Edit tour

Windows Analysis Report
http://bc1qlpk73pgj3dz02nq8d9kpdxk.org

Overview

General Information

Sample URL:	http://bc1qlpk73pgj3dz02nq8d9kpdxk.org
Analysis ID:	1560399
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5432 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2264,i,11239854592833149862,5177491342514730736,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bc1qlpk73pgj3dz02nq8d9kpdxk.org" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: http://bc1qlpk73pgj3dz02nq8d9kpdxk.org

Avira URL Cloud: detection malicious, Label: malware

Antivirus detection for URL or domain

Source: https://bc1qlpk73pgj3dz02nq8d9kpdxk.org/favicon.ico	Avira URL Cloud: Label: malware
Source: http://bc1qlpk73pgj3dz02nq8d9kpdxk.org/	Avira URL Cloud: Label: malware

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49753 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.218.208.109
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 178.79.238.128
Source: unknown	TCP traffic detected without corresponding DNS query: 178.79.238.128
Source: unknown	TCP traffic detected without corresponding DNS query: 178.79.238.128
Source: unknown	TCP traffic detected without corresponding DNS query: 178.79.238.128
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bc1qlpk73pgj3dz02nq8d9kpdxk.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: bc1qlpk73pgj3dz02nq8d9kpdxk.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://bc1qlpk73pgj3dz02nq8d9kpdxk.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BgLLrZzD5p4gxbt&MD=ED+ARY9o HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BgLLrZzD5p4gxbt&MD=ED+ARY9o HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: bc1qlpk73pgj3dz02nq8d9kpdxk.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: bc1qlpk73pgj3dz02nq8d9kpdxk.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 21 Nov 2024 17:47:45 GMTServer: Apache/2.4.52 (Ubuntu)Content-Length: 294Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49753 version: TLS 1.2

Source: classification engine

Classification label: mal56.win@17/4@8/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2264,i,11239854592833149862,5177491342514730736,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bc1qlpk73pgj3dz02nq8d9kpdxk.org"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2264,i,11239854592833149862,5177491342514730736,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://bc1qlpk73pgj3dz02nq8d9kpdxk.org	100%	Avira URL Cloud	malware

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://bc1qlpk73pgj3dz02nq8d9kpdxk.org/favicon.ico	100%	Avira URL Cloud	malware
http://bc1qlpk73pgj3dz02nq8d9kpdxk.org/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bc1qlpk73pgj3dz02nq8d9kpdxk.org	154.216.17.193	true	false		high
www.google.com	142.250.181.100	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://bc1qlpk73pgj3dz02nq8d9kpdxk.org/	true	Avira URL Cloud: malware	unknown
https://bc1qlpk73pgj3dz02nq8d9kpdxk.org/	false		unknown
https://bc1qlpk73pgj3dz02nq8d9kpdxk.org/favicon.ico	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.216.17.193	bc1qlpk73pgj3dz02nq8d9kpdxk.org	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560399
Start date and time:	2024-11-21 18:46:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://bc1qlpk73pgj3dz02nq8d9kpdxk.org
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@17/4@8/4

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.19.238, 74.125.205.84, 34.104.35.123, 2.20.68.210, 192.229.221.95, 172.217.17.67
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://bc1qlpk73pgj3dz02nq8d9kpdxk.org

Simulations

Behavior and APIs

⊘No simulations

Input	Output
URL: http://bc1qlpk73pgj3dz02nq8d9kpdxk.org Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://bc1qlpk73pgj3dz02nq8d9kpdxk.org
URL: https://bc1qlpk73pgj3dz02nq8d9kpdxk.org/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Site is coming soon!!", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://bc1qlpk73pgj3dz02nq8d9kpdxk.org/ Model: Joe Sandbox AI	{ "brands": [] }

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 41

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	21
Entropy (8bit):	3.4273334938982654
Encrypted:	false
SSDEEP:	3:xKGNQt:x7mt
MD5:	B93F7F189C790DF6BA03B02CE34992C6
SHA1:	FAE19625E4770FC922B28949B80E5C245CAD3A78
SHA-256:	3561C489D0B2FF97C747C10BB39D826D4E69C62C7E13BF423492735221298843
SHA-512:	089711C4E21F2DF6BC5DC6E2BC13974A0F2D1AF608A2175C25C049A9E15AAA2BBDCD2DD6A8DBA8BBB375F7DAFFB0C9D9334486546B6419DCC5EE5FD4983261DD
Malicious:	false
Reputation:	low
URL:	https://bc1qlpk73pgj3dz02nq8d9kpdxk.org/
Preview:	Site is coming soon!!

Chrome Cache Entry: 42

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	294
Entropy (8bit):	5.381095299317023
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoIRCwtUrMcyq8oD:J0+oxBeRmR9etdzRxGezHthq8+
MD5:	D9AAEB466757662841D14A8FBC3A0ECA
SHA1:	B048E49BDEF7B06E5C59CCFCA0C7B8FF039FE93B
SHA-256:	B8C6A7EF4E33A1AA0E8F1EEA0CC46C5A71233A8F1760484B047BCBD6B5A38D5D
SHA-512:	45EB211E95434E1869E8B58F459DEE57A469D4626023D20F46A299B1444CEC8EE5F7B4EB6ED7459F901E8F940EC0D67888CB2E0468E6790997FF2E2D8E3482FD
Malicious:	false
Reputation:	low
URL:	https://bc1qlpk73pgj3dz02nq8d9kpdxk.org/favicon.ico
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<hr>.<address>Apache/2.4.52 (Ubuntu) Server at bc1qlpk73pgj3dz02nq8d9kpdxk.org Port 443</address>.</body></html>.

