET	443	49718	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.395639896 CET	443	49717	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.397228956 CET	49717	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.397243023 CET	443	49717	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.397685051 CET	49717	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.397690058 CET	443	49717	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.459948063 CET	443	49719	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.468466997 CET	49719	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.468477964 CET	443	49719	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.469099045 CET	49719	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.469104052 CET	443	49719	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.511349916 CET	443	49721	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.522749901 CET	49721	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.522782087 CET	443	49721	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.523243904 CET	49721	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.523248911 CET	443	49721	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.528520107 CET	443	49720	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.529309988 CET	49720	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.529336929 CET	443	49720	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.529863119 CET	49720	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.529867887 CET	443	49720	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.588634014 CET	49676	443	192.168.2.9	23.206.229.209
Nov 20, 2024 15:09:26.588654041 CET	49675	443	192.168.2.9	23.206.229.209
Nov 20, 2024 15:09:26.687385082 CET	443	49718	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.687460899 CET	443	49718	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.687603951 CET	49718	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.812336922 CET	49674	443	192.168.2.9	23.206.229.209
Nov 20, 2024 15:09:26.840336084 CET	49718	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.840358973 CET	443	49718	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.840385914 CET	49718	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.840392113 CET	443	49718	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.845927954 CET	49726	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.845976114 CET	443	49726	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.846112967 CET	49726	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.846447945 CET	49726	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.846465111 CET	443	49726	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.861656904 CET	443	49717	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.861726999 CET	443	49717	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.861804962 CET	49717	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.862003088 CET	49717	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.862003088 CET	49717	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.862018108 CET	443	49717	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.862029076 CET	443	49717	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.868884087 CET	49727	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.868937969 CET	443	49727	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.869015932 CET	49727	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.869929075 CET	49727	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.869960070 CET	443	49727	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.923089027 CET	443	49719	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.923157930 CET	443	49719	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.923391104 CET	49719	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.928215981 CET	49719	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.928215981 CET	49719	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.928227901 CET	443	49719	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.928237915 CET	443	49719	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.931193113 CET	49728	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.931229115 CET	443	49728	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.931302071 CET	49728	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.931468964 CET	49728	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.931485891 CET	443	49728	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.962007046 CET	443	49721	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.962169886 CET	443	49721	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.962230921 CET	49721	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.962388992 CET	49721	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.962415934 CET	49721	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.962414980 CET	443	49721	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.962424040 CET	443	49721	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.966042042 CET	49729	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.966090918 CET	443	49729	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.966167927 CET	49729	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.966358900 CET	49729	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.966376066 CET	443	49729	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.984338045 CET	443	49720	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.984502077 CET	443	49720	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.984560966 CET	49720	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.990037918 CET	49720	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.990071058 CET	443	49720	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:26.990083933 CET	49720	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:26.990091085 CET	443	49720	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:27.004556894 CET	49730	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:27.004590034 CET	443	49730	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:27.004868984 CET	49730	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:27.006767035 CET	49730	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:27.006793022 CET	443	49730	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:27.472332001 CET	49731	443	192.168.2.9	172.217.21.36
Nov 20, 2024 15:09:27.472376108 CET	443	49731	172.217.21.36	192.168.2.9
Nov 20, 2024 15:09:27.472527027 CET	49731	443	192.168.2.9	172.217.21.36
Nov 20, 2024 15:09:27.472805023 CET	49731	443	192.168.2.9	172.217.21.36
Nov 20, 2024 15:09:27.472841024 CET	443	49731	172.217.21.36	192.168.2.9
Nov 20, 2024 15:09:28.209393024 CET	49732	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:28.209439039 CET	443	49732	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:28.209613085 CET	49732	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:28.211493969 CET	49732	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:28.211508989 CET	443	49732	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:28.695461035 CET	443	49728	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.700943947 CET	443	49727	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.703607082 CET	443	49726	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.715553999 CET	49728	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:28.715591908 CET	443	49728	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.716242075 CET	49728	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:28.716249943 CET	443	49728	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.716589928 CET	49727	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:28.716603994 CET	443	49727	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.717070103 CET	49727	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:28.717077017 CET	443	49727	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.717797995 CET	49726	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:28.717837095 CET	443	49726	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.718255997 CET	49726	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:28.718265057 CET	443	49726	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.721735954 CET	443	49729	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.725492001 CET	49729	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:28.725516081 CET	443	49729	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.725933075 CET	49729	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:28.725939035 CET	443	49729	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.858179092 CET	443	49730	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.858889103 CET	49730	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:28.858913898 CET	443	49730	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:28.859308958 CET	49730	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:28.859360933 CET	443	49730	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.150465965 CET	443	49726	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.150532961 CET	443	49726	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.150583982 CET	49726	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.150825977 CET	49726	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.150851011 CET	443	49726	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.150861979 CET	49726	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.150866985 CET	443	49726	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.151530027 CET	443	49727	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.151590109 CET	443	49727	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.151696920 CET	49727	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.152026892 CET	49727	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.152026892 CET	49727	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.152050972 CET	443	49727	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.152065039 CET	443	49727	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.154757977 CET	49733	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.154815912 CET	443	49733	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.154898882 CET	49733	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.155021906 CET	49733	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.155039072 CET	443	49733	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.155045033 CET	49734	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.155086040 CET	443	49734	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.155153036 CET	49734	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.155320883 CET	49734	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.155333996 CET	443	49734	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.156441927 CET	443	49728	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.156514883 CET	443	49728	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.156605005 CET	49728	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.156665087 CET	49728	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.156673908 CET	443	49728	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.156687975 CET	49728	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.156694889 CET	443	49728	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.159732103 CET	443	49729	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.159895897 CET	443	49729	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.160007954 CET	49735	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.160022974 CET	443	49735	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.160033941 CET	49729	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.160079002 CET	49735	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.160164118 CET	49729	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.160171032 CET	443	49729	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.160198927 CET	49729	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.160207033 CET	443	49729	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.160737991 CET	49735	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.160751104 CET	443	49735	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.162497044 CET	49736	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.162518024 CET	443	49736	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.162693977 CET	49736	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.162842035 CET	49736	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.162854910 CET	443	49736	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.234405994 CET	443	49731	172.217.21.36	192.168.2.9
Nov 20, 2024 15:09:29.234766960 CET	49731	443	192.168.2.9	172.217.21.36
Nov 20, 2024 15:09:29.234781981 CET	443	49731	172.217.21.36	192.168.2.9
Nov 20, 2024 15:09:29.235649109 CET	443	49731	172.217.21.36	192.168.2.9
Nov 20, 2024 15:09:29.235718966 CET	49731	443	192.168.2.9	172.217.21.36
Nov 20, 2024 15:09:29.237135887 CET	49731	443	192.168.2.9	172.217.21.36
Nov 20, 2024 15:09:29.237201929 CET	443	49731	172.217.21.36	192.168.2.9
Nov 20, 2024 15:09:29.276864052 CET	49731	443	192.168.2.9	172.217.21.36
Nov 20, 2024 15:09:29.276875019 CET	443	49731	172.217.21.36	192.168.2.9
Nov 20, 2024 15:09:29.295677900 CET	443	49704	23.206.229.209	192.168.2.9
Nov 20, 2024 15:09:29.295767069 CET	49704	443	192.168.2.9	23.206.229.209
Nov 20, 2024 15:09:29.306485891 CET	443	49730	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.306556940 CET	443	49730	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.306639910 CET	49730	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.306874990 CET	49730	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.306874990 CET	49730	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.306919098 CET	443	49730	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.306946039 CET	443	49730	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.312840939 CET	49737	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.312875986 CET	443	49737	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.312985897 CET	49737	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.313165903 CET	49737	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:29.313185930 CET	443	49737	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:29.330172062 CET	49731	443	192.168.2.9	172.217.21.36
