Edit tour

Windows Analysis Report
https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au

Overview

General Information

Sample URL:	https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au
Analysis ID:	1567972
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

URL contains potential PII (phishing indication)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2308,i,14290075727724152583,10955571162648931548,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6540 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au	Avira URL Cloud: detection malicious, Label: phishing
Source: https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Multi AV Scanner detection for submitted file

Source: https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au

Virustotal: Detection: 17%

Perma Link

Source: https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au

Sample URL: PII: sbarnes@clc.org.au

Source: unknown	HTTPS traffic detected: 2.19.229.151:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.229.151:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.229.151
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET /8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html HTTP/1.1Host: s3.timeweb.cloudConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: s3.timeweb.cloudConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1W1VHL71cyCsSxv&MD=gV5aoan5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1W1VHL71cyCsSxv&MD=gV5aoan5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: s3.timeweb.cloud

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 04 Dec 2024 02:48:51 GMTContent-Type: application/xmlContent-Length: 249Connection: closex-amz-request-id: tx000003ef224081a6f87d2-00674fc313-b0b1d03-ru-1X-Robots-Tag: noindex,nofollow
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 04 Dec 2024 02:48:52 GMTContent-Type: application/xmlContent-Length: 216Connection: closex-amz-request-id: tx00000a7b9931bf1ee9353-00674fc314-b0af77c-ru-1X-Robots-Tag: noindex,nofollow

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 2.19.229.151:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.229.151:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: classification engine

Classification label: mal56.win@16/4@4/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2308,i,14290075727724152583,10955571162648931548,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2308,i,14290075727724152583,10955571162648931548,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au	100%	Avira URL Cloud	phishing
https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering
https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au	18%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	216.58.208.228	true	false		high
s3.timeweb.cloud	217.78.234.244	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html	false		high
https://s3.timeweb.cloud/favicon.ico	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
216.58.208.228	www.google.com	United States	15169	GOOGLEUS	false
217.78.234.244	s3.timeweb.cloud	Russian Federation	197349	SKYLINEWIMAXRU	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567972
Start date and time:	2024-12-04 03:47:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@16/4@4/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.17.46, 74.125.205.84, 23.32.238.201, 192.229.221.95, 172.217.17.35
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

⊘No simulations

Input	Output
URL: https://s3.timeweb.cloud Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: https://s3.timeweb.cloud

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 41

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	XML 1.0 document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	249
Entropy (8bit):	5.270793091273231
Encrypted:	false
SSDEEP:	6:TMVBd/IqZjvGg51E4gscNZBBhZy6LGRPdKWuan:TMHd1Bv1a3NZzjy6y1dia
MD5:	79414909F442997ACF4888C3BA5E460F
SHA1:	FF9AEBE17E0C8123FEF766682F40DEBF8B421A89
SHA-256:	219EF6C7ECD42A39DC338D19701FECA868462835637E135CDCA9D90D4E11A1B8
SHA-512:	65667DBE5C70CBD8216E7964BD75529B62C62C0887AD33BACD9762ADF6BBDA11725C877A14BE2840CF3D1C03846E1E417C8504D3158F01D1C53E00EE91474C32
Malicious:	false
Reputation:	low
URL:	https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html
Preview:	<?xml version="1.0" encoding="UTF-8"?><Error><Code>UserSuspended</Code><BucketName>8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd</BucketName><RequestId>tx000003ef224081a6f87d2-00674fc313-b0b1d03-ru-1</RequestId><HostId>b0b1d03-ru-1-ru</HostId></Error>

Chrome Cache Entry: 42

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	XML 1.0 document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	216
Entropy (8bit):	5.228332230819615
Encrypted:	false
SSDEEP:	6:TMVBd/IqZj7rA9sLMoihRtWoWlEDhFR3JKWuan:TMHd1B3A9X5zWlEH1Jia
MD5:	830C7D2BED63B52354D0A4A01E28812B
SHA1:	9977919FE301A55E88839E742FB429E24C38A042
SHA-256:	EC9994513F064B5F7E88B60356D2829EBDD995D9749443B18562CA149C78078B
SHA-512:	1E1E833428DAD7F68C5A45BE67336FDB3E406CA50E9F18966B845453F4DDD90C7FDFF7A898F1C72019874B3AB7451790BC072E2583A6D848A60F0476383D30B5
Malicious:	false
Reputation:	low
URL:	https://s3.timeweb.cloud/favicon.ico
Preview:	<?xml version="1.0" encoding="UTF-8"?><Error><Code>NoSuchBucket</Code><BucketName>favicon.ico</BucketName><RequestId>tx00000a7b9931bf1ee9353-00674fc314-b0af77c-ru-1</RequestId><HostId>b0af77c-ru-1-ru</HostId></Error>