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 18:47:33.454085112 CET	49675	443	192.168.2.4	173.222.162.32
Nov 21, 2024 18:47:39.761482000 CET	49737	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:39.762025118 CET	49738	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:39.830780983 CET	49739	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:39.881155014 CET	80	49737	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:39.881258011 CET	49737	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:39.881519079 CET	49737	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:39.881597996 CET	80	49738	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:39.881704092 CET	49738	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:39.950565100 CET	80	49739	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:39.950676918 CET	49739	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:40.001166105 CET	80	49737	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:40.124603987 CET	49740	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:47:40.124710083 CET	443	49740	142.250.181.100	192.168.2.4
Nov 21, 2024 18:47:40.124834061 CET	49740	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:47:40.125216961 CET	49740	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:47:40.125252008 CET	443	49740	142.250.181.100	192.168.2.4
Nov 21, 2024 18:47:41.183032990 CET	80	49737	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:41.233460903 CET	49737	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:41.297842026 CET	49741	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:41.297930956 CET	443	49741	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:41.298072100 CET	49741	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:41.299900055 CET	49741	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:41.299937010 CET	443	49741	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:41.327693939 CET	49742	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:41.327739000 CET	443	49742	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:41.327816010 CET	49742	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:41.328075886 CET	49742	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:41.328093052 CET	443	49742	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:41.882153034 CET	443	49740	142.250.181.100	192.168.2.4
Nov 21, 2024 18:47:41.882484913 CET	49740	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:47:41.882531881 CET	443	49740	142.250.181.100	192.168.2.4
Nov 21, 2024 18:47:41.884025097 CET	443	49740	142.250.181.100	192.168.2.4
Nov 21, 2024 18:47:41.884088039 CET	49740	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:47:41.885204077 CET	49740	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:47:41.885298014 CET	443	49740	142.250.181.100	192.168.2.4
Nov 21, 2024 18:47:41.938571930 CET	49740	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:47:41.938608885 CET	443	49740	142.250.181.100	192.168.2.4
Nov 21, 2024 18:47:41.986062050 CET	49740	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:47:42.729708910 CET	443	49741	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:42.730392933 CET	49741	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:42.733611107 CET	49741	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:42.733637094 CET	443	49741	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:42.733922958 CET	443	49741	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:42.781275034 CET	49741	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:42.781827927 CET	49741	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:42.822678089 CET	443	49742	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:42.823072910 CET	49742	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:42.823112011 CET	443	49742	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:42.824620962 CET	443	49742	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:42.824742079 CET	49742	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:42.827346087 CET	443	49741	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:42.830322027 CET	49742	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:42.830493927 CET	443	49742	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:42.830545902 CET	49742	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:42.874866962 CET	49742	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:42.874914885 CET	443	49742	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:42.920866013 CET	49742	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:43.254369020 CET	443	49741	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:43.254539013 CET	443	49741	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:43.254722118 CET	49741	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:43.254722118 CET	49741	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:43.254796028 CET	443	49741	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:43.254828930 CET	49741	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:43.254847050 CET	443	49741	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:43.287756920 CET	49743	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:43.287787914 CET	443	49743	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:43.287997961 CET	49743	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:43.288325071 CET	49743	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:43.288338900 CET	443	49743	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:43.655132055 CET	443	49742	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:43.655338049 CET	443	49742	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:43.655530930 CET	49742	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:43.656686068 CET	49742	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:43.656708002 CET	443	49742	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:43.725303888 CET	49744	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:43.725399017 CET	443	49744	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:43.725560904 CET	49744	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:43.725778103 CET	49744	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:43.725816011 CET	443	49744	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:44.670150042 CET	443	49743	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:44.670264959 CET	49743	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:44.671474934 CET	49743	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:44.671505928 CET	443	49743	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:44.671853065 CET	443	49743	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:44.673616886 CET	49743	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:44.719331980 CET	443	49743	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:45.201889992 CET	443	49743	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:45.201971054 CET	443	49743	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:45.202074051 CET	49743	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:45.202977896 CET	49743	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:45.202977896 CET	49743	443	192.168.2.4	23.218.208.109
Nov 21, 2024 18:47:45.203027964 CET	443	49743	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:45.203056097 CET	443	49743	23.218.208.109	192.168.2.4
Nov 21, 2024 18:47:45.247970104 CET	443	49744	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:45.248287916 CET	49744	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:45.248332977 CET	443	49744	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:45.249819994 CET	443	49744	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:45.250241041 CET	49744	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:45.250452042 CET	443	49744	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:45.250583887 CET	49744	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:45.295344114 CET	443	49744	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:45.812036991 CET	443	49744	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:45.812238932 CET	443	49744	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:45.812304974 CET	49744	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:45.813822031 CET	49744	443	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:45.813842058 CET	443	49744	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:46.183463097 CET	80	49737	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:46.183557987 CET	49737	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:46.611382008 CET	49737	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:47:46.731060982 CET	80	49737	154.216.17.193	192.168.2.4
Nov 21, 2024 18:47:47.020232916 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:47.020347118 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:47.020522118 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:47.021437883 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:47.021492004 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:48.739414930 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:48.739528894 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:48.742604017 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:48.742636919 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:48.743172884 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:48.797199965 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:50.510411978 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:50.551350117 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:51.076174021 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:51.076210022 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:51.076217890 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:51.076288939 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:51.076339960 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:51.076347113 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:51.076364994 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:51.076407909 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:51.076432943 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:51.076432943 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:51.076453924 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:51.095297098 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:51.095396996 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:51.095426083 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:51.095474958 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:51.095520020 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:51.587447882 CET	443	49740	142.250.181.100	192.168.2.4
Nov 21, 2024 18:47:51.587513924 CET	443	49740	142.250.181.100	192.168.2.4
Nov 21, 2024 18:47:51.587595940 CET	49740	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:47:52.553360939 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:52.553442001 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:52.553479910 CET	49746	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:47:52.553498983 CET	443	49746	172.202.163.200	192.168.2.4
Nov 21, 2024 18:47:52.610377073 CET	49740	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:47:52.610426903 CET	443	49740	142.250.181.100	192.168.2.4
Nov 21, 2024 18:47:52.974406958 CET	49723	80	192.168.2.4	178.79.238.128
Nov 21, 2024 18:47:53.095448017 CET	80	49723	178.79.238.128	192.168.2.4
Nov 21, 2024 18:47:53.095604897 CET	49723	80	192.168.2.4	178.79.238.128
Nov 21, 2024 18:48:19.346000910 CET	80	49724	178.79.238.128	192.168.2.4
Nov 21, 2024 18:48:19.346257925 CET	49724	80	192.168.2.4	178.79.238.128
Nov 21, 2024 18:48:19.346257925 CET	49724	80	192.168.2.4	178.79.238.128
Nov 21, 2024 18:48:19.466667891 CET	80	49724	178.79.238.128	192.168.2.4
Nov 21, 2024 18:48:24.891030073 CET	49738	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:48:24.953500986 CET	49739	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:48:25.010740042 CET	80	49738	154.216.17.193	192.168.2.4
Nov 21, 2024 18:48:25.076527119 CET	80	49739	154.216.17.193	192.168.2.4
Nov 21, 2024 18:48:27.382863998 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:27.382955074 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:27.383049011 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:27.383368015 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:27.383420944 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:28.943424940 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:28.943527937 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:28.943620920 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:28.944015026 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:28.944051981 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:29.302469015 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:29.302608013 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:29.307472944 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:29.307514906 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:29.307940006 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:29.316963911 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:29.363385916 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:29.794770956 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:29.794832945 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:29.794877052 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:29.794935942 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:29.794987917 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:29.795023918 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:29.795047045 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:29.995671034 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:29.995733976 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:29.995810986 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:29.995850086 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:29.995881081 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:29.995902061 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.053981066 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.054014921 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.054100990 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.054114103 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.054164886 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.187103987 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.187134027 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.187191010 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.187222004 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.187253952 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.187273026 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.224246025 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.224333048 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.224334002 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.224364996 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.224419117 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.244463921 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.244508028 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.244566917 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.244585991 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.244615078 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.244643927 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.261931896 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.261941910 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.261989117 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.261997938 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.262061119 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.386065960 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.386090040 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.386153936 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.386219025 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.386255980 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.386275053 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.403842926 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.403888941 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.403925896 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.403949976 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.403980017 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.404004097 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.419517040 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.419570923 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.419620037 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.419688940 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.419714928 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.419749022 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.430883884 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.430913925 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.430963993 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.431004047 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.431039095 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.431068897 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.440669060 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.440736055 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.440794945 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.441488981 CET	49752	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.441523075 CET	443	49752	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.485939980 CET	49754	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.486001968 CET	443	49754	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.486100912 CET	49754	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.488226891 CET	49755	