Nov 20, 2024 15:09:29.657583952 CET	443	49732	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:29.657677889 CET	49732	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:29.662422895 CET	49732	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:29.662431955 CET	443	49732	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:29.662823915 CET	443	49732	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:29.709594965 CET	49732	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:29.719504118 CET	49732	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:29.767335892 CET	443	49732	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:30.187120914 CET	443	49732	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:30.187201977 CET	443	49732	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:30.187283993 CET	49732	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:30.187738895 CET	49732	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:30.187738895 CET	49732	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:30.187767982 CET	443	49732	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:30.187777042 CET	443	49732	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:30.224266052 CET	49738	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:30.224328041 CET	443	49738	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:30.224396944 CET	49738	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:30.224720955 CET	49738	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:30.224737883 CET	443	49738	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:30.892719030 CET	443	49733	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:30.894171000 CET	49733	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:30.894208908 CET	443	49733	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:30.894903898 CET	49733	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:30.894913912 CET	443	49733	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:30.959424973 CET	443	49735	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:30.959820032 CET	49735	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:30.959846020 CET	443	49735	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:30.960418940 CET	49735	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:30.960426092 CET	443	49735	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:30.963433027 CET	443	49736	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:30.963890076 CET	49736	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:30.963913918 CET	443	49736	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:30.964297056 CET	49736	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:30.964303017 CET	443	49736	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.030721903 CET	443	49734	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.031250000 CET	49734	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.031317949 CET	443	49734	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.031893969 CET	49734	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.031902075 CET	443	49734	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.043685913 CET	443	49737	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.044337988 CET	49737	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.044361115 CET	443	49737	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.044887066 CET	49737	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.044892073 CET	443	49737	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.368554115 CET	443	49733	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.368619919 CET	443	49733	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.368973970 CET	49733	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.369048119 CET	49733	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.369071007 CET	443	49733	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.369081974 CET	49733	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.369087934 CET	443	49733	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.372054100 CET	49739	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.372095108 CET	443	49739	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.372189999 CET	49739	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.372759104 CET	49739	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.372772932 CET	443	49739	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.439074039 CET	49677	443	192.168.2.9	20.189.173.11
Nov 20, 2024 15:09:31.591559887 CET	443	49735	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.591660976 CET	443	49735	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.591733932 CET	443	49737	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.591749907 CET	49735	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.591777086 CET	443	49734	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.591795921 CET	443	49737	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.591815948 CET	443	49736	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.591845989 CET	443	49734	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.591847897 CET	49737	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.591886997 CET	49734	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.591974020 CET	443	49736	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.592047930 CET	49736	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.592050076 CET	49735	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.592050076 CET	49735	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.592070103 CET	443	49735	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.592078924 CET	443	49735	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.592145920 CET	49736	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.592165947 CET	443	49736	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.592178106 CET	49736	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.592183113 CET	443	49736	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.593425035 CET	49737	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.593437910 CET	443	49737	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.593451023 CET	49737	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.593456030 CET	443	49737	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.593569040 CET	49734	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.593584061 CET	443	49734	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.593600035 CET	49734	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.593605995 CET	443	49734	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.597728014 CET	49740	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.597774982 CET	443	49740	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.597912073 CET	49740	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.599577904 CET	49741	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.599622965 CET	443	49741	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.599700928 CET	49741	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.600230932 CET	49742	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.600245953 CET	443	49742	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.600538015 CET	49740	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.600555897 CET	443	49740	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.600574970 CET	49742	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.600642920 CET	49742	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.600667953 CET	443	49742	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.600847960 CET	49741	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.600863934 CET	443	49741	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.601324081 CET	49743	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.601334095 CET	443	49743	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.601427078 CET	49743	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.601564884 CET	49743	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:31.601576090 CET	443	49743	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:31.712850094 CET	443	49738	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:31.712940931 CET	49738	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:31.714162111 CET	49738	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:31.714174986 CET	443	49738	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:31.714413881 CET	443	49738	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:31.715598106 CET	49738	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:31.763343096 CET	443	49738	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:32.669002056 CET	443	49738	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:32.722516060 CET	49738	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:32.722537041 CET	443	49738	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:32.725362062 CET	49738	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:32.725378990 CET	443	49738	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:32.725389957 CET	49738	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:32.725801945 CET	443	49738	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:32.725902081 CET	443	49738	23.218.208.109	192.168.2.9
Nov 20, 2024 15:09:32.726445913 CET	49738	443	192.168.2.9	23.218.208.109
Nov 20, 2024 15:09:33.272346020 CET	443	49739	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.272881985 CET	49739	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.272917032 CET	443	49739	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.273478985 CET	49739	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.273494959 CET	443	49739	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.609564066 CET	443	49742	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.610255957 CET	49742	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.610279083 CET	443	49742	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.610735893 CET	49742	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.610740900 CET	443	49742	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.679959059 CET	443	49743	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.680424929 CET	49743	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.680460930 CET	443	49743	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.680885077 CET	49743	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.680890083 CET	443	49743	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.682450056 CET	443	49740	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.682768106 CET	49740	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.682776928 CET	443	49740	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.683156967 CET	49740	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.683162928 CET	443	49740	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.688374996 CET	443	49741	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.689152956 CET	49741	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.689192057 CET	443	49741	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.689783096 CET	49741	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.689790010 CET	443	49741	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.720525980 CET	443	49739	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.720596075 CET	443	49739	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.720695972 CET	49739	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.721434116 CET	49739	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.721434116 CET	49739	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.721458912 CET	443	49739	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.721471071 CET	443	49739	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.725244045 CET	49744	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.725289106 CET	443	49744	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:33.725588083 CET	49744	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.725737095 CET	49744	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:33.725748062 CET	443	49744	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.046964884 CET	443	49742	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.047035933 CET	443	49742	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.047107935 CET	49742	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.047395945 CET	49742	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.047409058 CET	443	49742	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.047431946 CET	49742	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.047437906 CET	443	49742	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.051537037 CET	49745	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.051563978 CET	443	49745	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.051701069 CET	49745	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.051876068 CET	49745	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.051891088 CET	443	49745	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.140119076 CET	443	49743	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.140225887 CET	443	49743	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.140374899 CET	49743	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.140727997 CET	49743	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.140752077 CET	443	49743	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.140762091 CET	49743	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.140769005 CET	443	49743	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.141572952 CET	443	49740	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.141752005 CET	443	49740	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.142091036 CET	49740	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.143848896 CET	49740	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.143848896 CET	49740	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.143866062 CET	443	49740	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.143874884 CET	443	49740	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.147104979 CET	49746	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.147164106 CET	443	49746	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.147267103 CET	49746	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.147484064 CET	49746	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.147497892 CET	443	49746	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.148454905 CET	49747	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.148478031 CET	443	49747	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.148699045 CET	49747	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.148819923 CET	49747	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.148834944 CET	443	49747	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.149120092 CET	443	49741	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.149187088 CET	443	49741	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.149262905 CET	49741	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.149421930 CET	49741	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.149427891 CET	443	49741	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.149437904 CET	49741	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.149441957 CET	443	49741	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.161984921 CET	49748	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.162019014 CET	443	49748	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:34.162081003 CET	49748	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.162728071 CET	49748	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:34.162739992 CET	443	49748	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:35.328696012 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:35.328727961 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:35.328783035 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:35.330816984 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:35.330830097 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:35.613977909 CET	443	49744	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:35.617342949 CET	49744	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:35.617362976 CET	443	49744	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:35.617999077 CET	49744	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:35.618006945 CET	443	49744	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:35.853513002 CET	443	49745	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:35.854176044 CET	49745	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:35.854203939 CET	443	49745	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:35.854645014 CET	49745	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:35.854650021 CET	443	49745	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.006758928 CET	443	49747	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.007399082 CET	49747	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.007417917 CET	443	49747	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.007762909 CET	49747	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.007767916 