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 03:48:33.560452938 CET	49675	443	192.168.2.4	173.222.162.32
Dec 4, 2024 03:48:43.169787884 CET	49675	443	192.168.2.4	173.222.162.32
Dec 4, 2024 03:48:47.764034033 CET	49737	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:48:47.764074087 CET	443	49737	216.58.208.228	192.168.2.4
Dec 4, 2024 03:48:47.764158964 CET	49737	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:48:47.764358044 CET	49737	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:48:47.764370918 CET	443	49737	216.58.208.228	192.168.2.4
Dec 4, 2024 03:48:48.500179052 CET	49738	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:48.500222921 CET	443	49738	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:48.500307083 CET	49738	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:48.501804113 CET	49738	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:48.501821995 CET	443	49738	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:49.505307913 CET	443	49737	216.58.208.228	192.168.2.4
Dec 4, 2024 03:48:49.505552053 CET	49737	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:48:49.505568027 CET	443	49737	216.58.208.228	192.168.2.4
Dec 4, 2024 03:48:49.506423950 CET	443	49737	216.58.208.228	192.168.2.4
Dec 4, 2024 03:48:49.506481886 CET	49737	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:48:49.507430077 CET	49737	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:48:49.507483959 CET	443	49737	216.58.208.228	192.168.2.4
Dec 4, 2024 03:48:49.560154915 CET	49737	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:48:49.560162067 CET	443	49737	216.58.208.228	192.168.2.4
Dec 4, 2024 03:48:49.607106924 CET	49737	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:48:49.994538069 CET	49739	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:49.994575977 CET	443	49739	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:49.994633913 CET	49739	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:49.994882107 CET	49739	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:49.994896889 CET	443	49739	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:49.995256901 CET	49740	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:49.995286942 CET	443	49740	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:49.995373011 CET	49740	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:49.995628119 CET	49740	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:49.995644093 CET	443	49740	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:49.995925903 CET	443	49738	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:49.995990038 CET	49738	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:50.000454903 CET	49738	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:50.000459909 CET	443	49738	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:50.000751019 CET	443	49738	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:50.045269966 CET	49738	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:50.091331959 CET	443	49738	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:50.552784920 CET	443	49738	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:50.552850008 CET	443	49738	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:50.553041935 CET	49738	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:50.553041935 CET	49738	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:50.553041935 CET	49738	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:50.553076029 CET	443	49738	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:50.580986977 CET	49741	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:50.581024885 CET	443	49741	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:50.581227064 CET	49741	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:50.581460953 CET	49741	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:50.581475019 CET	443	49741	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:50.855766058 CET	49738	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:50.855787992 CET	443	49738	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:51.427038908 CET	443	49740	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:51.427269936 CET	49740	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:51.427293062 CET	443	49740	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:51.428181887 CET	443	49740	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:51.428244114 CET	49740	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:51.432949066 CET	49740	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:51.433006048 CET	443	49740	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:51.433171988 CET	49740	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:51.433180094 CET	443	49740	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:51.470272064 CET	443	49739	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:51.471035004 CET	49739	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:51.471059084 CET	443	49739	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:51.471967936 CET	443	49739	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:51.472027063 CET	49739	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:51.472491980 CET	49739	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:51.472552061 CET	443	49739	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:51.486004114 CET	49740	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:51.517250061 CET	49739	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:51.517258883 CET	443	49739	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:51.563621998 CET	49739	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:51.968427896 CET	443	49740	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:51.968482971 CET	443	49740	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:51.968547106 CET	49740	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:51.970160961 CET	49740	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:51.970182896 CET	443	49740	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:52.030786991 CET	49739	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:52.071341038 CET	443	49739	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:52.117824078 CET	443	49741	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:52.117904902 CET	49741	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:52.119086981 CET	49741	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:52.119091988 CET	443	49741	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:52.119311094 CET	443	49741	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:52.120311022 CET	49741	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:52.167340040 CET	443	49741	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:52.465221882 CET	443	49739	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:52.465276003 CET	443	49739	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:52.465343952 CET	49739	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:52.466635942 CET	49739	443	192.168.2.4	217.78.234.244
Dec 4, 2024 03:48:52.466655970 CET	443	49739	217.78.234.244	192.168.2.4
Dec 4, 2024 03:48:52.689459085 CET	443	49741	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:52.689526081 CET	443	49741	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:52.689603090 CET	49741	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:52.690396070 CET	49741	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:52.690409899 CET	443	49741	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:52.690418005 CET	49741	443	192.168.2.4	2.19.229.151
Dec 4, 2024 03:48:52.690423012 CET	443	49741	2.19.229.151	192.168.2.4
Dec 4, 2024 03:48:56.082494020 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:48:56.082561016 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:48:56.082628012 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:48:56.083806038 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:48:56.083825111 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:48:57.842703104 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:48:57.842782974 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:48:57.845958948 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:48:57.845969915 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:48:57.846189976 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:48:57.887554884 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:48:59.214706898 CET	443	49737	216.58.208.228	192.168.2.4
Dec 4, 2024 03:48:59.214761019 CET	443	49737	216.58.208.228	192.168.2.4
Dec 4, 2024 03:48:59.215013027 CET	49737	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:48:59.479769945 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:48:59.523336887 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:48:59.827780962 CET	49737	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:48:59.827794075 CET	443	49737	216.58.208.228	192.168.2.4
Dec 4, 2024 03:49:00.064822912 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:00.064851999 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:00.064858913 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:00.064871073 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:00.064903021 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:00.064903021 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:00.064929008 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:00.064939976 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:00.064949989 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:00.064971924 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:00.092170954 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:00.092247963 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:00.092251062 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:00.092298985 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:01.508616924 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:01.508642912 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:01.508655071 CET	49742	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:01.508661985 CET	443	49742	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:03.813788891 CET	49723	80	192.168.2.4	93.184.221.240
Dec 4, 2024 03:49:03.934478045 CET	80	49723	93.184.221.240	192.168.2.4
Dec 4, 2024 03:49:03.934645891 CET	49723	80	192.168.2.4	93.184.221.240
Dec 4, 2024 03:49:37.859563112 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:37.859601021 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:37.859674931 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:37.859987974 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:37.860004902 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:38.310426950 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:38.310465097 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:38.310632944 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:38.310966015 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:38.310981989 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:39.560281038 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:39.560364008 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:39.564681053 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:39.564694881 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:39.564943075 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:39.575285912 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:39.619333029 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:40.098378897 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.098479986 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.100111008 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.100122929 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.100352049 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.107816935 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.155333042 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.247297049 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:40.247319937 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:40.247344971 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:40.247487068 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:40.247487068 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:40.247503996 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:40.247551918 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:40.284709930 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:40.284743071 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:40.284782887 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:40.284879923 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:40.284879923 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:40.284879923 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:40.284934044 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:40.284945965 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:40.284956932 CET	49748	443	192.168.2.4	20.109.210.53
Dec 4, 2024 03:49:40.284961939 CET	443	49748	20.109.210.53	192.168.2.4
Dec 4, 2024 03:49:40.586457968 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.586482048 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.586494923 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.586546898 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.586565018 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.586755991 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.774804115 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.774827003 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.774890900 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.774907112 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.775188923 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.817248106 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.817266941 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.817336082 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.817348003 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.817486048 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.959688902 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.959713936 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.959875107 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.959875107 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.959891081 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.959942102 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.998822927 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.998837948 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.999003887 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:40.999010086 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:40.999056101 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.018980980 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.018995047 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.019145966 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.019150972 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.019197941 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.036519051 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.036554098 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.036581993 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.036587954 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.036613941 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.036626101 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.154788017 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.154810905 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.154982090 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.154994011 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.155041933 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.171582937 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.171597958 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.171792984 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.171798944 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.172056913 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.191126108 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.191143990 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.191191912 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.191198111 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.191255093 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.202433109 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.202447891 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.202517986 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.202522039 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.202696085 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.212388992 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.212402105 