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.488279104 CET	443	49755	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.488348007 CET	49755	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.488578081 CET	49754	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.488607883 CET	443	49754	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.490303040 CET	49756	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.490345001 CET	443	49756	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.490406990 CET	49756	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.490751028 CET	49755	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.490767956 CET	443	49755	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.490998030 CET	49756	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.491014004 CET	443	49756	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.494241953 CET	49757	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.494275093 CET	443	49757	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.494335890 CET	49757	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.494515896 CET	49757	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.494528055 CET	443	49757	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.495723009 CET	49758	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.495731115 CET	443	49758	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.495791912 CET	49758	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.495979071 CET	49758	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:30.495990992 CET	443	49758	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:30.658118963 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:30.658319950 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:30.660482883 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:30.660511017 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:30.660871029 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:30.668338060 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:30.711371899 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:31.342032909 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:31.342053890 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:31.342135906 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:31.342139959 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:31.342211008 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:31.342247963 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:31.342271090 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:31.378578901 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:31.378619909 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:31.378664970 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:31.378777027 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:31.378777027 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:31.378907919 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:31.378946066 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:31.378973007 CET	49753	443	192.168.2.4	172.202.163.200
Nov 21, 2024 18:48:31.378987074 CET	443	49753	172.202.163.200	192.168.2.4
Nov 21, 2024 18:48:32.189263105 CET	443	49756	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.189997911 CET	49756	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.190037012 CET	443	49756	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.190398932 CET	49756	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.190407038 CET	443	49756	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.223119020 CET	443	49754	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.223542929 CET	49754	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.223628998 CET	443	49754	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.223891973 CET	49754	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.223906040 CET	443	49754	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.271099091 CET	443	49757	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.271568060 CET	49757	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.271666050 CET	443	49757	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.275182009 CET	49757	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.275234938 CET	443	49757	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.283891916 CET	443	49758	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.284384966 CET	49758	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.284413099 CET	443	49758	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.284704924 CET	49758	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.284709930 CET	443	49758	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.299581051 CET	443	49755	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.300143957 CET	49755	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.300220013 CET	443	49755	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.300339937 CET	49755	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.300354004 CET	443	49755	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.442843914 CET	80	49738	154.216.17.193	192.168.2.4
Nov 21, 2024 18:48:32.442941904 CET	49738	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:48:32.611385107 CET	49738	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:48:32.641043901 CET	443	49756	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.641232014 CET	443	49756	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.641304970 CET	49756	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.641469002 CET	49756	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.641493082 CET	443	49756	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.641505957 CET	49756	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.641514063 CET	443	49756	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.644722939 CET	49759	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.644768953 CET	443	49759	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.644870043 CET	49759	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.645076990 CET	49759	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.645093918 CET	443	49759	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.655838966 CET	443	49754	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.655890942 CET	443	49754	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.655962944 CET	49754	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.656023026 CET	443	49754	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.656092882 CET	49754	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.656167984 CET	49754	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.656167984 CET	49754	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.656187057 CET	443	49754	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.656568050 CET	443	49754	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.656650066 CET	443	49754	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.656832933 CET	49754	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.658262968 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.658355951 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.658454895 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.658617973 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.658652067 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.707231045 CET	443	49757	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.708025932 CET	80	49739	154.216.17.193	192.168.2.4
Nov 21, 2024 18:48:32.708122015 CET	49739	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:48:32.709580898 CET	443	49757	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.709654093 CET	49757	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.709703922 CET	49757	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.709733009 CET	443	49757	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.709759951 CET	49757	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.709774017 CET	443	49757	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.711847067 CET	49761	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.711880922 CET	443	49761	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.711966038 CET	49761	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.712155104 CET	49761	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.712169886 CET	443	49761	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.731183052 CET	80	49738	154.216.17.193	192.168.2.4
Nov 21, 2024 18:48:32.732614994 CET	443	49758	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.732630968 CET	443	49758	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.732677937 CET	49758	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.732688904 CET	443	49758	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.732944965 CET	49758	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.732944965 CET	49758	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.732959986 CET	443	49758	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.733052969 CET	443	49758	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.733076096 CET	443	49758	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.733119965 CET	49758	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.734586000 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.734648943 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.734744072 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.734913111 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.734934092 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.749524117 CET	443	49755	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.749553919 CET	443	49755	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.749631882 CET	49755	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.749701023 CET	443	49755	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.749772072 CET	49755	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.749859095 CET	49755	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.749877930 CET	443	49755	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.749914885 CET	49755	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.750056982 CET	443	49755	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.750091076 CET	443	49755	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.750139952 CET	49755	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.751696110 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.751734972 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:32.751817942 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.751996040 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:32.752012968 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.381187916 CET	443	49759	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.381989956 CET	49759	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.382054090 CET	443	49759	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.382803917 CET	49759	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.382817984 CET	443	49759	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.447997093 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.449372053 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.449423075 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.449793100 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.449807882 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.535389900 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.536031008 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.536091089 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.536482096 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.536498070 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.551651001 CET	443	49761	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.552198887 CET	49761	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.552261114 CET	443	49761	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.552820921 CET	49761	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.552834988 CET	443	49761	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.566834927 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.567261934 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.567291975 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.567894936 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.567904949 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.611836910 CET	49739	80	192.168.2.4	154.216.17.193
Nov 21, 2024 18:48:34.731445074 CET	80	49739	154.216.17.193	192.168.2.4
Nov 21, 2024 18:48:34.817114115 CET	443	49759	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.817190886 CET	443	49759	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.817373037 CET	49759	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.817581892 CET	49759	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.817581892 CET	49759	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.817629099 CET	443	49759	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.817656994 CET	443	49759	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.821286917 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.821335077 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.821434975 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.821676970 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.821692944 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.891050100 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.891201019 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.891417980 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.891498089 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.891498089 CET	49760	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.891546965 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.891580105 CET	443	49760	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.894370079 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.894458055 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.894563913 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.894735098 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.894772053 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.994980097 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.995127916 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.995309114 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.995309114 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.995309114 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.998130083 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.998150110 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:34.998238087 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.998409033 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:34.998421907 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.010891914 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.011065960 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.011137009 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.011225939 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.011271954 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.011301994 CET	49763	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.011343956 CET	443	49763	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.013770103 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.013853073 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.013946056 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.014084101 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.014115095 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.027590036 CET	443	49761	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.027739048 CET	443	49761	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.027807951 CET	49761	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.028784990 CET	49761	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.028811932 CET	443	49761	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.028836966 CET	49761	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.028850079 CET	443	49761	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.031927109 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.032013893 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.032104969 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.032253027 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.032298088 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:35.296924114 CET	49762	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:35.296961069 CET	443	49762	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.666908026 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.667478085 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:36.667495966 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.668088913 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:36.668093920 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.749366045 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.750036001 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:36.750046968 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.750677109 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:36.750680923 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.757883072 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.758477926 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:36.758517027 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.758936882 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:36.758964062 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.761146069 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.761574030 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:36.761694908 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.761920929 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:36.761938095 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.872031927 