CET	443	49747	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.022284985 CET	443	49748	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.022886038 CET	49748	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.022927999 CET	443	49748	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.023253918 CET	49748	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.023267984 CET	443	49748	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.047998905 CET	443	49746	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.050818920 CET	49746	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.050842047 CET	443	49746	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.051284075 CET	49746	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.051291943 CET	443	49746	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.069392920 CET	443	49744	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.069544077 CET	443	49744	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.069698095 CET	49744	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.069852114 CET	49744	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.069852114 CET	49744	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.069886923 CET	443	49744	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.069896936 CET	443	49744	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.072637081 CET	49750	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.072680950 CET	443	49750	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.072757006 CET	49750	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.072911024 CET	49750	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.072932959 CET	443	49750	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.299083948 CET	443	49745	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.299155951 CET	443	49745	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.299334049 CET	49745	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.299467087 CET	49745	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.299467087 CET	49745	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.299488068 CET	443	49745	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.299496889 CET	443	49745	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.302553892 CET	49751	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.302594900 CET	443	49751	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.302665949 CET	49751	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.302835941 CET	49751	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.302851915 CET	443	49751	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.451486111 CET	443	49747	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.451562881 CET	443	49747	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.451653004 CET	49747	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.451883078 CET	49747	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.451900005 CET	443	49747	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.451910973 CET	49747	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.451915979 CET	443	49747	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.455065966 CET	49752	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.455121040 CET	443	49752	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.455195904 CET	49752	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.455358982 CET	49752	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.455374002 CET	443	49752	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.466067076 CET	443	49748	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.466130972 CET	443	49748	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.466310024 CET	49748	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.466423035 CET	49748	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.466423035 CET	49748	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.466473103 CET	443	49748	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.466504097 CET	443	49748	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.470000982 CET	49753	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.470041037 CET	443	49753	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.470112085 CET	49753	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.470468044 CET	49753	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.470480919 CET	443	49753	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.510576963 CET	443	49746	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.510657072 CET	443	49746	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.510778904 CET	49746	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.510947943 CET	49746	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.510947943 CET	49746	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.510973930 CET	443	49746	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.510984898 CET	443	49746	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.513824940 CET	49754	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.513873100 CET	443	49754	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:36.513942957 CET	49754	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.514110088 CET	49754	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:36.514121056 CET	443	49754	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:37.064291000 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.064521074 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:37.066220045 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:37.066242933 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.066484928 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.112205982 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:37.129991055 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:37.171356916 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.770807028 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.770833969 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.770840883 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.770849943 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.770883083 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.770922899 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:37.770955086 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.770978928 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:37.771003962 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:37.793250084 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.793324947 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:37.793334007 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.793384075 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:37.793572903 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:37.793595076 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.793608904 CET	49749	443	192.168.2.9	20.109.210.53
Nov 20, 2024 15:09:37.793613911 CET	443	49749	20.109.210.53	192.168.2.9
Nov 20, 2024 15:09:37.870918989 CET	443	49750	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:37.925499916 CET	49750	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:37.947994947 CET	49750	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:37.948020935 CET	443	49750	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:37.949098110 CET	49750	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:37.949105978 CET	443	49750	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.127821922 CET	443	49751	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.129160881 CET	49751	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.129190922 CET	443	49751	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.129600048 CET	49751	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.129605055 CET	443	49751	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.200242996 CET	443	49752	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.202507019 CET	49752	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.202538967 CET	443	49752	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.203006983 CET	49752	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.203012943 CET	443	49752	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.314989090 CET	443	49750	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.315102100 CET	443	49750	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.315291882 CET	49750	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.316728115 CET	49750	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.316759109 CET	443	49750	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.316775084 CET	49750	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.316783905 CET	443	49750	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.319520950 CET	49756	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.319566965 CET	443	49756	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.319673061 CET	49756	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.319793940 CET	49756	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.319811106 CET	443	49756	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.320379972 CET	443	49754	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.320687056 CET	49754	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.320714951 CET	443	49754	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.321105003 CET	49754	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.321110964 CET	443	49754	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.351393938 CET	443	49753	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.355104923 CET	49753	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.355123043 CET	443	49753	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.355582952 CET	49753	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.355588913 CET	443	49753	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.624186039 CET	443	49751	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.624257088 CET	443	49751	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.624317884 CET	49751	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.624516010 CET	49751	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.624530077 CET	443	49751	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.624546051 CET	49751	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.624552011 CET	443	49751	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.628231049 CET	49757	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.628285885 CET	443	49757	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.628416061 CET	49757	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.628696918 CET	49757	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.628709078 CET	443	49757	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.653760910 CET	443	49752	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.653825045 CET	443	49752	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.654062986 CET	49752	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.654215097 CET	49752	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.654233932 CET	443	49752	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.654247999 CET	49752	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.654253960 CET	443	49752	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.656416893 CET	49758	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.656461954 CET	443	49758	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.656596899 CET	49758	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.656910896 CET	49758	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.656929970 CET	443	49758	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.765827894 CET	443	49754	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.765904903 CET	443	49754	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.766164064 CET	49754	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.766204119 CET	49754	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.766217947 CET	443	49754	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.766226053 CET	49754	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.766230106 CET	443	49754	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.768785954 CET	49759	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.768820047 CET	443	49759	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.768893003 CET	49759	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.769057989 CET	49759	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.769072056 CET	443	49759	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.805418015 CET	443	49753	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.805510044 CET	443	49753	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.805603027 CET	49753	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.805701971 CET	49753	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.805701971 CET	49753	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.805718899 CET	443	49753	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.805730104 CET	443	49753	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.808351994 CET	49760	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.808382034 CET	443	49760	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.808453083 CET	49760	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.808567047 CET	49760	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:38.808581114 CET	443	49760	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:38.922575951 CET	443	49731	172.217.21.36	192.168.2.9
Nov 20, 2024 15:09:38.922662020 CET	443	49731	172.217.21.36	192.168.2.9
Nov 20, 2024 15:09:38.922738075 CET	49731	443	192.168.2.9	172.217.21.36
Nov 20, 2024 15:09:39.665829897 CET	49731	443	192.168.2.9	172.217.21.36
Nov 20, 2024 15:09:39.665880919 CET	443	49731	172.217.21.36	192.168.2.9