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.212450981 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.212456942 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.212649107 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.213901997 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.213948965 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.214031935 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.214725018 CET	49749	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.214740038 CET	443	49749	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.246690989 CET	49750	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.246717930 CET	443	49750	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.246824980 CET	49750	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.247003078 CET	49750	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.247014999 CET	443	49750	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.248605013 CET	49751	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.248631001 CET	443	49751	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.249129057 CET	49752	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.249167919 CET	49751	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.249187946 CET	443	49752	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.249241114 CET	49752	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.249267101 CET	49751	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.249279022 CET	443	49751	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.250516891 CET	49753	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.250546932 CET	443	49753	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.250605106 CET	49753	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.251034975 CET	49754	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.251055956 CET	443	49754	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.251158953 CET	49752	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.251182079 CET	443	49752	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.251194000 CET	49754	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.251246929 CET	49754	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.251255989 CET	443	49754	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:41.251323938 CET	49753	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:41.251337051 CET	443	49753	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:42.780925035 CET	443	49751	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:42.781394958 CET	49751	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:42.781419992 CET	443	49751	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:42.782021999 CET	49751	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:42.782027006 CET	443	49751	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:42.974071026 CET	443	49753	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:42.974668026 CET	49753	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:42.974699974 CET	443	49753	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:42.975127935 CET	49753	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:42.975136042 CET	443	49753	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.032504082 CET	443	49754	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.032808065 CET	49754	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.032835960 CET	443	49754	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.033138037 CET	49754	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.033143044 CET	443	49754	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.090749025 CET	443	49750	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.091041088 CET	49750	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.091084003 CET	443	49750	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.091351986 CET	49750	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.091367960 CET	443	49750	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.095565081 CET	443	49752	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.095777035 CET	49752	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.095797062 CET	443	49752	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.096051931 CET	49752	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.096056938 CET	443	49752	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.220906019 CET	443	49751	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.220931053 CET	443	49751	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.220995903 CET	49751	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.221015930 CET	443	49751	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.221064091 CET	49751	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.221256018 CET	49751	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.221261024 CET	443	49751	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.221275091 CET	49751	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.221415997 CET	443	49751	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.221443892 CET	443	49751	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.221483946 CET	49751	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.224379063 CET	49755	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.224406958 CET	443	49755	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.224469900 CET	49755	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.224597931 CET	49755	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.224610090 CET	443	49755	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.413861036 CET	443	49753	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.413883924 CET	443	49753	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.413938046 CET	49753	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.413949966 CET	443	49753	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.414123058 CET	49753	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.414135933 CET	443	49753	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.414143085 CET	49753	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.414244890 CET	443	49753	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.414269924 CET	443	49753	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.414310932 CET	49753	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.416053057 CET	49757	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.416064024 CET	443	49757	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.416121006 CET	49757	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.416234016 CET	49757	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.416248083 CET	443	49757	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.476730108 CET	443	49754	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.476775885 CET	443	49754	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.476824045 CET	49754	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.476979017 CET	49754	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.476996899 CET	443	49754	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.477010012 CET	49754	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.477016926 CET	443	49754	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.478931904 CET	49758	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.478962898 CET	443	49758	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.479032040 CET	49758	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.479178905 CET	49758	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.479192019 CET	443	49758	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.549376965 CET	443	49750	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.549397945 CET	443	49750	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.549458981 CET	49750	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.549468994 CET	443	49750	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.549582005 CET	49750	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.549742937 CET	49750	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.549747944 CET	443	49750	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.549818039 CET	49750	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.549865961 CET	443	49750	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.549891949 CET	443	49750	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.549962044 CET	49750	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.551881075 CET	49759	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.551891088 CET	443	49752	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.551903009 CET	443	49759	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.551942110 CET	443	49752	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.551981926 CET	49759	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.552007914 CET	49752	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.552071095 CET	49752	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.552093029 CET	443	49752	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.552118063 CET	49752	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.552126884 CET	443	49752	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.552531958 CET	49759	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.552547932 CET	443	49759	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.554994106 CET	49760	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.555023909 CET	443	49760	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:43.555082083 CET	49760	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.555298090 CET	49760	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:43.555316925 CET	443	49760	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.002976894 CET	443	49755	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.003510952 CET	49755	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.003530979 CET	443	49755	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.003974915 CET	49755	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.003979921 CET	443	49755	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.194360971 CET	443	49757	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.194729090 CET	49757	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.194737911 CET	443	49757	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.195105076 CET	49757	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.195110083 CET	443	49757	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.272507906 CET	443	49759	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.272922039 CET	49759	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.272933960 CET	443	49759	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.273284912 CET	49759	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.273289919 CET	443	49759	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.273432970 CET	443	49760	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.273674011 CET	49760	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.273696899 CET	443	49760	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.273957014 CET	49760	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.273962021 CET	443	49760	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.321805954 CET	443	49758	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.322112083 CET	49758	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.322133064 CET	443	49758	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.322458029 CET	49758	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.322462082 CET	443	49758	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.449244022 CET	443	49755	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.449316025 CET	443	49755	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.449373007 CET	49755	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.449522972 CET	49755	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.449542999 CET	443	49755	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.449552059 CET	49755	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.449558973 CET	443	49755	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.451886892 CET	49761	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.451920986 CET	443	49761	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.451998949 CET	49761	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.452114105 CET	49761	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.452126026 CET	443	49761	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.638410091 CET	443	49757	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.638463974 CET	443	49757	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.638509989 CET	49757	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.638664961 CET	49757	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.638686895 CET	443	49757	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.638698101 CET	49757	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.638703108 CET	443	49757	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.640928030 CET	49762	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.640954971 CET	443	49762	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.641027927 CET	49762	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.641259909 CET	49762	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.641271114 CET	443	49762	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.708794117 CET	443	49759	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.708837032 CET	443	49759	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.708888054 CET	49759	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.709018946 CET	49759	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.709029913 CET	443	49759	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.709042072 CET	49759	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.709045887 CET	443	49759	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.709433079 CET	443	49760	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.709479094 CET	443	49760	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.709522009 CET	49760	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.709697008 CET	49760	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.709707022 CET	443	49760	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.709714890 CET	49760	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.709721088 CET	443	49760	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.711793900 CET	49763	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.711827040 CET	443	49763	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.711889029 CET	49763	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.711998940 CET	49763	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.712013006 CET	443	49763	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.712028027 CET	49764	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.712054968 CET	443	49764	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.712110996 CET	49764	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.712238073 CET	49764	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.712248087 CET	443	49764	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.776122093 CET	443	49758	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.776168108 CET	443	49758	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.776261091 CET	49758	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.776343107 CET	49758	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.776343107 CET	49758	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.776356936 CET	443	49758	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.776364088 CET	443	49758	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.778233051 CET	49765	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.778268099 CET	443	49765	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:45.778331041 CET	49765	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.778434038 CET	49765	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:45.778451920 CET	443	49765	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.231990099 CET	443	49761	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.232469082 CET	49761	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.232485056 CET	443	49761	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.232944012 CET	49761	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.232949018 CET	443	49761	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.425255060 CET	443	49763	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.425718069 CET	49763	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.425729990 CET	443	49763	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.426171064 CET	49763	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.426176071 CET	443	49763	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.485495090 CET	443	49762	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.485810995 CET	49762	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.485824108 CET	443	49762	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.486174107 CET	49762	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.486177921 CET	443	49762	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.555012941 CET	443	49764	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.555357933 CET	49764	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.555372000 CET	443	49764	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.555716038 CET	49764	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.555720091 CET	443	49764	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.621572971 CET	443	49765	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.621999025 CET	49765	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.622035980 CET	443	49765	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.622379065 CET	49765	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.622385979 CET	443	49765	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.676280022 CET	443	49761	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.676345110 CET	443	49761	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.676398993 CET	49761	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.676604986 CET	49761	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.676620007 CET	443	49761	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.676634073 CET	49761	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.676640034 CET	443	49761	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.679337978 CET	49766	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.679363012 CET	443	49766	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.679454088 CET	49766	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.679606915 CET	49766	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.679619074 CET	443	49766	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.685400009 CET	49767	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:49:47.685441971 CET	443	49767	216.58.208.228	192.168.2.4