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.872670889 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:36.872730017 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:36.873262882 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:36.873276949 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.123861074 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.123914957 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.124197006 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.124242067 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.124264956 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.124279022 CET	49764	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.124285936 CET	443	49764	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.127760887 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.127845049 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.127968073 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.128170967 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.128190041 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.189340115 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.189502001 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.189630032 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.189661026 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.189675093 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.189687967 CET	49766	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.189693928 CET	443	49766	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.192013025 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.192082882 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.192183018 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.192380905 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.192426920 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.192459106 CET	49768	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.192475080 CET	443	49768	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.192766905 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.192796946 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.194504023 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.194675922 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.194685936 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.195113897 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.195152998 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.195210934 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.195326090 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.195336103 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.212913990 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.213064909 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.213301897 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.213301897 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.213301897 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.215719938 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.215806007 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.215931892 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.216048956 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.216075897 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.328983068 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.329065084 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.329366922 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.329366922 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.329366922 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.331758022 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.331772089 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.331859112 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.332011938 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.332020998 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.515455008 CET	49765	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.515502930 CET	443	49765	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:37.546760082 CET	49767	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:37.546781063 CET	443	49767	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:38.931154013 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:38.931756020 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:38.931832075 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:38.932406902 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:38.932420969 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.056245089 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.056638956 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.056673050 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.057183027 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.057192087 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.083278894 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.083615065 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.083687067 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.084146976 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.084161997 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.086211920 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.086483955 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.086509943 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.086956978 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.086965084 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.186969042 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.187553883 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.187586069 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.188188076 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.188194036 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.375737906 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.375816107 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.375885963 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.376065016 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.376112938 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.376141071 CET	49770	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.376157999 CET	443	49770	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.379363060 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.379452944 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.379523993 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.379687071 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.379710913 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.509176970 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.509321928 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.509392023 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.509535074 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.509581089 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.509609938 CET	49771	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.509625912 CET	443	49771	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.512608051 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.512648106 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.512721062 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.512886047 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.512903929 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.537679911 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.537838936 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.537904024 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.537986040 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.537986040 CET	49773	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.538047075 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.538078070 CET	443	49773	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.540267944 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.540414095 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.540472984 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.540513039 CET	49772	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.540532112 CET	443	49772	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.540601969 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.540684938 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.540767908 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.541066885 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.541100979 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.543004990 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.543016911 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.543085098 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.543258905 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.543272972 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.639921904 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.640002012 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.640053034 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.640144110 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.640151978 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.640163898 CET	49774	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.640171051 CET	443	49774	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.642390966 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.642430067 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:39.642497063 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.642667055 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:39.642693996 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:40.048568010 CET	49780	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:48:40.048657894 CET	443	49780	142.250.181.100	192.168.2.4
Nov 21, 2024 18:48:40.048763990 CET	49780	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:48:40.048962116 CET	49780	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:48:40.048996925 CET	443	49780	142.250.181.100	192.168.2.4
Nov 21, 2024 18:48:41.162847042 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.163475990 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.163542986 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.163907051 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.163919926 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.348027945 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.348584890 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.348647118 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.349042892 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.349055052 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.351937056 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.352200985 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.352262974 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.352482080 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.352497101 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.423371077 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.423685074 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.423723936 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.424004078 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.424014091 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.539406061 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.539833069 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.539871931 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.540270090 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.540282965 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.618469000 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.618532896 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.618594885 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.618762016 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.618801117 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.618829966 CET	49775	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.618844986 CET	443	49775	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.621638060 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.621674061 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.621754885 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.621908903 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.621922970 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.883233070 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.883409977 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.883487940 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.883559942 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.883615017 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.883646011 CET	49778	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.883661985 CET	443	49778	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.886257887 CET	443	49780	142.250.181.100	192.168.2.4
Nov 21, 2024 18:48:41.886462927 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.886524916 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.886554956 CET	49780	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:48:41.886591911 CET	443	49780	142.250.181.100	192.168.2.4
Nov 21, 2024 18:48:41.886622906 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.886737108 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.886755943 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.886919975 CET	443	49780	142.250.181.100	192.168.2.4
Nov 21, 2024 18:48:41.887299061 CET	49780	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:48:41.887372017 CET	443	49780	142.250.181.100	192.168.2.4
Nov 21, 2024 18:48:41.889082909 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.889260054 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.889344931 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.889345884 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.889429092 CET	49777	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.889466047 CET	443	49777	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.891221046 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.891247034 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.891325951 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.891450882 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.891459942 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.914936066 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.915077925 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.915158033 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.915224075 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.915224075 CET	49779	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.915246964 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.915268898 CET	443	49779	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.917033911 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.917095900 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.917181969 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.917298079 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:41.917327881 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:41.937051058 CET	49780	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:48:42.018881083 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:42.019047022 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:42.019112110 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:42.019153118 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:42.019153118 CET	49776	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:42.019176006 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:42.019198895 CET	443	49776	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:42.020775080 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:42.020822048 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:42.020893097 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:42.021001101 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:42.021013975 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.485570908 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.486151934 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.486177921 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.486624002 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.486629009 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.675017118 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.675597906 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.675647020 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.676105022 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.676116943 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.685633898 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.685993910 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.686007023 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.686340094 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.686343908 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.702482939 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.702867985 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.702925920 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.703171968 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.703191042 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.882558107 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.882958889 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.882996082 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.883352995 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.883362055 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.956866026 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.956916094 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.956969976 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.957156897 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.957176924 