Nov 20, 2024 15:09:40.104541063 CET	443	49756	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.105063915 CET	49756	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.105102062 CET	443	49756	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.105709076 CET	49756	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.105724096 CET	443	49756	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.502458096 CET	443	49757	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.503421068 CET	49757	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.503456116 CET	443	49757	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.504106045 CET	49757	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.504111052 CET	443	49757	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.509910107 CET	443	49758	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.510432959 CET	49758	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.510462046 CET	443	49758	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.510827065 CET	49758	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.510833025 CET	443	49758	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.554693937 CET	443	49756	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.554754972 CET	443	49756	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.554822922 CET	49756	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.555000067 CET	49756	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.555021048 CET	443	49756	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.555046082 CET	49756	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.555052996 CET	443	49756	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.557735920 CET	49761	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.557765961 CET	443	49761	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.557900906 CET	49761	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.558111906 CET	49761	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.558125973 CET	443	49761	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.568866968 CET	443	49759	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.569309950 CET	49759	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.569334984 CET	443	49759	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.569760084 CET	49759	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.569765091 CET	443	49759	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.606172085 CET	443	49760	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.606699944 CET	49760	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.606726885 CET	443	49760	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.607160091 CET	49760	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.607166052 CET	443	49760	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.959785938 CET	443	49757	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.959863901 CET	443	49757	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.959928036 CET	49757	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.960109949 CET	49757	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.960139036 CET	443	49757	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.960149050 CET	49757	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.960155010 CET	443	49757	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.962910891 CET	49762	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.962949038 CET	443	49762	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.963036060 CET	49762	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.963162899 CET	49762	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.963181019 CET	443	49762	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.964890957 CET	443	49758	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.964956999 CET	443	49758	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.965033054 CET	49758	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.965110064 CET	49758	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.965126991 CET	443	49758	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.965137959 CET	49758	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.965142965 CET	443	49758	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.967324018 CET	49763	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.967360973 CET	443	49763	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:40.967433929 CET	49763	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.967561960 CET	49763	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:40.967576027 CET	443	49763	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:41.015779972 CET	443	49759	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:41.015852928 CET	443	49759	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:41.016062975 CET	49759	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:41.016102076 CET	49759	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:41.016124964 CET	443	49759	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:41.016135931 CET	49759	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:41.016141891 CET	443	49759	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:41.021888018 CET	49764	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:41.021945953 CET	443	49764	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:41.022093058 CET	49764	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:41.022500038 CET	49764	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:41.022512913 CET	443	49764	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:41.053203106 CET	443	49760	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:41.053288937 CET	443	49760	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:41.053349018 CET	49760	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:41.053586006 CET	49760	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:41.053607941 CET	443	49760	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:41.053636074 CET	49760	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:41.053642988 CET	443	49760	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:41.056596041 CET	49765	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:41.056643009 CET	443	49765	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:41.056705952 CET	49765	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:41.056898117 CET	49765	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:41.056909084 CET	443	49765	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:42.588696957 CET	443	49761	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:42.589348078 CET	49761	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:42.589369059 CET	443	49761	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:42.589915991 CET	49761	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:42.589921951 CET	443	49761	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:42.758341074 CET	443	49764	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:42.759016037 CET	49764	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:42.759061098 CET	443	49764	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:42.759727001 CET	49764	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:42.759744883 CET	443	49764	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:42.967000961 CET	443	49762	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:42.967668056 CET	49762	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:42.967691898 CET	443	49762	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:42.968168020 CET	49762	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:42.968193054 CET	443	49762	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:42.977871895 CET	443	49763	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:42.978311062 CET	49763	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:42.978349924 CET	443	49763	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:42.978744030 CET	49763	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:42.978750944 CET	443	49763	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.049458981 CET	443	49761	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.049556017 CET	443	49761	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.049652100 CET	49761	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.050004005 CET	49761	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.050025940 CET	443	49761	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.050036907 CET	49761	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.050041914 CET	443	49761	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.052963018 CET	49766	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.053066969 CET	443	49766	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.053181887 CET	49766	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.053356886 CET	49766	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.053385973 CET	443	49766	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.142306089 CET	443	49765	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.144366980 CET	49765	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.144393921 CET	443	49765	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.144959927 CET	49765	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.144964933 CET	443	49765	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.277179956 CET	443	49764	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.277363062 CET	443	49764	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.277506113 CET	49764	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.277579069 CET	49764	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.277612925 CET	443	49764	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.277638912 CET	49764	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.277654886 CET	443	49764	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.280158997 CET	49767	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.280191898 CET	443	49767	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.280292034 CET	49767	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.280427933 CET	49767	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.280447960 CET	443	49767	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.414053917 CET	443	49762	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.414129019 CET	443	49762	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.414212942 CET	49762	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.414422035 CET	49762	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.414437056 CET	443	49762	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.414448023 CET	49762	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.414453983 CET	443	49762	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.417522907 CET	49768	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.417562962 CET	443	49768	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.417654991 CET	49768	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.417839050 CET	49768	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.417859077 CET	443	49768	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.585220098 CET	443	49763	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.585288048 CET	443	49763	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.585346937 CET	49763	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.585536003 CET	49763	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.585557938 CET	443	49763	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.585583925 CET	49763	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.585589886 CET	443	49763	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.588484049 CET	49769	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.588532925 CET	443	49769	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.588601112 CET	49769	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.588763952 CET	49769	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.588773012 CET	443	49769	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.594038010 CET	443	49765	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.594125032 CET	443	49765	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.594183922 CET	49765	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.594273090 CET	49765	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.594289064 CET	443	49765	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.594300032 CET	49765	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.594305992 CET	443	49765	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.596699953 CET	49770	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.596733093 CET	443	49770	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:43.596816063 CET	49770	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.596976042 CET	49770	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:43.596987963 CET	443	49770	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:44.831741095 CET	443	49766	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:44.832626104 CET	49766	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:44.832672119 CET	443	49766	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:44.832964897 CET	49766	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:44.832973003 CET	443	49766	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.119838953 CET	443	49767	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.121020079 CET	49767	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.121047020 CET	443	49767	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.121505976 CET	49767	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.121512890 CET	443	49767	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.334784985 CET	443	49766	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.334871054 CET	443	49766	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.334956884 CET	49766	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.335144043 CET	49766	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.335171938 CET	443	49766	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.335186958 CET	49766	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.335194111 CET	443	49766	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.338083982 CET	49771	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.338130951 CET	443	49771	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.338222980 CET	49771	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.338433027 CET	49771	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.338445902 CET	443	49771	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.395143032 CET	443	49768	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.395770073 CET	49768	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.395797968 CET	443	49768	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.396225929 CET	49768	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.396231890 CET	443	49768	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.400008917 CET	443	49769	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.400432110 CET	49769	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.400465012 CET	443	49769	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.400870085 CET	49769	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.400876999 CET	443	49769	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.402867079 CET	443	49770	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.403116941 CET	49770	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.403139114 CET	443	49770	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.403460026 CET	49770	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.403466940 CET	443	49770	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.574714899 CET	443	49767	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.574800014 CET	443	49767	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.574851036 CET	49767	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.575316906 CET	49767	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.575336933 CET	443	49767	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.575354099 CET	49767	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.575361013 CET	443	49767	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.580249071 CET	49772	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.580271959 CET	443	49772	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.580327034 CET	49772	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.580698013 CET	49772	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.580704927 CET	443	49772	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.848016977 CET	443	49769	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.848084927 CET	443	49769	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.848138094 CET	49769	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.848474026 CET	49769	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.848491907 CET	443	49769	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.848504066 CET	49769	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.848509073 CET	443	49769	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.851681948 CET	49773	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.851727962 CET	443	49773	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.851794958 CET	49773	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.851927042 CET	49773	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.851938963 CET	443	49773	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.852313995 CET	443	49768	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.852374077 CET	443	49768	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.852411032 CET	49768	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.852497101 CET	49768	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.852513075 CET	443	49768	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.852524042 CET	49768	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.852529049 CET	443	49768	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.853233099 CET	443	49770	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.853297949 CET	443	49770	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.853332043 CET	49770	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.853456020 CET	49770	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.853460073 CET	443	49770	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.853473902 CET	49770	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.853477955 CET	443	49770	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.855221987 CET	49774	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.855242968 CET	443	49774	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.855292082 CET	49774	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.855539083 CET	49774	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.855546951 CET	443	49774	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.856147051 CET	49775	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.856178999 CET	443	49775	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:45.856244087 CET	49775	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.856379032 CET	49775	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:45.856391907 CET	443	49775	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:46.919375896 CET	80	49722	192.177.111.24	192.168.2.9