Dec 4, 2024 03:49:47.685502052 CET	49767	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:49:47.685771942 CET	49767	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:49:47.685790062 CET	443	49767	216.58.208.228	192.168.2.4
Dec 4, 2024 03:49:47.861031055 CET	443	49763	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.861093044 CET	443	49763	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.861140966 CET	49763	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.861224890 CET	49763	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.861232042 CET	443	49763	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.861239910 CET	49763	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.861243963 CET	443	49763	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.862938881 CET	49768	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.862972021 CET	443	49768	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.863039017 CET	49768	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.863138914 CET	49768	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.863153934 CET	443	49768	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.938425064 CET	443	49762	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.938477039 CET	443	49762	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.938524961 CET	49762	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.938647985 CET	49762	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.938661098 CET	443	49762	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.938669920 CET	49762	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.938674927 CET	443	49762	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.940476894 CET	49769	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.940489054 CET	443	49769	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:47.940547943 CET	49769	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.940670013 CET	49769	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:47.940682888 CET	443	49769	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:48.011077881 CET	443	49764	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:48.011121988 CET	443	49764	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:48.011167049 CET	49764	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:48.011310101 CET	49764	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:48.011327028 CET	443	49764	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:48.011338949 CET	49764	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:48.011343956 CET	443	49764	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:48.013664007 CET	49770	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:48.013694048 CET	443	49770	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:48.013770103 CET	49770	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:48.013916016 CET	49770	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:48.013931036 CET	443	49770	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:48.076824903 CET	443	49765	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:48.076869965 CET	443	49765	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:48.076920986 CET	49765	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:48.077004910 CET	49765	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:48.077018976 CET	443	49765	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:48.077034950 CET	49765	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:48.077039003 CET	443	49765	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:48.078741074 CET	49771	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:48.078763962 CET	443	49771	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:48.078830957 CET	49771	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:48.078948975 CET	49771	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:48.078962088 CET	443	49771	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.376787901 CET	443	49767	216.58.208.228	192.168.2.4
Dec 4, 2024 03:49:49.377067089 CET	49767	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:49:49.377091885 CET	443	49767	216.58.208.228	192.168.2.4
Dec 4, 2024 03:49:49.377382994 CET	443	49767	216.58.208.228	192.168.2.4
Dec 4, 2024 03:49:49.377657890 CET	49767	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:49:49.377716064 CET	443	49767	216.58.208.228	192.168.2.4
Dec 4, 2024 03:49:49.395473003 CET	443	49766	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.395944118 CET	49766	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.395958900 CET	443	49766	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.396373034 CET	49766	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.396378040 CET	443	49766	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.419137955 CET	49767	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:49:49.653676987 CET	443	49769	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.654032946 CET	49769	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.654051065 CET	443	49769	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.654401064 CET	49769	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.654407024 CET	443	49769	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.706321001 CET	443	49768	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.709727049 CET	49768	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.709779024 CET	443	49768	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.710133076 CET	49768	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.710139036 CET	443	49768	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.801873922 CET	443	49770	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.802176952 CET	49770	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.802194118 CET	443	49770	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.802544117 CET	49770	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.802548885 CET	443	49770	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.830333948 CET	443	49766	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.830406904 CET	443	49766	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.830568075 CET	49766	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.830598116 CET	49766	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.830611944 CET	443	49766	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.830621004 CET	49766	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.830626965 CET	443	49766	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.833003044 CET	49772	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.833035946 CET	443	49772	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.833112955 CET	49772	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.833286047 CET	49772	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.833298922 CET	443	49772	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.857934952 CET	443	49771	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.858434916 CET	49771	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.858455896 CET	443	49771	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:49.859052896 CET	49771	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:49.859057903 CET	443	49771	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.088598967 CET	443	49769	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.088645935 CET	443	49769	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.088841915 CET	49769	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.088867903 CET	49769	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.088880062 CET	443	49769	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.088891029 CET	49769	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.088896990 CET	443	49769	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.091759920 CET	49773	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.091801882 CET	443	49773	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.091881037 CET	49773	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.092031956 CET	49773	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.092051983 CET	443	49773	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.160012007 CET	443	49768	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.160057068 CET	443	49768	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.160171986 CET	49768	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.160197020 CET	49768	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.160211086 CET	443	49768	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.160218954 CET	49768	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.160224915 CET	443	49768	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.162319899 CET	49774	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.162348986 CET	443	49774	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.162425995 CET	49774	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.162549019 CET	49774	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.162561893 CET	443	49774	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.247652054 CET	443	49770	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.247694969 CET	443	49770	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.247834921 CET	49770	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.247864008 CET	49770	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.247869015 CET	443	49770	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.247878075 CET	49770	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.247880936 CET	443	49770	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.249639034 CET	49775	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.249651909 CET	443	49775	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.249715090 CET	49775	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.249814034 CET	49775	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.249825954 CET	443	49775	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.302972078 CET	443	49771	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.303013086 CET	443	49771	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.303126097 CET	49771	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.303148031 CET	49771	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.303153992 CET	443	49771	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.303162098 CET	49771	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.303165913 CET	443	49771	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.304936886 CET	49776	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.304951906 CET	443	49776	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.305015087 CET	49776	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.305133104 CET	49776	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:50.305145025 CET	443	49776	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:50.341126919 CET	49724	80	192.168.2.4	93.184.221.240
Dec 4, 2024 03:49:50.461359978 CET	80	49724	93.184.221.240	192.168.2.4
Dec 4, 2024 03:49:50.461422920 CET	49724	80	192.168.2.4	93.184.221.240
Dec 4, 2024 03:49:51.468710899 CET	443	49772	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.469342947 CET	49772	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:51.469361067 CET	443	49772	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.469937086 CET	49772	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:51.469942093 CET	443	49772	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.871165037 CET	443	49773	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.871632099 CET	49773	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:51.871665001 CET	443	49773	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.872092962 CET	49773	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:51.872097969 CET	443	49773	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.929389000 CET	443	49772	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.929449081 CET	443	49772	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.929502964 CET	49772	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:51.929662943 CET	49772	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:51.929677963 CET	443	49772	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.929689884 CET	49772	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:51.929693937 CET	443	49772	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.932343006 CET	49777	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:51.932382107 CET	443	49777	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.932467937 CET	49777	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:51.932620049 CET	49777	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:51.932632923 CET	443	49777	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.964720011 CET	443	49775	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.965030909 CET	49775	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:51.965040922 CET	443	49775	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:51.965421915 CET	49775	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:51.965428114 CET	443	49775	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.005233049 CET	443	49774	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.005559921 CET	49774	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.005572081 CET	443	49774	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.005897045 CET	49774	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.005901098 CET	443	49774	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.084314108 CET	443	49776	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.084636927 CET	49776	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.084666014 CET	443	49776	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.084995031 CET	49776	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.085000038 CET	443	49776	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.320107937 CET	443	49773	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.320157051 CET	443	49773	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.320210934 CET	49773	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.320372105 CET	49773	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.320393085 CET	443	49773	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.320406914 CET	49773	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.320411921 CET	443	49773	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.323036909 CET	49778	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.323074102 CET	443	49778	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.323158026 