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.957190990 CET	49781	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.957197905 CET	443	49781	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.960098982 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.960166931 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:43.960278034 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.960422039 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:43.960453033 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.118372917 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.118525028 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.118618965 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.118695021 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.118741989 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.118769884 CET	49782	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.118786097 CET	443	49782	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.121834040 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.121870995 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.121942043 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.122092009 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.122109890 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.130871058 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.130944967 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.131004095 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.131079912 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.131097078 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.131138086 CET	49783	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.131145000 CET	443	49783	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.132894039 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.132936001 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.133008957 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.133126020 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.133142948 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.146553993 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.146622896 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.146684885 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.146780014 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.146780014 CET	49784	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.146825075 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.146852016 CET	443	49784	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.148690939 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.148725033 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.148792028 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.148910046 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.148926973 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.329492092 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.329560995 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.329626083 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.329816103 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.329834938 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.329848051 CET	49785	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.329854965 CET	443	49785	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.332626104 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.332648039 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:44.332729101 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.332926035 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:44.332935095 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:45.754371881 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:45.755076885 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:45.755141973 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:45.755678892 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:45.755692959 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:45.848457098 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:45.848995924 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:45.849042892 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:45.849298000 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:45.849306107 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.001872063 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.003177881 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.003240108 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.003637075 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.003652096 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.003807068 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.006731987 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.006747961 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.007106066 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.007112026 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.183377981 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.183804989 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.183845997 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.184150934 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.184165001 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.230199099 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.230269909 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.230549097 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.233398914 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.233406067 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.233406067 CET	49786	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.233433008 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.233443975 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.233449936 CET	443	49786	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.233537912 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.233666897 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.233676910 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.283031940 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.283083916 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.283237934 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.283265114 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.283283949 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.283296108 CET	49787	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.283303022 CET	443	49787	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.285247087 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.285296917 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.285376072 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.285505056 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.285531998 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.725410938 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.725574970 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.725847006 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.725894928 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.725914955 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.725930929 CET	49789	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.725938082 CET	443	49789	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.729254961 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.729298115 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.729377985 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.729553938 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.729568005 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.741338968 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.741431952 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.741570950 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.741606951 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.741606951 CET	49788	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.741626978 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.741640091 CET	443	49788	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.744493008 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.744559050 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.744658947 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.744852066 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.744885921 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.758718967 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.758791924 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.758889914 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.759207010 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.759217024 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.759228945 CET	49790	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.759234905 CET	443	49790	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.761780024 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.761795044 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:46.762012005 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.762240887 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:46.762254000 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.179573059 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.180157900 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.180237055 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.180701971 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.180716991 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.187114000 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.187555075 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.187585115 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.188041925 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.188049078 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.526571989 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.527163982 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.527180910 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.527781010 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.527786970 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.550683022 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.551040888 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.551074028 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.551445961 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.551459074 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.553555965 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.553880930 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.553894997 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.554441929 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.554447889 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.625904083 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.625977993 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.626044035 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.626200914 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.626240969 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.626266956 CET	49792	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.626281977 CET	443	49792	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.629364014 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.629446983 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.629547119 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.629686117 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.629717112 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.643493891 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.643558025 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.643605947 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.643722057 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.643742085 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.643754959 CET	49791	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.643762112 CET	443	49791	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.646265984 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.646292925 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.646358967 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.646528006 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.646543980 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.969528913 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.969675064 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.969815969 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.969851971 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.969870090 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.969880104 CET	49793	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.969886065 CET	443	49793	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.973196983 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.973268986 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.973370075 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.973562002 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.973586082 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.995740891 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.995883942 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.996077061 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.996182919 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.996182919 CET	49794	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.996227026 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.996258020 CET	443	49794	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.998698950 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.998735905 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:48.998812914 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.998943090 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:48.998951912 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:49.011646986 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:49.011802912 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:49.011871099 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:49.011889935 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:49.011895895 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:49.011914015 CET	49795	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:49.011923075 CET	443	49795	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:49.014117956 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:49.014206886 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:49.014287949 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:49.014409065 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:49.014431953 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.345447063 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.346055031 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.346136093 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.346519947 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.346534014 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.452111959 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.452671051 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.452687025 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.453080893 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.453088045 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.762275934 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.762953997 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.763006926 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.763432980 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.763449907 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.781074047 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.781240940 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.781313896 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.781439066 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.781455994 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.781469107 CET	49796	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.781476021 CET	443	49796	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.784713030 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.784795046 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.784908056 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.785109997 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.785141945 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.795761108 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.796171904 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.796215057 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.796600103 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.796617985 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.851188898 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.851738930 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.851758003 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.852245092 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.852248907 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.896791935 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.896853924 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.896931887 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.897156000 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.897171021 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.897181988 CET	49797	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.897186995 CET	443	49797	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.899804115 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.899856091 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:50.899955988 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.900093079 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:50.900124073 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.205969095 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.206114054 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.206188917 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.206326008 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.206368923 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.206414938 CET	49798	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.206432104 CET	443	49798	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.209224939 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.209322929 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.209492922 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.209660053 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.209692955 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.239016056 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.239161015 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.239228964 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.239283085 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.239283085 CET	49800	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.239331007 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.239356995 CET	443	49800	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.241081953 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.241117001 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.241266966 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.241409063 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.241425991 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.305613041 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.305763960 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.305816889 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.305843115 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.305867910 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.305880070 CET	49799	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.305886984 CET	443	49799	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.307507038 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.307545900 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.307691097 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.307806969 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:51.307817936 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:51.514899969 CET	443	49780	142.250.181.100	192.168.2.4