Nov 20, 2024 15:09:46.919485092 CET	49722	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:46.928195953 CET	80	49723	192.177.111.24	192.168.2.9
Nov 20, 2024 15:09:46.928282022 CET	49723	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:46.928697109 CET	49723	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:46.984018087 CET	49722	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:47.050434113 CET	80	49723	192.177.111.24	192.168.2.9
Nov 20, 2024 15:09:47.105948925 CET	80	49722	192.177.111.24	192.168.2.9
Nov 20, 2024 15:09:47.214689016 CET	443	49771	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.215483904 CET	49771	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.215511084 CET	443	49771	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.215954065 CET	49771	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.215959072 CET	443	49771	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.532202005 CET	443	49772	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.533396959 CET	49772	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.533433914 CET	443	49772	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.533842087 CET	49772	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.533847094 CET	443	49772	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.661911964 CET	443	49771	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.661978960 CET	443	49771	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.662091970 CET	49771	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.740520000 CET	443	49775	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.742386103 CET	443	49774	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.752063036 CET	443	49773	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.779789925 CET	49771	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.779830933 CET	443	49771	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.779886961 CET	49771	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.779903889 CET	443	49771	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.791294098 CET	49775	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.791294098 CET	49774	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.806871891 CET	49773	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.811759949 CET	49775	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.811769962 CET	443	49775	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.817883968 CET	49775	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.817889929 CET	443	49775	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.821130037 CET	49774	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.821136951 CET	443	49774	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.827620983 CET	49774	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.827646017 CET	443	49774	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.830835104 CET	49773	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.830857992 CET	443	49773	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.837285042 CET	49773	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.837299109 CET	443	49773	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.899064064 CET	49776	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.899136066 CET	443	49776	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.899219990 CET	49776	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.899496078 CET	49776	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.899523973 CET	443	49776	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.977555037 CET	49777	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:47.977766037 CET	49778	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:47.987729073 CET	443	49772	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.987802029 CET	443	49772	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.987838030 CET	49772	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.988281012 CET	49772	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.988296032 CET	443	49772	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.988307953 CET	49772	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.988312960 CET	443	49772	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.994246006 CET	49779	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.994277000 CET	443	49779	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:47.994349003 CET	49779	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.995028973 CET	49779	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:47.995039940 CET	443	49779	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.099788904 CET	80	49777	192.177.111.24	192.168.2.9
Nov 20, 2024 15:09:48.099886894 CET	49777	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:48.100089073 CET	49777	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:48.100327015 CET	80	49778	192.177.111.24	192.168.2.9
Nov 20, 2024 15:09:48.100414991 CET	49778	80	192.168.2.9	192.177.111.24
Nov 20, 2024 15:09:48.188827038 CET	443	49775	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.188893080 CET	443	49774	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.188908100 CET	443	49775	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.188976049 CET	443	49774	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.188998938 CET	49775	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.189019918 CET	49774	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.190257072 CET	49775	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.190278053 CET	443	49775	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.190289021 CET	49775	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.190294027 CET	443	49775	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.191498995 CET	49774	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.191513062 CET	443	49774	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.191524029 CET	49774	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.191529036 CET	443	49774	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.194190025 CET	49780	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.194216013 CET	443	49780	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.194278955 CET	49780	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.194782019 CET	49781	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.194801092 CET	443	49781	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.194850922 CET	49781	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.194948912 CET	49780	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.194962978 CET	443	49780	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.195048094 CET	49781	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.195056915 CET	443	49781	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.206876993 CET	443	49773	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.206959009 CET	443	49773	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.207014084 CET	49773	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.207178116 CET	49773	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.207185984 CET	443	49773	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.207195997 CET	49773	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.207200050 CET	443	49773	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.209686995 CET	49782	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.209702015 CET	443	49782	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.209768057 CET	49782	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.209923983 CET	49782	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:48.209930897 CET	443	49782	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:48.219712973 CET	80	49777	192.177.111.24	192.168.2.9
Nov 20, 2024 15:09:49.699019909 CET	443	49776	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:49.699753046 CET	49776	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:49.699817896 CET	443	49776	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:49.700108051 CET	49776	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:49.700122118 CET	443	49776	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:49.791790009 CET	443	49779	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:49.792438984 CET	49779	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:49.792471886 CET	443	49779	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:49.792891026 CET	49779	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:49.792896986 CET	443	49779	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:49.920311928 CET	443	49781	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:49.920953989 CET	49781	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:49.920994043 CET	443	49781	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:49.921454906 CET	49781	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:49.921459913 CET	443	49781	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.011187077 CET	443	49782	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.011672974 CET	49782	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.011713028 CET	443	49782	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.012181044 CET	49782	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.012187004 CET	443	49782	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.049331903 CET	443	49780	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.049920082 CET	49780	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.049947977 CET	443	49780	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.050358057 CET	49780	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.050363064 CET	443	49780	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.151828051 CET	443	49776	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.151890993 CET	443	49776	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.151957989 CET	49776	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.152179956 CET	49776	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.152193069 CET	443	49776	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.152204037 CET	49776	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.152208090 CET	443	49776	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.155287027 CET	49783	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.155352116 CET	443	49783	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.155451059 CET	49783	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.155621052 CET	49783	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.155635118 CET	443	49783	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.249471903 CET	443	49779	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.249658108 CET	443	49779	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.249749899 CET	49779	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.249866009 CET	49779	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.249866009 CET	49779	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.249883890 CET	443	49779	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.249892950 CET	443	49779	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.253032923 CET	49784	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.253061056 CET	443	49784	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.253146887 CET	49784	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.253268003 CET	49784	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.253283978 CET	443	49784	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.355385065 CET	443	49781	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.355463028 CET	443	49781	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.355565071 CET	49781	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.355751991 CET	49781	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.355770111 CET	443	49781	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.355778933 CET	49781	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.355784893 CET	443	49781	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.358762980 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.358819962 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.358918905 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.359113932 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.359129906 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.471376896 CET	443	49782	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.471467018 CET	443	49782	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.471555948 CET	49782	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.471836090 CET	49782	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.471836090 CET	49782	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.471862078 CET	443	49782	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.471870899 CET	443	49782	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.474735022 CET	49786	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.474770069 CET	443	49786	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.474858046 CET	49786	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.475052118 CET	49786	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.475064039 CET	443	49786	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.513303995 CET	443	49780	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.513366938 CET	443	49780	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.513457060 CET	49780	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.513684034 CET	49780	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.513694048 CET	443	49780	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.513703108 CET	49780	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.513706923 CET	443	49780	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.516877890 CET	49787	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.516933918 CET	443	49787	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:50.517023087 CET	49787	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.517570972 CET	49787	