CET	49778	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.323318958 CET	49778	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.323331118 CET	443	49778	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.400391102 CET	443	49775	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.400444031 CET	443	49775	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.400495052 CET	49775	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.400634050 CET	49775	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.400639057 CET	443	49775	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.400649071 CET	49775	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.400651932 CET	443	49775	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.402662992 CET	49779	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.402683020 CET	443	49779	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.402754068 CET	49779	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.402879953 CET	49779	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.402896881 CET	443	49779	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.458589077 CET	443	49774	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.458636999 CET	443	49774	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.458682060 CET	49774	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.458815098 CET	49774	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.458826065 CET	443	49774	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.458839893 CET	49774	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.458843946 CET	443	49774	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.460926056 CET	49780	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.460952997 CET	443	49780	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.461028099 CET	49780	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.461158037 CET	49780	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.461179972 CET	443	49780	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.528057098 CET	443	49776	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.528105974 CET	443	49776	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.528151989 CET	49776	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.528304100 CET	49776	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.528314114 CET	443	49776	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.528332949 CET	49776	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.528337955 CET	443	49776	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.530333996 CET	49781	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.530354977 CET	443	49781	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:52.530430079 CET	49781	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.530561924 CET	49781	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:52.530571938 CET	443	49781	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:53.711345911 CET	443	49777	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:53.711842060 CET	49777	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:53.711858988 CET	443	49777	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:53.712311983 CET	49777	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:53.712316990 CET	443	49777	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.155837059 CET	443	49777	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.155894995 CET	443	49777	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.155966997 CET	49777	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.156160116 CET	49777	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.156173944 CET	443	49777	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.156183958 CET	49777	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.156188965 CET	443	49777	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.158664942 CET	49782	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.158690929 CET	443	49782	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.158777952 CET	49782	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.158902884 CET	49782	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.158915997 CET	443	49782	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.169466972 CET	443	49778	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.174458981 CET	49778	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.174483061 CET	443	49778	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.175050020 CET	49778	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.175056934 CET	443	49778	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.183985949 CET	443	49779	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.184302092 CET	49779	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.184323072 CET	443	49779	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.184698105 CET	49779	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.184703112 CET	443	49779	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.239146948 CET	443	49780	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.239578962 CET	49780	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.239588976 CET	443	49780	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.240161896 CET	49780	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.240166903 CET	443	49780	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.310642004 CET	443	49781	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.311002970 CET	49781	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.311019897 CET	443	49781	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.311372995 CET	49781	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.311377048 CET	443	49781	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.622811079 CET	443	49778	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.622875929 CET	443	49778	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.622929096 CET	49778	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.623075008 CET	49778	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.623094082 CET	443	49778	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.623104095 CET	49778	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.623109102 CET	443	49778	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.625763893 CET	49783	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.625792980 CET	443	49783	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.625854015 CET	49783	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.626020908 CET	49783	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.626033068 CET	443	49783	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.629558086 CET	443	49779	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.629627943 CET	443	49779	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.629672050 CET	49779	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.629749060 CET	49779	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.629759073 CET	443	49779	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.629770041 CET	49779	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.629774094 CET	443	49779	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.631982088 CET	49784	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.632005930 CET	443	49784	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.632072926 CET	49784	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.632208109 CET	49784	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.632220984 CET	443	49784	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.688919067 CET	443	49780	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.688975096 CET	443	49780	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.689023972 CET	49780	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.689599991 CET	49780	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.689611912 CET	443	49780	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.689623117 CET	49780	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.689629078 CET	443	49780	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.691412926 CET	49785	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.691441059 CET	443	49785	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.691508055 CET	49785	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.691622019 CET	49785	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.691633940 CET	443	49785	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.760860920 CET	443	49781	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.760915041 CET	443	49781	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.760962963 CET	49781	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.761089087 CET	49781	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.761096954 CET	443	49781	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.761106968 CET	49781	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.761111975 CET	443	49781	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.763289928 CET	49786	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.763319969 CET	443	49786	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:54.763379097 CET	49786	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.763684034 CET	49786	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:54.763695955 CET	443	49786	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:55.940291882 CET	443	49782	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:55.940748930 CET	49782	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:55.940773010 CET	443	49782	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:55.941189051 CET	49782	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:55.941195011 CET	443	49782	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.384449005 CET	443	49782	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.384504080 CET	443	49782	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.384562969 CET	49782	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.384814978 CET	49782	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.384834051 CET	443	49782	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.384845018 CET	49782	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.384850979 CET	443	49782	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.387526989 CET	49787	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.387558937 CET	443	49787	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.387635946 CET	49787	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.387850046 CET	49787	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.387861967 CET	443	49787	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.410789967 CET	443	49783	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.411180019 CET	49783	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.411204100 CET	443	49783	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.411622047 CET	49783	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.411627054 CET	443	49783	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.472184896 CET	443	49785	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.472497940 CET	49785	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.472507000 CET	443	49785	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.472862959 CET	49785	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.472867012 CET	443	49785	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.546863079 CET	443	49786	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.547355890 CET	49786	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.547375917 CET	443	49786	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.547950029 CET	49786	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.547955036 CET	443	49786	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.854705095 CET	443	49783	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.854748964 CET	443	49783	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.854887009 CET	49783	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.855081081 CET	49783	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.855093002 CET	443	49783	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.855102062 CET	49783	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.855106115 CET	443	49783	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.857611895 CET	49788	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.857654095 CET	443	49788	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.857716084 CET	49788	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.857836962 CET	49788	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.857855082 CET	443	49788	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.917751074 CET	443	49785	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.917799950 CET	443	49785	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.917876005 CET	49785	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.918029070 CET	49785	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.918040991 CET	443	49785	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.918051004 CET	49785	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.918054104 CET	443	49785	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.923938990 CET	49789	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.923963070 CET	443	49789	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.924027920 CET	49789	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.924206018 CET	49789	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.924216986 CET	443	49789	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.995477915 CET	443	49786	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.995521069 CET	443	49786	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.995784998 CET	49786	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.995939016 CET	49786	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.995953083 CET	443	49786	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.995961905 CET	49786	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.995966911 CET	443	49786	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.998164892 CET	49790	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.998187065 CET	443	49790	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:56.998256922 CET	49790	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.998398066 CET	49790	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:56.998411894 CET	443	49790	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:57.371495962 CET	443	49784	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:57.372297049 CET	49784	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:57.372311115 CET	443	49784	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:57.372941971 CET	49784	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:57.372946024 CET	443	49784	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:57.815819025 CET	443	49784	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:57.815885067 CET	443	49784	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:57.815928936 CET	49784	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:57.816111088 CET	49784	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:57.816123962 CET	443	49784	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:57.816135883 CET	49784	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:57.816140890 CET	443	49784	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:57.818687916 CET	49791	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:57.818707943 CET	443	49791	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:57.818793058 CET	49791	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:57.818938017 CET	49791	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:57.818948984 CET	443	49791	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.107023001 CET	443	49787	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.107589960 CET	49787	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.107611895 CET	443	49787	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.108025074 CET	49787	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.108031034 CET	443	49787	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.544873953 CET	443	49787	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.544935942 CET	443	49787	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.544982910 CET	49787	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.545149088 CET	49787	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.545161963 CET	443	49787	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.545171976 CET	49787	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.545176029 CET	443	49787	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.547929049 CET	49792	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.547952890 CET	443	49792	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.548027039 CET	49792	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.548188925 CET	49792	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.548199892 CET	443	49792	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.703505993 CET	443	49789	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.704032898 CET	49789	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.704045057 CET	443	49789	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.704467058 CET	49789	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.704472065 CET	443	49789	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.706707001 CET	443	49788	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.707113981 CET	49788	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.707140923 CET	443	49788	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.707524061 CET	49788	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.707530022 CET	443	49788	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.777299881 CET	443	49790	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.777667999 CET	49790	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.777687073 CET	443	49790	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:58.778188944 CET	49790	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:58.778193951 CET	443	49790	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.113974094 CET	443	49767	216.58.208.228	192.168.2.4