Nov 21, 2024 18:48:51.514956951 CET	443	49780	142.250.181.100	192.168.2.4
Nov 21, 2024 18:48:51.515022993 CET	49780	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:48:52.610972881 CET	49780	443	192.168.2.4	142.250.181.100
Nov 21, 2024 18:48:52.611037970 CET	443	49780	142.250.181.100	192.168.2.4
Nov 21, 2024 18:48:52.639509916 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:52.640326977 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:52.640402079 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:52.640712023 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:52.640724897 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:52.682204008 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:52.682677984 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:52.682717085 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:52.682938099 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:52.682950974 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.063632011 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.064271927 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.064331055 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.064450979 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.064466000 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.089104891 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.089544058 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.089566946 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.089773893 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.089778900 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.091192007 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.091363907 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.091551065 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.091552019 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.091552019 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.093983889 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.094074011 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.094166040 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.094321966 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.094341993 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.098570108 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.098838091 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.098858118 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.099158049 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.099169016 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.125557899 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.125607014 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.125660896 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.125857115 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.125857115 CET	49802	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.125880003 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.125893116 CET	443	49802	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.127630949 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.127654076 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.127722979 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.127859116 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.127871037 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.406162024 CET	49801	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.406224012 CET	443	49801	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.517569065 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.517734051 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.517817974 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.517868042 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.517891884 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.517916918 CET	49803	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.517930984 CET	443	49803	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.520153046 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.520200968 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.520292997 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.520431995 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.520454884 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.559912920 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.559967995 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.560091019 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.560242891 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.560250998 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.560260057 CET	49805	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.560264111 CET	443	49805	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.562197924 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.562284946 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.562381983 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.562504053 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.562522888 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.563303947 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.563498974 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.563580990 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.563580990 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.563580990 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.565216064 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.565258980 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.565341949 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.565454006 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.565469027 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:53.874785900 CET	49804	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:53.874854088 CET	443	49804	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:54.915165901 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:54.915673018 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:54.915693998 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:54.916201115 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:54.916204929 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:54.946707010 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:54.947148085 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:54.947221041 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:54.947570086 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:54.947582960 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.244313002 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.244868040 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.244931936 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.245450974 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.245464087 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.347213984 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.347601891 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.347661972 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.348042011 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.348058939 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.355401993 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.355658054 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.355695963 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.355973005 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.355987072 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.362394094 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.362464905 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.362514019 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.362601995 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.362617016 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.362624884 CET	49807	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.362629890 CET	443	49807	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.365036011 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.365103006 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.365194082 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.365309954 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.365328074 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.408045053 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.408201933 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.408267975 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.408324957 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.408324957 CET	49806	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.408363104 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.408406973 CET	443	49806	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.410327911 CET	49812	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.410350084 CET	443	49812	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.410414934 CET	49812	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.410550117 CET	49812	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.410562038 CET	443	49812	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.678431034 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.678580046 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.678666115 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.678739071 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.678739071 CET	49808	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.678782940 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.678812027 CET	443	49808	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.680439949 CET	49813	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.680500031 CET	443	49813	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.680589914 CET	49813	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.680706024 CET	49813	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.680723906 CET	443	49813	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.793765068 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.793843985 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.793916941 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.794004917 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.794059038 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.794092894 CET	49809	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.794109106 CET	443	49809	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.796068907 CET	49814	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.796096087 CET	443	49814	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.796170950 CET	49814	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.796293020 CET	49814	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.796300888 CET	443	49814	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.803299904 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.803461075 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.803527117 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.803595066 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.803595066 CET	49810	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.803627014 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.803667068 CET	443	49810	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.805895090 CET	49815	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.805938005 CET	443	49815	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:55.806006908 CET	49815	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.806128025 CET	49815	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:55.806138992 CET	443	49815	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:57.087038040 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:57.087554932 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:57.087620974 CET	443	49811	13.107.246.63	192.168.2.4
Nov 21, 2024 18:48:57.088203907 CET	49811	443	192.168.2.4	13.107.246.63
Nov 21, 2024 18:48:57.088219881 CET	443	49811	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 18:47:36.485410929 CET	53	64086	1.1.1.1	192.168.2.4
Nov 21, 2024 18:47:36.558217049 CET	53	57122	1.1.1.1	192.168.2.4
Nov 21, 2024 18:47:38.092617035 CET	57215	53	192.168.2.4	1.1.1.1
Nov 21, 2024 18:47:38.092818975 CET	62329	53	192.168.2.4	1.1.1.1
Nov 21, 2024 18:47:39.115530014 CET	49319	53	192.168.2.4	1.1.1.1
Nov 21, 2024 18:47:39.115976095 CET	59373	53	192.168.2.4	1.1.1.1
Nov 21, 2024 18:47:39.468435049 CET	53	54650	1.1.1.1	192.168.2.4
Nov 21, 2024 18:47:39.760559082 CET	53	62329	1.1.1.1	192.168.2.4
Nov 21, 2024 18:47:39.760710955 CET	53	57215	1.1.1.1	192.168.2.4
Nov 21, 2024 18:47:39.761584997 CET	53	49319	1.1.1.1	192.168.2.4
Nov 21, 2024 18:47:39.762388945 CET	53	59373	1.1.1.1	192.168.2.4
Nov 21, 2024 18:47:39.985884905 CET	53501	53	192.168.2.4	1.1.1.1
Nov 21, 2024 18:47:39.986076117 CET	55185	53	192.168.2.4	1.1.1.1
Nov 21, 2024 18:47:40.123423100 CET	53	55185	1.1.1.1	192.168.2.4
Nov 21, 2024 18:47:40.123476028 CET	53	53501	1.1.1.1	192.168.2.4
Nov 21, 2024 18:47:41.186018944 CET	51776	53	192.168.2.4	1.1.1.1
Nov 21, 2024 18:47:41.186069012 CET	49810	53	192.168.2.4	1.1.1.1
Nov 21, 2024 18:47:41.322982073 CET	53	51776	1.1.1.1	192.168.2.4
Nov 21, 2024 18:47:41.327230930 CET	53	49810	1.1.1.1	192.168.2.4
Nov 21, 2024 18:47:49.148926973 CET	138	138	192.168.2.4	192.168.2.255
Nov 21, 2024 18:47:57.875144005 CET	53	58591	1.1.1.1	192.168.2.4
Nov 21, 2024 18:48:18.966636896 CET	53	49748	1.1.1.1	192.168.2.4
Nov 21, 2024 18:48:36.048506975 CET	53	51303	1.1.1.1	192.168.2.4
Nov 21, 2024 18:48:44.062138081 CET	53	54481	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 21, 2024 18:47:39.761816978 CET	192.168.2.4	1.1.1.1	c205	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 18:47:38.092617035 CET	192.168.2.4	1.1.1.1	0xed14	Standard query (0)	bc1qlpk73pgj3dz02nq8d9kpdxk.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 18:47:38.092818975 CET	192.168.2.4	1.1.1.1	0xdd79	Standard query (0)	bc1qlpk73pgj3dz02nq8d9kpdxk.org	65	IN (0x0001)	false
Nov 21, 2024 18:47:39.115530014 CET	192.168.2.4	1.1.1.1	0x977a	Standard query (0)	bc1qlpk73pgj3dz02nq8d9kpdxk.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 18:47:39.115976095 CET	192.168.2.4	1.1.1.1	0xf6f7	Standard query (0)	bc1qlpk73pgj3dz02nq8d9kpdxk.org	65	IN (0x0001)	false
Nov 21, 2024 18:47:39.985884905 CET	192.168.2.4	1.1.1.1	0x3935	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 18:47:39.986076117 CET	192.168.2.4	1.1.1.1	0xd5cf	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 18:47:41.186018944 CET	192.168.2.4	1.1.1.1	0xb2c9	Standard query (0)	bc1qlpk73pgj3dz02nq8d9kpdxk.org	A (IP address)	IN (0x0001)	false
Nov 21, 2024 18:47:41.186069012 CET	192.168.2.4	1.1.1.1	0x207b	Standard query (0)	bc1qlpk73pgj3dz02nq8d9kpdxk.org	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 18:47:39.760710955 CET	1.1.1.1	192.168.2.4	0xed14	No error (0)	bc1qlpk73pgj3dz02nq8d9kpdxk.org	154.216.17.193	A (IP address)	IN (0x0001)	false
Nov 21, 2024 18:47:39.761584997 CET	1.1.1.1	192.168.2.4	0x977a	No error (0)	bc1qlpk73pgj3dz02nq8d9kpdxk.org	154.216.17.193	A (IP address)	IN (0x0001)	false
Nov 21, 2024 18:47:40.123423100 CET	1.1.1.1	192.168.2.4	0xd5cf	No error (0)	www.google.com		65	IN (0x0001)	false
Nov 21, 2024 18:47:40.123476028 CET	1.1.1.1	192.168.2.4	0x3935	No error (0)	www.google.com	142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 21, 2024 18:47:41.322982073 CET	1.1.1.1	192.168.2.4	0xb2c9	No error (0)	bc1qlpk73pgj3dz02nq8d9kpdxk.org	154.216.17.193	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bc1qlpk73pgj3dz02nq8d9kpdxk.org