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:50.517589092 CET	443	49787	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:51.754925013 CET	443	49783	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:51.755577087 CET	49783	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:51.755628109 CET	443	49783	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:51.756061077 CET	49783	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:51.756076097 CET	443	49783	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.048353910 CET	443	49784	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.049140930 CET	49784	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.049174070 CET	443	49784	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.049561024 CET	49784	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.049565077 CET	443	49784	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.202146053 CET	443	49783	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.202240944 CET	443	49783	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.202372074 CET	49783	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.202733994 CET	49783	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.202763081 CET	443	49783	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.202796936 CET	49783	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.202805042 CET	443	49783	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.206382036 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.206438065 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.206553936 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.206738949 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.206756115 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.217269897 CET	443	49786	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.217644930 CET	49786	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.217665911 CET	443	49786	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.218065023 CET	49786	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.218070030 CET	443	49786	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.219471931 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.219913960 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.219939947 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.220257044 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.220262051 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.396198988 CET	443	49787	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.396745920 CET	49787	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.396795034 CET	443	49787	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.397166967 CET	49787	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.397172928 CET	443	49787	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.502314091 CET	443	49784	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.502410889 CET	443	49784	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.502518892 CET	49784	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.502693892 CET	49784	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.502713919 CET	443	49784	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.502753973 CET	49784	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.502763033 CET	443	49784	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.505683899 CET	49789	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.505719900 CET	443	49789	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.505805016 CET	49789	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.505969048 CET	49789	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.505983114 CET	443	49789	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.652839899 CET	443	49786	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.652916908 CET	443	49786	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.652992964 CET	49786	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.653199911 CET	49786	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.653214931 CET	443	49786	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.653233051 CET	49786	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.653239965 CET	443	49786	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.656235933 CET	49790	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.656284094 CET	443	49790	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.656347036 CET	49790	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.656528950 CET	49790	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.656547070 CET	443	49790	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.672041893 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.672116995 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.672168016 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.672410011 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.672431946 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.672442913 CET	49785	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.672449112 CET	443	49785	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.675832033 CET	49791	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.675868988 CET	443	49791	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.675935030 CET	49791	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.676086903 CET	49791	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.676098108 CET	443	49791	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.837066889 CET	443	49787	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.837136984 CET	443	49787	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.837217093 CET	49787	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.837435961 CET	49787	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.837455988 CET	443	49787	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.837466002 CET	49787	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.837471962 CET	443	49787	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.840467930 CET	49792	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.840506077 CET	443	49792	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:52.840593100 CET	49792	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.840768099 CET	49792	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:52.840780020 CET	443	49792	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.059488058 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.060471058 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.060484886 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.060606003 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.060609102 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.367454052 CET	443	49789	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.368052959 CET	49789	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.368076086 CET	443	49789	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.368479967 CET	49789	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.368485928 CET	443	49789	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.469002962 CET	443	49791	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.469913006 CET	49791	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.469949007 CET	443	49791	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.470632076 CET	49791	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.470638037 CET	443	49791	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.514447927 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.514517069 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.514590979 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.514779091 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.514796972 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.514807940 CET	49788	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.514813900 CET	443	49788	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.517824888 CET	49793	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.517867088 CET	443	49793	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.517947912 CET	49793	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.518121958 CET	49793	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.518135071 CET	443	49793	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.695780993 CET	443	49792	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.696465969 CET	49792	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.696492910 CET	443	49792	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.697055101 CET	49792	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.697061062 CET	443	49792	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.822746992 CET	443	49789	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.822818041 CET	443	49789	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.822860003 CET	49789	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.823261023 CET	49789	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.823276997 CET	443	49789	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.823287010 CET	49789	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.823292971 CET	443	49789	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.827349901 CET	49794	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.827379942 CET	443	49794	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.827444077 CET	49794	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.827650070 CET	49794	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.827661991 CET	443	49794	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.940254927 CET	443	49791	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.940337896 CET	443	49791	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.940386057 CET	49791	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.940562010 CET	49791	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.940582991 CET	443	49791	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.940593958 CET	49791	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.940598965 CET	443	49791	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.943748951 CET	49795	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.943780899 CET	443	49795	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:54.943851948 CET	49795	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.944076061 CET	49795	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:54.944083929 CET	443	49795	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:55.151257038 CET	443	49792	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:55.151335955 CET	443	49792	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:55.151388884 CET	49792	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:55.151565075 CET	49792	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:55.151572943 CET	443	49792	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:55.151587963 CET	49792	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:55.151593924 CET	443	49792	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:55.155194044 CET	49796	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:55.155222893 CET	443	49796	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:55.155304909 CET	49796	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:55.155446053 CET	49796	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:55.155457020 CET	443	49796	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.395576000 CET	443	49793	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.396352053 CET	49793	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:56.396377087 CET	443	49793	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.397031069 CET	49793	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:56.397037983 CET	443	49793	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.607842922 CET	443	49794	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.608316898 CET	49794	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:56.608331919 CET	443	49794	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.608900070 CET	49794	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:56.608905077 CET	443	49794	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.761787891 CET	443	49795	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.762309074 CET	49795	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:56.762336016 CET	443	49795	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.762964964 CET	49795	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:56.762973070 CET	443	49795	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.850603104 CET	443	49793	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.850692987 CET	443	49793	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.850775957 CET	49793	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:56.850922108 CET	49793	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:56.850922108 CET	49793	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:56.850943089 CET	443	49793	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.850954056 CET	443	49793	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.854067087 CET	49797	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:56.854108095 CET	443	49797	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:56.854171038 CET	49797	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:56.854321003 CET	49797	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:56.854336977 CET	443	49797	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:57.020145893 CET	443	49796	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:57.020577908 CET	49796	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:57.020613909 CET	443	49796	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:57.021101952 CET	49796	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:57.021111012 CET	443	49796	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:57.051994085 CET	443	49794	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:57.052074909 CET	443	49794	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:57.052123070 CET	49794	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:57.052279949 CET	49794	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:57.052285910 CET	443	49794	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:57.052295923 CET	49794	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:57.052299976 CET	443	49794	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:57.055057049 CET	49798	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:57.055097103 CET	443	49798	13.107.246.63	192.168.2.9
Nov 20, 2024 15:09:57.055207968 CET	49798	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:57.055387020 CET	49798	443	192.168.2.9	13.107.246.63
Nov 20, 2024 15:09:57.055402040 CET	443	49798	13.107.246.63	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 15:09:23.343265057 CET	53	63072	1.1.1.1	192.168.2.9
Nov 20, 2024 15:09:23.343776941 CET	53	59938	1.1.1.1	192.168.2.9
Nov 20, 2024 15:09:26.532030106 CET	53	62087	1.1.1.1	192.168.2.9
Nov 20, 2024 15:09:27.331635952 CET	50887	53	192.168.2.9	1.1.1.1
Nov 20, 2024 15:09:27.332031012 CET	49975	53	192.168.2.9	1.1.1.1
Nov 20, 2024 15:09:27.470079899 CET	53	49975	1.1.1.1	192.168.2.9
Nov 20, 2024 15:09:27.470540047 CET	53	50887	1.1.1.1	192.168.2.9
Nov 20, 2024 15:09:43.515075922 CET	53	59215	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 15:09:27.331635952 CET	192.168.2.9	1.1.1.1	0x4261	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 15:09:27.332031012 CET	192.168.2.9	1.1.1.1	0xcea8	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 15:09:27.470079899 CET	1.1.1.1	192.168.2.9	0xcea8	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 15:09:27.470540047 CET	1.1.1.1	192.168.2.9	0x4261	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