Dec 4, 2024 03:49:59.114020109 CET	443	49767	216.58.208.228	192.168.2.4
Dec 4, 2024 03:49:59.114073038 CET	49767	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:49:59.152250051 CET	443	49789	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.152292967 CET	443	49789	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.152416945 CET	49789	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.152640104 CET	49789	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.152648926 CET	443	49789	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.152662039 CET	49789	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.152667046 CET	443	49789	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.155334949 CET	49793	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.155361891 CET	443	49793	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.155432940 CET	49793	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.155560970 CET	49793	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.155572891 CET	443	49793	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.159951925 CET	443	49788	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.159995079 CET	443	49788	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.160039902 CET	49788	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.160161972 CET	49788	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.160182953 CET	443	49788	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.160196066 CET	49788	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.160202026 CET	443	49788	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.162257910 CET	49794	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.162283897 CET	443	49794	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.162354946 CET	49794	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.162482977 CET	49794	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.162497044 CET	443	49794	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.223485947 CET	443	49790	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.223537922 CET	443	49790	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.223592043 CET	49790	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.223750114 CET	49790	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.223754883 CET	443	49790	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.223768950 CET	49790	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.223773003 CET	443	49790	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.225745916 CET	49795	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.225759983 CET	443	49795	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.225836039 CET	49795	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.225960016 CET	49795	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.225970984 CET	443	49795	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.534620047 CET	443	49791	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.535211086 CET	49791	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.535219908 CET	443	49791	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.535845041 CET	49791	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.535850048 CET	443	49791	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.826404095 CET	49767	443	192.168.2.4	216.58.208.228
Dec 4, 2024 03:49:59.826435089 CET	443	49767	216.58.208.228	192.168.2.4
Dec 4, 2024 03:49:59.969609022 CET	443	49791	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.969671011 CET	443	49791	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.969883919 CET	49791	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.969912052 CET	49791	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.969923973 CET	443	49791	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.969934940 CET	49791	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.969939947 CET	443	49791	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.972577095 CET	49796	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.972614050 CET	443	49796	13.107.246.63	192.168.2.4
Dec 4, 2024 03:49:59.972703934 CET	49796	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.972862005 CET	49796	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:49:59.972876072 CET	443	49796	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:00.351450920 CET	443	49792	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:00.352057934 CET	49792	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:00.352075100 CET	443	49792	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:00.352705956 CET	49792	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:00.352710009 CET	443	49792	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:00.807019949 CET	443	49792	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:00.807090044 CET	443	49792	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:00.807149887 CET	49792	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:00.807411909 CET	49792	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:00.807426929 CET	443	49792	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:00.807439089 CET	49792	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:00.807445049 CET	443	49792	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:00.810307980 CET	49797	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:00.810333014 CET	443	49797	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:00.810405970 CET	49797	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:00.810539007 CET	49797	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:00.810549974 CET	443	49797	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:00.947426081 CET	443	49795	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:00.947801113 CET	49795	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:00.947820902 CET	443	49795	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:00.948256969 CET	49795	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:00.948261023 CET	443	49795	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.000499010 CET	443	49793	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.000931025 CET	49793	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.000942945 CET	443	49793	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.001364946 CET	49793	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.001368999 CET	443	49793	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.067038059 CET	443	49794	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.067490101 CET	49794	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.067507982 CET	443	49794	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.067955971 CET	49794	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.067960978 CET	443	49794	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.382610083 CET	443	49795	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.382658958 CET	443	49795	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.382818937 CET	49795	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.383016109 CET	49795	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.383024931 CET	443	49795	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.383054018 CET	49795	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.383058071 CET	443	49795	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.385745049 CET	49798	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.385776997 CET	443	49798	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.385857105 CET	49798	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.386015892 CET	49798	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.386029959 CET	443	49798	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.458867073 CET	443	49793	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.458910942 CET	443	49793	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.459005117 CET	49793	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.459287882 CET	49793	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.459294081 CET	443	49793	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.459321976 CET	49793	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.459326029 CET	443	49793	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.461965084 CET	49799	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.461987972 CET	443	49799	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.462080002 CET	49799	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.462218046 CET	49799	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.462229967 CET	443	49799	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.510715008 CET	443	49794	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.510761976 CET	443	49794	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.510814905 CET	49794	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.510962963 CET	49794	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.510976076 CET	443	49794	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.510983944 CET	49794	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.510989904 CET	443	49794	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.513194084 CET	49800	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.513225079 CET	443	49800	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.513284922 CET	49800	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.513545036 CET	49800	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.513561010 CET	443	49800	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.708720922 CET	443	49796	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.709100962 CET	49796	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.709121943 CET	443	49796	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:01.709623098 CET	49796	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:01.709629059 CET	443	49796	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:02.147046089 CET	443	49796	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:02.147097111 CET	443	49796	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:02.147149086 CET	49796	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:02.147277117 CET	49796	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:02.147289991 CET	443	49796	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:02.147299051 CET	49796	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:02.147304058 CET	443	49796	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:02.149444103 CET	49801	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:02.149477005 CET	443	49801	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:02.149539948 CET	49801	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:02.149653912 CET	49801	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:02.149667025 CET	443	49801	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:02.592777014 CET	443	49797	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:02.593185902 CET	49797	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:02.593202114 CET	443	49797	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:02.593627930 CET	49797	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:02.593633890 CET	443	49797	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.036628962 CET	443	49797	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.036678076 CET	443	49797	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.036725044 CET	49797	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.036866903 CET	49797	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.036866903 CET	49797	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.036880970 CET	443	49797	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.036890030 CET	443	49797	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.039061069 CET	49802	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.039099932 CET	443	49802	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.039166927 CET	49802	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.039284945 CET	49802	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.039297104 CET	443	49802	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.165687084 CET	443	49798	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.166060925 CET	49798	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.166094065 CET	443	49798	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.166481018 CET	49798	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.166486025 CET	443	49798	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.227804899 CET	443	49800	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.228151083 CET	49800	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.228172064 CET	443	49800	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.228511095 CET	49800	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.228516102 CET	443	49800	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.316992998 CET	443	49799	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.317357063 CET	49799	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.317372084 CET	443	49799	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.317714930 CET	49799	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.317719936 CET	443	49799	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.609802008 CET	443	49798	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.609849930 CET	443	49798	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.609905958 CET	49798	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.610042095 CET	49798	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.610057116 CET	443	49798	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.610066891 CET	49798	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.610071898 CET	443	49798	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.612152100 CET	49803	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.612170935 CET	443	49803	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.612238884 CET	49803	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.612392902 CET	49803	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.612406015 CET	443	49803	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.665890932 CET	443	49800	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.665944099 CET	443	49800	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.666024923 CET	49800	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.666152000 CET	49800	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.666161060 CET	443	49800	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.666177988 CET	49800	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.666182995 CET	443	49800	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.669020891 CET	49804	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.669053078 CET	443	49804	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.669209957 CET	49804	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.669347048 CET	49804	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.669364929 CET	443	49804	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.771785975 CET	443	49799	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.771821976 CET	443	49799	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.771888018 CET	49799	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.772028923 CET	49799	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.772028923 