fs.microsoft.com

https:

slscr.update.microsoft.com

otelrules.azureedge.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	154.216.17.193	80	5432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 18:47:39.881519079 CET	446	OUT	GET / HTTP/1.1 Host: bc1qlpk73pgj3dz02nq8d9kpdxk.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Nov 21, 2024 18:47:41.183032990 CET	622	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 21 Nov 2024 17:47:40 GMT Server: Apache/2.4.52 (Ubuntu) Location: https://bc1qlpk73pgj3dz02nq8d9kpdxk.org/ Content-Length: 345 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 63 31 71 6c 70 6b 37 33 70 67 6a 33 64 7a 30 32 6e 71 38 64 39 6b 70 64 78 6b 2e 6f 72 67 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 62 63 31 71 6c 70 6b 37 33 70 67 6a 33 64 7a 30 32 6e 71 38 64 39 6b 70 64 78 6b 2e 6f 72 67 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://bc1qlpk73pgj3dz02nq8d9kpdxk.org/">here</a>.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at bc1qlpk73pgj3dz02nq8d9kpdxk.org Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	154.216.17.193	80	5432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 18:48:24.891030073 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	154.216.17.193	80	5432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 18:48:24.953500986 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:47:42 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 17:47:43 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF57) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=169023 Date: Thu, 21 Nov 2024 17:47:43 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	154.216.17.193	443	5432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:47:42 UTC	674	OUT	GET / HTTP/1.1 Host: bc1qlpk73pgj3dz02nq8d9kpdxk.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 17:47:43 UTC	293	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:47:43 GMT Server: Apache/2.4.52 (Ubuntu) Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET, OPTIONS Access-Control-Allow-Headers: Content-Type Content-Length: 21 Connection: close Content-Type: text/html; charset=UTF-8
2024-11-21 17:47:43 UTC	21	IN	Data Raw: 53 69 74 65 20 69 73 20 63 6f 6d 69 6e 67 20 73 6f 6f 6e 21 21 Data Ascii: Site is coming soon!!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:47:44 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 17:47:45 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=169078 Date: Thu, 21 Nov 2024 17:47:44 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-21 17:47:45 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	154.216.17.193	443	5432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:47:45 UTC	618	OUT	GET /favicon.ico HTTP/1.1 Host: bc1qlpk73pgj3dz02nq8d9kpdxk.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://bc1qlpk73pgj3dz02nq8d9kpdxk.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 17:47:45 UTC	180	IN	HTTP/1.1 404 Not Found Date: Thu, 21 Nov 2024 17:47:45 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 294 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-21 17:47:45 UTC	294	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 62 63 31 71 6c 70 6b 37 33 70 67 6a 33 64 7a 30 32 6e 71 38 64 39 6b 70 64 78 6b Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.52 (Ubuntu) Server at bc1qlpk73pgj3dz02nq8d9kpdxk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:47:50 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BgLLrZzD5p4gxbt&MD=ED+ARY9o HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 17:47:51 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 885a4a1e-24fb-4e59-b63b-3e19877e59c5 MS-RequestId: 107bbf4a-0fca-4591-971b-dc1dd0424797 MS-CV: TGFYYY+ok0atSuYS.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 17:47:49 GMT Connection: close Content-Length: 24490
2024-11-21 17:47:51 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-21 17:47:51 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:29 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:29 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:29 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174829Z-178bfbc474btrnf9hC1NYCb80g000000020000000000988x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:29 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-21 17:48:29 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-21 17:48:30 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-21 17:48:30 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-21 17:48:30 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-21 17:48:30 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-21 17:48:30 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-21 17:48:30 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-21 17:48:30 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-21 17:48:30 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49753	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:30 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BgLLrZzD5p4gxbt&MD=ED+ARY9o HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 17:48:31 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: b9ab3e8a-1627-4b5b-ae80-e3c582a27976 MS-RequestId: 19d9ad0e-3615-482d-b309-9cd546ba97e8 MS-CV: Koq/Y3pC5kOwCjjY.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 17:48:30 GMT Connection: close Content-Length: 30005
2024-11-21 17:48:31 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-21 17:48:31 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:32 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:32 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05856cf7-f01e-0020-4060-3b956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174832Z-178bfbc474bvjk8shC1NYC83ns00000001kg00000000rue5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:32 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:32 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:32 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:32 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f909c6c7-c01e-0049-518c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174832Z-r1d97b99577kk29chC1TEBemmg0000000amg00000000r3rg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:32 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:32 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:32 UTC	492	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:32 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: e8aec935-001e-0046-54a1-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174832Z-178bfbc474bv587zhC1NYCny5w00000001sg0000000030sk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:32 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:32 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:32 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:32 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8ba33068-a01e-0070-5caa-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174832Z-r1d97b99577ndm4rhC1TEBf0ps0000000atg00000000afkz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:32 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:32 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:32 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:32 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aa7a34d-201e-0096-3676-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174832Z-1777c6cb754b7tdghC1TEBwwa40000000bfg00000000newp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:32 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:34 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:34 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174834Z-178bfbc474bwh9gmhC1NYCy3rs00000001t000000000xf1a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:34 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:34 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 02a2c6fa-b01e-0001-107b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174834Z-178bfbc474bnwsh4hC1NYC2ubs00000001t000000000vkfs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:34 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:34 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:34 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 17c3c293-501e-00a3-6567-3bc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174834Z-178bfbc474bpnd5vhC1NYC4vr400000001ug000000009d0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:34 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:34 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bfe6cc7a-201e-006e-7e8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174834Z-1777c6cb754xlpjshC1TEBv8cc0000000bg000000000mq6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:34 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:35 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:34 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174834Z-1777c6cb7549x5qchC1TEBggbg0000000bd000000000ncqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:35 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:36 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:36 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174836Z-178bfbc474bmqmgjhC1NYCy16c00000001ug00000000nsf7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:37 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:36 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:37 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 2260837b-601e-0084-5dae-3b6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174837Z-r1d97b995777mdbwhC1TEBezag0000000ang00000000ea31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:37 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:36 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:37 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 35b36372-301e-005d-408e-3be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174837Z-1777c6cb7549j9hhhC1TEBzmcc0000000b9g00000000gtm7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:37 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:36 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:37 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 239436ba-d01e-0028-7bd5-3b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174837Z-r1d97b99577n5jhbhC1TEB74vn0000000ang00000000bkse x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:37 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:36 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:37 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:37 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174837Z-178bfbc474bpnd5vhC1NYC4vr400000001vg000000006mx4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:37 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:38 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:39 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174839Z-178bfbc474bw8bwphC1NYC38b400000001rg0000000018yq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:39 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:39 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:39 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 835fb09e-e01e-0003-07ce-3b0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174839Z-r1d97b995774n5h6hC1TEBvf840000000ak000000000n9w3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:39 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:39 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:39 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 3c827ba2-d01e-0014-367c-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174839Z-178bfbc474bwh9gmhC1NYCy3rs00000001sg00000000z8hy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:39 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:39 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174839Z-r1d97b99577jlrkbhC1TEBq8d00000000ang000000004hf2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:39 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:39 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:39 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174839Z-178bfbc474bw8bwphC1NYC38b400000001qg000000005gwr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:39 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:41 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:41 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 8b710333-301e-0020-767a-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174841Z-178bfbc474b9fdhphC1NYCac0n00000001pg00000000shvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:41 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:41 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:41 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174841Z-178bfbc474bq2pr7hC1NYCkfgg00000001z000000000b6r7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:41 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:41 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:41 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 798eb064-701e-0021-422e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174841Z-r1d97b99577brct2hC1TEBambg00000004fg000000001q7p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:41 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 