otelrules.azureedge.net

fs.microsoft.com

slscr.update.microsoft.com

192.177.111.24

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49723	192.177.111.24	80	2580	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 15:09:24.682717085 CET	429	OUT	GET / HTTP/1.1 Host: 192.177.111.24 Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49777	192.177.111.24	80	2580	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 15:09:48.100089073 CET	455	OUT	GET / HTTP/1.1 Host: 192.177.111.24 Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.9	49706	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:17 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:17 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:17 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 13:10:03 GMT ETag: "0x8DD089B7B2F27B3" x-ms-request-id: 082f1a68-301e-005d-348c-3ae448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140917Z-185f5d8b95cjbkr4hC1NYCeu240000000a700000000091tb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:17 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-20 14:09:18 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-20 14:09:18 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-20 14:09:18 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-20 14:09:18 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-20 14:09:18 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-20 14:09:18 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-20 14:09:18 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-20 14:09:18 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-20 14:09:18 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.9	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:23 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:23 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140923Z-r1d97b99577hsvhhhC1TEByb1w000000035g00000000f380 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:24 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.9	49707	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:23 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:24 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:23 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f909c6c7-c01e-0049-518c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140923Z-185f5d8b95c96jn4hC1NYCbgp80000000ab000000000cvuu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:24 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.9	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:23 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:24 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e579fe48-a01e-001e-648c-3a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140924Z-185f5d8b95crl6swhC1NYC3ueg0000000af000000000f0zc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:24 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.9	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:23 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:24 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:24 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 884d2a23-a01e-00ab-5b8c-3a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140924Z-185f5d8b95cdtclvhC1NYC4rmc0000000ad000000000mm31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:24 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.9	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:23 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:24 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:24 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140924Z-r1d97b99577ckpmjhC1TEBrzs000000009100000000086x7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:24 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.9	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:26 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bfe6cc7a-201e-006e-7e8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140926Z-r1d97b99577lxltfhC1TEByw2s00000008wg00000000myzy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.9	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:26 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3126d9de-f01e-0099-4d8c-3a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140926Z-185f5d8b95c5lcmhhC1NYCsnsw0000000aag00000000reag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.9	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:26 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140926Z-r1d97b99577hc74hhC1TEBvbns00000008y0000000000e9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:26 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.9	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:26 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:26 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140926Z-185f5d8b95csp6jmhC1NYCwy6s0000000a5g00000000scgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:26 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.9	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:26 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:26 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:26 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140926Z-r1d97b99577mrt4rhC1TEBftkc00000008wg000000007tc7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:26 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.9	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:28 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:28 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140928Z-185f5d8b95csp6jmhC1NYCwy6s0000000a7g00000000n8wv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.9	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:28 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: d278da68-d01e-002b-0c18-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140928Z-r1d97b995778dpcthC1TEB4b5400000008x0000000006zzd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.9	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:28 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 438f5de3-f01e-0052-361c-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140928Z-r1d97b99577l6wbzhC1TEB3fwn00000008zg00000000gptd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.9	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:28 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:28 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140928Z-185f5d8b95cf7qddhC1NYC66an0000000afg00000000261r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.9	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:28 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140929Z-185f5d8b95cf7qddhC1NYC66an0000000a9g00000000r67r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49732	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:29 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 14:09:30 UTC	465	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF45) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=9406 Date: Wed, 20 Nov 2024 14:09:29 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.9	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:30 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7511ce5b-801e-0083-468c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140931Z-1777c6cb754gc8g6hC1TEB966c00000009t0000000001zp9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:31 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.9	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:30 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:31 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140931Z-1777c6cb754lvj6mhC1TEBke9400000009sg00000000batp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.9	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:30 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:31 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140931Z-r1d97b99577gg97qhC1TEBcrf400000008qg00000000k8n1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:31 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.9	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:31 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:31 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140931Z-r1d97b9957747b9jhC1TEBgyec00000008zg00000000fv5d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.9	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:31 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:31 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a1cde93a-f01e-0020-638c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140931Z-r1d97b99577656nchC1TEBk98c000000090000000000bw7a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:31 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49738	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:31 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 14:09:32 UTC	533	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=9420 Date: Wed, 20 Nov 2024 14:09:32 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-20 14:09:32 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.9	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:33 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:33 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f1ce2f4-701e-0001-5e8c-3ab110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140933Z-185f5d8b95c96jn4hC1NYCbgp80000000aag00000000fpve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.9	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:33 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140933Z-185f5d8b95crwqd8hC1NYCps680000000a8000000000qw3t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.9	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:33 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:33 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140933Z-1777c6cb754gvvgfhC1TEBz4rg00000009v0000000002uq7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:34 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.9	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:33 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140933Z-r1d97b99577hc74hhC1TEBvbns00000008ug0000000093c0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.9	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:33 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:33 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140933Z-1777c6cb754lvj6mhC1TEBke9400000009p000000000nz40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:34 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.9	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:35 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:35 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140935Z-1777c6cb754wcxkwhC1TEB3c6w00000009q0000000004n00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:36 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.9	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:35 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:36 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 16a2fbdb-801e-002a-4d23-3b31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140936Z-r1d97b99577n4dznhC1TEBc1qw0000000910000000007qhp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:36 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.9	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:36 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 657669b3-a01e-0002-118c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140936Z-1777c6cb754xrr98hC1TEB3kag00000009mg0000000052k7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.9	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:36 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:36 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140936Z-1777c6cb754mqztshC1TEB4mkc00000009pg00000000hyhq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:36 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.9	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:36 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:36 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: c6b0c23f-801e-0048-738c-3af3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140936Z-1777c6cb754gvvgfhC1TEBz4rg00000009p000000000p49e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:36 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	49749	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:37 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=3DDWeYvxN5kAWwg&MD=WtMWrc4d HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 14:09:37 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0317222f-0ac7-4940-a6bf-f6980bad7856 MS-RequestId: 56abec86-b083-47bb-88bc-8fee27fd2ef7 MS-CV: jxFO/V6pBkiggD6L.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 14:09:36 GMT Connection: close Content-Length: 24490