CET	49799	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.772041082 CET	443	49799	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.772049904 CET	443	49799	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.773876905 CET	49805	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.773910046 CET	443	49805	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.774058104 CET	49805	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.774178982 CET	49805	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.774190903 CET	443	49805	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.936207056 CET	443	49801	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.936552048 CET	49801	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.936573029 CET	443	49801	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:03.936965942 CET	49801	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:03.936971903 CET	443	49801	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:04.380584955 CET	443	49801	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:04.380640984 CET	443	49801	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:04.380903959 CET	49801	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:04.380904913 CET	49801	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:04.380904913 CET	49801	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:04.382805109 CET	49806	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:04.382833958 CET	443	49806	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:04.382896900 CET	49806	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:04.383013010 CET	49806	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:04.383027077 CET	443	49806	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:04.684004068 CET	49801	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:04.684025049 CET	443	49801	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:04.828157902 CET	443	49802	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:04.828547955 CET	49802	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:04.828572035 CET	443	49802	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:04.829055071 CET	49802	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:04.829060078 CET	443	49802	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.270669937 CET	443	49802	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.270725012 CET	443	49802	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.270884991 CET	49802	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.271045923 CET	49802	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.271059036 CET	443	49802	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.271069050 CET	49802	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.271074057 CET	443	49802	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.273324013 CET	49807	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.273355007 CET	443	49807	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.273423910 CET	49807	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.273535013 CET	49807	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.273547888 CET	443	49807	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.450723886 CET	443	49804	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.451100111 CET	49804	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.451124907 CET	443	49804	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.451538086 CET	49804	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.451545000 CET	443	49804	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.456285000 CET	443	49803	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.456533909 CET	49803	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.456556082 CET	443	49803	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.456908941 CET	49803	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.456913948 CET	443	49803	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.620434046 CET	443	49805	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.620810986 CET	49805	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.620827913 CET	443	49805	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.621170998 CET	49805	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.621175051 CET	443	49805	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.895214081 CET	443	49804	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.895261049 CET	443	49804	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.895354033 CET	49804	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.895462036 CET	49804	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.895476103 CET	443	49804	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.895488024 CET	49804	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.895493031 CET	443	49804	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.897675991 CET	49808	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.897705078 CET	443	49808	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.897778988 CET	49808	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.897913933 CET	49808	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.897928953 CET	443	49808	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.909245014 CET	443	49803	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.909288883 CET	443	49803	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.909342051 CET	49803	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.909435034 CET	49803	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.909435034 CET	49803	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.909442902 CET	443	49803	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.909455061 CET	443	49803	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.911289930 CET	49809	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.911322117 CET	443	49809	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:05.911392927 CET	49809	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.911526918 CET	49809	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:05.911541939 CET	443	49809	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.073748112 CET	443	49805	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.073791981 CET	443	49805	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.073934078 CET	49805	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.074091911 CET	49805	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.074105024 CET	443	49805	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.074115992 CET	49805	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.074120998 CET	443	49805	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.076069117 CET	49810	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.076081991 CET	443	49810	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.076144934 CET	49810	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.076256990 CET	49810	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.076273918 CET	443	49810	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.163079023 CET	443	49806	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.163556099 CET	49806	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.163594007 CET	443	49806	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.163952112 CET	49806	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.163957119 CET	443	49806	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.607733011 CET	443	49806	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.607801914 CET	443	49806	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.607856989 CET	49806	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.607969999 CET	49806	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.607976913 CET	443	49806	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.607985973 CET	49806	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.607990026 CET	443	49806	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.610007048 CET	49811	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.610023975 CET	443	49811	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:06.610095024 CET	49811	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.610219002 CET	49811	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:06.610235929 CET	443	49811	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.053781986 CET	443	49807	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.054146051 CET	49807	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.054168940 CET	443	49807	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.054533958 CET	49807	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.054538965 CET	443	49807	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.502461910 CET	443	49807	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.502553940 CET	443	49807	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.502609968 CET	49807	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.504771948 CET	49807	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.504786015 CET	443	49807	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.504797935 CET	49807	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.504802942 CET	443	49807	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.525580883 CET	49812	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.525609016 CET	443	49812	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.525661945 CET	49812	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.525862932 CET	49812	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.525875092 CET	443	49812	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.742804050 CET	443	49808	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.743324041 CET	49808	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.743345022 CET	443	49808	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.743757963 CET	49808	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.743765116 CET	443	49808	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.755003929 CET	443	49809	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.755369902 CET	49809	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.755388021 CET	443	49809	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.755698919 CET	49809	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.755705118 CET	443	49809	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.925642967 CET	443	49810	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.926145077 CET	49810	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.926160097 CET	443	49810	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:07.926462889 CET	49810	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:07.926467896 CET	443	49810	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.196322918 CET	443	49808	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.196377039 CET	443	49808	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.196680069 CET	49808	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.196681023 CET	49808	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.196681023 CET	49808	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.198990107 CET	49813	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.199033976 CET	443	49813	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.199111938 CET	49813	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.199223995 CET	49813	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.199240923 CET	443	49813	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.209412098 CET	443	49809	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.209466934 CET	443	49809	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.209521055 CET	49809	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.209594965 CET	49809	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.209609985 CET	443	49809	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.209665060 CET	49809	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.209671021 CET	443	49809	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.211797953 CET	49814	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.211888075 CET	443	49814	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.211958885 CET	49814	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.212076902 CET	49814	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.212093115 CET	443	49814	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.379486084 CET	443	49810	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.379545927 CET	443	49810	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.379606962 CET	49810	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.379734993 CET	49810	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.379750013 CET	443	49810	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.379759073 CET	49810	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.379764080 CET	443	49810	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.382030964 CET	49815	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.382050991 CET	443	49815	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.382113934 CET	49815	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.382242918 CET	49815	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.382256985 CET	443	49815	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.392282963 CET	443	49811	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.392596960 CET	49811	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.392615080 CET	443	49811	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.393016100 CET	49811	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.393021107 CET	443	49811	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.497371912 CET	49808	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.497384071 CET	443	49808	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.836675882 CET	443	49811	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.836760044 CET	443	49811	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.836810112 CET	49811	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.836940050 CET	49811	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.836954117 CET	443	49811	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.836962938 CET	49811	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.836967945 CET	443	49811	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.839247942 CET	49816	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.839277983 CET	443	49816	13.107.246.63	192.168.2.4
Dec 4, 2024 03:50:08.839335918 CET	49816	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.839457035 CET	49816	443	192.168.2.4	13.107.246.63
Dec 4, 2024 03:50:08.839471102 CET	443	49816	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 03:48:43.461781025 CET	53	64565	1.1.1.1	192.168.2.4
Dec 4, 2024 03:48:43.515101910 CET	53	57797	1.1.1.1	192.168.2.4
Dec 4, 2024 03:48:46.470997095 CET	53	56797	1.1.1.1	192.168.2.4
Dec 4, 2024 03:48:47.623142958 CET	61062	53	192.168.2.4	1.1.1.1
Dec 4, 2024 03:48:47.623338938 CET	63729	53	192.168.2.4	1.1.1.1
Dec 4, 2024 03:48:47.762890100 CET	53	61062	1.1.1.1	192.168.2.4
Dec 4, 2024 03:48:47.762995958 CET	53	63729	1.1.1.1	192.168.2.4
Dec 4, 2024 03:48:49.244416952 CET	54495	53	192.168.2.4	1.1.1.1
Dec 4, 2024 03:48:49.244580030 CET	52285	53	192.168.2.4	1.1.1.1
Dec 4, 2024 03:48:49.993227005 CET	53	52285	1.1.1.1	192.168.2.4
Dec 4, 2024 03:48:49.993892908 CET	53	54495	1.1.1.1	192.168.2.4
Dec 4, 2024 03:49:01.908997059 CET	138	138	192.168.2.4	192.168.2.255
Dec 4, 2024 03:49:03.326360941 CET	53	59892	1.1.1.1	192.168.2.4
Dec 4, 2024 03:49:22.216559887 CET	53	53138	1.1.1.1	192.168.2.4
Dec 4, 2024 03:49:43.326781988 CET	53	64059	1.1.1.1	192.168.2.4
Dec 4, 2024 03:49:45.012826920 CET	53	61307	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 4, 2024 03:48:47.623142958 CET	192.168.2.4	1.1.1.1	0x5b18	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 4, 2024 03:48:47.623338938 CET	192.168.2.4	1.1.1.1	0x49bf	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 4, 2024 03:48:49.244416952 CET	192.168.2.4	1.1.1.1	0x7abe	Standard query (0)	s3.timeweb.cloud	A (IP address)	IN (0x0001)	false
Dec 4, 2024 03:48:49.244580030 CET	192.168.2.4	1.1.1.1	0x311	Standard query (0)	s3.timeweb.cloud	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 4, 2024 03:48:47.762890100 CET	1.1.1.1	192.168.2.4	0x5b18	No error (0)	www.google.com	216.58.208.228	A (IP address)	IN (0x0001)	false
Dec 4, 2024 03:48:47.762995958 CET	1.1.1.1	192.168.2.4	0x49bf	No error (0)	www.google.com		65	IN (0x0001)	false
Dec 4, 2024 03:48:49.993892908 CET	1.1.1.1	192.168.2.4	0x7abe	No error (0)	s3.timeweb.cloud	217.78.234.244	A (IP address)	IN (0x0001)	false
Dec 4, 2024 03:48:49.993892908 CET	1.1.1.1	192.168.2.4	0x7abe	No error (0)	s3.timeweb.cloud	217.78.234.243	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