20c6f849-701e-005c-2e61-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174841Z-178bfbc474btrnf9hC1NYCb80g00000001vg00000000xpvf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:41 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 367ebca4-601e-0070-6762-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174841Z-178bfbc474btrnf9hC1NYCb80g0000000210000000003qvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:43 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:43 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 85a2cd00-101e-0017-20ca-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174843Z-r1d97b99577brct2hC1TEBambg00000004d0000000007e5p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:43 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:43 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:43 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174843Z-178bfbc474bh5zbqhC1NYCkdug00000001s000000000curk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:44 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:43 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:43 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174843Z-178bfbc474bvjk8shC1NYC83ns00000001rg0000000025m4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:44 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:43 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:43 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 29297304-901e-0083-6776-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174843Z-1777c6cb754lv4cqhC1TEB13us0000000bgg000000000pra x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:44 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:43 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:44 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:44 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 3029707a-401e-0047-3163-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174844Z-178bfbc474bscnbchC1NYCe7eg000000021g00000000241m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:44 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:45 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:46 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 361c5568-301e-005d-3fb2-3be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174846Z-r1d97b995774zjnrhC1TEBv1ww0000000ahg00000000m71b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:46 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:45 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:46 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174846Z-178bfbc474btrnf9hC1NYCb80g000000020g000000005r36 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:46 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:46 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174846Z-1777c6cb754rz2pghC1TEBghen0000000b6g00000000v3u9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:46 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:46 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:46 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174846Z-r1d97b99577l6wbzhC1TEB3fwn0000000av0000000006fh3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:46 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:46 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:46 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:46 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 95b9e869-801e-008c-3081-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174846Z-1777c6cb754xlpjshC1TEBv8cc0000000bng000000002v9w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:46 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:48 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:48 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174848Z-1777c6cb754ww792hC1TEBzqu40000000b4g00000000vgwn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:48 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:48 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:48 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174848Z-1777c6cb754lvj6mhC1TEBke940000000bkg00000000305p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:48 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:48 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:48 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174848Z-178bfbc474bbcwv4hC1NYCypys00000001r000000000770v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:48 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:48 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:48 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174848Z-1777c6cb754lvj6mhC1TEBke940000000bf000000000d36z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:48 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:48 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:48 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174848Z-1777c6cb754rz2pghC1TEBghen0000000bd00000000035qx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:49 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:50 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:50 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:50 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174850Z-178bfbc474bwlrhlhC1NYCy3kg00000001q0000000010e12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 17:48:50 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:50 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:50 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: c2180679-501e-008f-16bc-3b9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174850Z-178bfbc474bfw4gbhC1NYCunf400000001sg00000000q4dq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:50 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:50 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:51 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 76e95f1f-101e-0034-7059-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174851Z-178bfbc474b9fdhphC1NYCac0n00000001r000000000hnhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:51 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:50 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:51 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5b8d3f05-a01e-006f-2465-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174851Z-178bfbc474bv587zhC1NYCny5w00000001m000000000tn7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:51 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:50 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:51 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 71c2edc3-001e-0082-0fa6-3b5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174851Z-r1d97b995774n5h6hC1TEBvf840000000aq00000000081y9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:51 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:52 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:52 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: c4abe473-d01e-008e-4d67-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174852Z-178bfbc474bxkclvhC1NYC69g400000001qg00000000nh5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:53 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:52 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:52 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174852Z-1777c6cb754gvvgfhC1TEBz4rg0000000beg00000000gv49 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:53 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:53 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:53 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174853Z-178bfbc474bvjk8shC1NYC83ns00000001n000000000hg7a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:53 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:53 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:53 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c2dc1527-b01e-0053-5db2-3bcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174853Z-1777c6cb754n67brhC1TEBcp9c0000000bgg00000000bmry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:53 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:53 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:53 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:53 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174853Z-178bfbc474b9fdhphC1NYCac0n00000001mg000000010f5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:53 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:54 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:55 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174855Z-1777c6cb754vxwc9hC1TEBykgw0000000be0000000009phm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:55 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:54 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:55 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 40c83c0a-001e-00ad-1e79-3b554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174855Z-1777c6cb754mqztshC1TEB4mkc0000000bk0000000002kdx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:55 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:55 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:55 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 138215a1-101e-0017-6465-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174855Z-178bfbc474bv587zhC1NYCny5w00000001kg00000000xg68 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:55 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:55 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:55 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 906eedcd-201e-0071-4861-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174855Z-178bfbc474b9fdhphC1NYCac0n00000001m0000000011vkf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:55 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49810	13.107.246.63	443	5432	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:55 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5304f1e1-001e-005a-6c6b-3bc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174855Z-178bfbc474bnwsh4hC1NYC2ubs00000001yg00000000476d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:55 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:57 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:57 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:57 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3585b350-301e-005d-097c-3be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174857Z-r1d97b99577tssmjhC1TEB8kan0000000ag000000000m20e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:57 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:57 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:57 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:57 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c2cadd2f-601e-0001-2bab-3bfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174857Z-r1d97b99577n5jhbhC1TEB74vn0000000ak000000000mpxk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 17:48:57 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:57 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:57 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:57 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174857Z-178bfbc474bwh9gmhC1NYCy3rs00000001u000000000shxw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:57 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:57 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:58 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:57 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 137cb315-101e-0017-3264-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174857Z-178bfbc474bv587zhC1NYCny5w00000001k000000000yn1y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:58 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 17:48:57 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 17:48:58 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 17:48:58 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T174858Z-1777c6cb754b7tdghC1TEBwwa40000000bfg00000000nh23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 17:48:58 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 2148, Parent PID: 3524

General

Target ID:	0
Start time:	12:47:29
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5432, Parent PID: 2148

General

Target ID:	2
Start time:	12:47:34
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 --field-trial-handle=2264,i,11239854592833149862,5177491342514730736,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6412, Parent PID: 3524

General

Target ID:	3
Start time:	12:47:37
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bc1qlpk73pgj3dz02nq8d9kpdxk.org"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://bc1qlpk73pgj3dz02nq8d9kpdxk.org

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 41

Chrome Cache Entry: 42

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 2148, Parent PID: 3524

General

Chronological Activities

Analysis Process: chrome.exePID: 5432, Parent PID: 2148

General

Chronological Activities

Analysis Process: chrome.exePID: 6412, Parent PID: 3524

General

Chronological Activities

Disassembly

Windows Analysis Report
http://bc1qlpk73pgj3dz02nq8d9kpdxk.org