2024-11-20 14:09:37 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-20 14:09:37 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.9	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:37 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:38 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140938Z-185f5d8b95cqnkdjhC1NYCm8w80000000a7g0000000080yr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:38 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.9	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:38 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140938Z-r1d97b99577ndm4rhC1TEBf0ps000000091000000000d7zf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.9	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:38 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140938Z-185f5d8b95cf7qddhC1NYC66an0000000adg00000000bt0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.9	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:38 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:38 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:38 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140938Z-r1d97b99577hsvhhhC1TEByb1w000000038000000000admg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:38 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.9	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:38 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:38 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: ac667451-e01e-003c-3e8c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140938Z-1777c6cb754ww792hC1TEBzqu400000009m000000000756c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:38 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.9	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:40 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:40 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 70a27ff5-201e-0051-4e8c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140940Z-1777c6cb7549x5qchC1TEBggbg00000009rg00000000edfv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:40 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.9	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:40 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:40 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140940Z-185f5d8b95ckwnflhC1NYCx9qs0000000a9000000000rtan x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:40 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.9	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:40 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140940Z-185f5d8b95cdcwrthC1NYCy5b80000000a7g00000000pc2y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.9	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:40 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:40 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140940Z-185f5d8b95c95vpshC1NYC759c0000000abg00000000acf2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:41 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.9	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:40 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:40 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140940Z-1777c6cb754lvj6mhC1TEBke9400000009tg000000008bap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:41 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.9	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:42 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:42 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140942Z-1777c6cb754b7tdghC1TEBwwa400000009vg000000008981 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:43 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.9	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:42 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:43 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140943Z-185f5d8b95csd4bwhC1NYCq7dc0000000a5000000000rhnb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:43 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.9	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:42 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:43 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140943Z-185f5d8b95cp7lkfhC1NYC7rpw0000000afg00000000bga9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:43 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.9	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:42 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:43 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140943Z-185f5d8b95cdtclvhC1NYC4rmc0000000af000000000e5ne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:43 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.9	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:43 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:43 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5b8b83f7-201e-0033-0b8c-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140943Z-185f5d8b95c4bhwphC1NYCs8gw0000000adg00000000hhd9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:43 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.9	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:44 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:45 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140945Z-185f5d8b95cqnkdjhC1NYCm8w80000000a7g0000000081r0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:45 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.9	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:45 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:45 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0514cbb3-901e-00ac-0281-3ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140945Z-185f5d8b95cdcwrthC1NYCy5b80000000a6g00000000pq2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:45 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.9	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:45 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:45 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b82dc135-b01e-0053-1a8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140945Z-r1d97b99577sdxndhC1TEBec5n000000092000000000cf91 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:45 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.9	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:45 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140945Z-r1d97b99577656nchC1TEBk98c00000008zg00000000c3wx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.9	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:45 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:45 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140945Z-1777c6cb754vxwc9hC1TEBykgw00000009r0000000008fz0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:45 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.9	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:47 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:47 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd359c47-601e-0002-7817-3ba786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140947Z-r1d97b99577gg97qhC1TEBcrf400000008sg00000000ctu9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.9	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:47 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:47 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140947Z-185f5d8b95crwqd8hC1NYCps680000000abg0000000094ad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:47 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.9	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:47 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:48 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 8e68b2a4-701e-005c-1a8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140948Z-r1d97b995778dpcthC1TEB4b5400000008wg000000007sbg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:48 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.9	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:47 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140948Z-185f5d8b95cx9g8lhC1NYCtgvc00000002t0000000001k7d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:48 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.9	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:47 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: be70f01e-301e-000c-538c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140948Z-185f5d8b95cdtclvhC1NYC4rmc0000000ac000000000s379 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.9	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:49 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:49 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: f37cb76d-d01e-0017-2085-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140949Z-185f5d8b95cdh56ghC1NYCk1x4000000045000000000fby8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:50 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.9	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:49 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:50 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140950Z-1777c6cb754xjpthhC1TEBexs800000009hg00000000b051 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:50 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.9	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:49 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:50 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:50 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: c9d6026a-001e-0014-11f3-3a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140950Z-r1d97b99577ckpmjhC1TEBrzs00000000930000000002k1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 14:09:50 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.9	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:50 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:50 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140950Z-1777c6cb754lv4cqhC1TEB13us00000009hg00000000r8ev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:50 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.9	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:50 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:50 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 38897a0b-401e-000a-7a8c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140950Z-r1d97b99577tssmjhC1TEB8kan00000008wg0000000078z5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:50 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.9	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:51 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:52 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 733c43f5-901e-007b-0e8c-3aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140952Z-1777c6cb754gc8g6hC1TEB966c00000009r0000000008gvz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:52 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.9	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:52 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:52 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0cd4e810-101e-0079-148c-3a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140952Z-1777c6cb7549x5qchC1TEBggbg00000009vg0000000014ng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:52 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.9	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:52 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:52 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 8d3bd1e1-301e-000c-7cf2-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140952Z-r1d97b99577hsvhhhC1TEByb1w000000036000000000ea23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:52 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.9	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:52 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:52 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140952Z-1777c6cb754whff4hC1TEBcd6c000000088g00000000m1ad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:52 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.9	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:52 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:52 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140952Z-185f5d8b95c5lcmhhC1NYCsnsw0000000a9000000000ugtc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:52 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.9	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:54 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:54 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: df9fe3f7-701e-0032-7501-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140954Z-r1d97b99577n5jhbhC1TEB74vn00000008y000000000agq5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:54 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.9	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:54 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:54 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 41283c59-801e-0015-058c-3af97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140954Z-1777c6cb754gc8g6hC1TEB966c00000009tg00000000012s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:54 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.9	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:54 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:54 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140954Z-r1d97b99577d6qrbhC1TEBux5s000000091g00000000fpg0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:54 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.9	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:54 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:55 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:54 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 4f8e9926-c01e-00ad-7c8c-3aa2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140954Z-185f5d8b95cf7qddhC1NYC66an0000000ae0000000008h08 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:55 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.9	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:56 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:56 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140956Z-1777c6cb754gvvgfhC1TEBz4rg00000009pg00000000mrcq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:56 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.9	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:56 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:56 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: cb785bac-301e-0000-6c8c-3aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140956Z-r1d97b99577sdxndhC1TEBec5n0000000950000000003vm5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:57 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.9	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:56 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:57 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140957Z-r1d97b99577ndm4rhC1TEBf0ps000000093g000000007hzn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:57 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.9	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:57 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:57 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140957Z-185f5d8b95cgrrn8hC1NYCgwh40000000a9g000000000a5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:57 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.9	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 14:09:57 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 14:09:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 14:09:57 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 9cb1ed33-701e-0021-398c-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T140957Z-185f5d8b95cdcwrthC1NYCy5b80000000ac0000000006g4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 14:09:57 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 6420, Parent PID: 5540

General

Target ID:	1
Start time:	09:09:16
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 2580, Parent PID: 6420

General

Target ID:	3
Start time:	09:09:21
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 --field-trial-handle=2036,i,4201370858838406440,1876458737403338155,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5352, Parent PID: 5540

General

Target ID:	4
Start time:	09:09:23
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://192.177.111.24"
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://192.177.111.24

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Errors

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6420, Parent PID: 5540

General

Chronological Activities

Analysis Process: chrome.exePID: 2580, Parent PID: 6420

General

Chronological Activities

Windows Analysis Report
http://192.177.111.24