s3.timeweb.cloud

https:

fs.microsoft.com

slscr.update.microsoft.com

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	2.19.229.151	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:48:50 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-04 02:48:50 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=126650 Date: Wed, 04 Dec 2024 02:48:50 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	217.78.234.244	443	5352	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:48:51 UTC	765	OUT	GET /8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html HTTP/1.1 Host: s3.timeweb.cloud Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-04 02:48:51 UTC	248	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Wed, 04 Dec 2024 02:48:51 GMT Content-Type: application/xml Content-Length: 249 Connection: close x-amz-request-id: tx000003ef224081a6f87d2-00674fc313-b0b1d03-ru-1 X-Robots-Tag: noindex,nofollow
2024-12-04 02:48:51 UTC	249	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 55 73 65 72 53 75 73 70 65 6e 64 65 64 3c 2f 43 6f 64 65 3e 3c 42 75 63 6b 65 74 4e 61 6d 65 3e 38 64 66 35 34 34 65 61 2d 36 37 73 38 39 64 75 36 37 38 77 65 39 30 61 6c 6b 66 64 78 7a 6d 6e 64 65 6f 69 65 77 7a 78 63 66 64 3c 2f 42 75 63 6b 65 74 4e 61 6d 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 74 78 30 30 30 30 30 33 65 66 32 32 34 30 38 31 61 36 66 38 37 64 32 2d 30 30 36 37 34 66 63 33 31 33 2d 62 30 62 31 64 30 33 2d 72 75 2d 31 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 62 30 62 31 64 30 33 2d 72 75 2d 31 2d 72 75 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><Error><Code>UserSuspended</Code><BucketName>8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd</BucketName><RequestId>tx000003ef224081a6f87d2-00674fc313-b0b1d03-ru-1</RequestId><HostId>b0b1d03-ru-1-ru</HostId></Error>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	217.78.234.244	443	5352	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:48:52 UTC	694	OUT	GET /favicon.ico HTTP/1.1 Host: s3.timeweb.cloud Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-04 02:48:52 UTC	248	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 04 Dec 2024 02:48:52 GMT Content-Type: application/xml Content-Length: 216 Connection: close x-amz-request-id: tx00000a7b9931bf1ee9353-00674fc314-b0af77c-ru-1 X-Robots-Tag: noindex,nofollow
2024-12-04 02:48:52 UTC	216	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 4e 6f 53 75 63 68 42 75 63 6b 65 74 3c 2f 43 6f 64 65 3e 3c 42 75 63 6b 65 74 4e 61 6d 65 3e 66 61 76 69 63 6f 6e 2e 69 63 6f 3c 2f 42 75 63 6b 65 74 4e 61 6d 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 74 78 30 30 30 30 30 61 37 62 39 39 33 31 62 66 31 65 65 39 33 35 33 2d 30 30 36 37 34 66 63 33 31 34 2d 62 30 61 66 37 37 63 2d 72 75 2d 31 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 62 30 61 66 37 37 63 2d 72 75 2d 31 2d 72 75 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><Error><Code>NoSuchBucket</Code><BucketName>favicon.ico</BucketName><RequestId>tx00000a7b9931bf1ee9353-00674fc314-b0af77c-ru-1</RequestId><HostId>b0af77c-ru-1-ru</HostId></Error>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	2.19.229.151	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:48:52 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-04 02:48:52 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=33415 Date: Wed, 04 Dec 2024 02:48:52 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-04 02:48:52 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49742	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:48:59 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1W1VHL71cyCsSxv&MD=gV5aoan5 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-04 02:49:00 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 94b5a966-1d34-4bdc-a48e-9b132e094fe4 MS-RequestId: bff3c72a-322d-4fb9-b045-fc9aeea6c6b4 MS-CV: uNy9eX5eqk+OBnkW.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 04 Dec 2024 02:48:58 GMT Connection: close Content-Length: 24490
2024-12-04 02:49:00 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-04 02:49:00 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:39 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1W1VHL71cyCsSxv&MD=gV5aoan5 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-04 02:49:40 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 3353f226-f77b-4a96-9188-bcc637296077 MS-RequestId: d2916eba-a107-4c61-9479-36574189691e MS-CV: ROyGsoilKUuOnga2.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 04 Dec 2024 02:49:39 GMT Connection: close Content-Length: 30005
2024-12-04 02:49:40 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-04 02:49:40 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:40 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:40 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:40 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 02 Dec 2024 13:20:33 GMT ETag: "0x8DD12D41A424BC1" x-ms-request-id: 300ecd5c-a01e-0050-4036-45db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024940Z-174f7845968xr5c2hC1EWRd0hn0000000rn000000000g6z9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:40 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-04 02:49:40 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-04 02:49:40 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-04 02:49:40 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-04 02:49:40 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-04 02:49:41 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-04 02:49:41 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-04 02:49:41 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-04 02:49:41 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-04 02:49:41 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:42 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:43 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:43 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 40031d31-601e-005c-53c5-45f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024943Z-1746fd949bd54zxghC1EWRzre400000000sg00000000phk5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:43 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:42 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:43 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:43 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 115d5b31-c01e-0046-4bcb-452db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024943Z-174f7845968swgbqhC1EWRmnb400000016yg00000000emea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:43 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:43 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:43 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 9ac3d201-201e-0000-03c5-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024943Z-1746fd949bdjzh7thC1EWR3g6400000000s0000000000u19 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:43 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:43 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:43 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:43 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024943Z-174f7845968xr5c2hC1EWRd0hn0000000rs0000000003u82 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:43 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:43 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:43 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c4831996-901e-0016-39ce-45efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024943Z-1746fd949bdwt8wrhC1EWRu6rg00000000qg00000000hdeu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:43 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:45 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:45 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:45 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4628c04c-d01e-0017-18cc-45b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024945Z-1746fd949bdwt8wrhC1EWRu6rg00000000t00000000093zy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:49:45 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:45 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:45 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: d3611829-901e-007b-22c2-45ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024945Z-1746fd949bdlqd7fhC1EWR6vt000000000u0000000006dsz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:45 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:45 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:45 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:45 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 4a622c55-e01e-0099-7fc1-45da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024945Z-1746fd949bdlqd7fhC1EWR6vt000000000v0000000003aap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:49:45 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:45 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:45 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:45 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: dbf49064-101e-00a2-1bc6-459f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024945Z-1746fd949bddtfvqhC1EWRxbpg00000000ng000000001k75 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:49:45 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:45 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:45 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: c2908fd4-501e-00a0-4ac8-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024945Z-1746fd949bdjrnwqhC1EWRpg2800000000h000000000eskx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:45 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:47 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:47 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 2b878731-501e-008c-34ce-45cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024947Z-1746fd949bdjrnwqhC1EWRpg2800000000n000000000fxkg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:47 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:47 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:47 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 6223bc78-401e-0015-38b6-450e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024947Z-1746fd949bddgsvjhC1EWRum2c00000000wg00000000a1bt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:47 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:47 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:47 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: c2a94a43-501e-00a0-7dd0-459d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024947Z-1746fd949bdkw94lhC1EWRxuz400000000pg00000000mugr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:47 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:47 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:47 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6818e2c2-d01e-0065-16d2-45b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024947Z-1746fd949bdw2rg8hC1EWR11u400000000wg000000008ke3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:47 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:47 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 864f0b94-901e-00a0-42cc-456a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024947Z-1746fd949bd7wvgbhC1EWR0rgs00000000h000000000dymp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:48 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:49 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:49 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:49 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: b5189c33-801e-008c-34cb-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024949Z-1746fd949bdjzh7thC1EWR3g6400000000g000000000b78g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:49 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:49 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: de914170-201e-0000-68ad-45a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024949Z-1746fd949bdw2rg8hC1EWR11u400000000u000000000hcsy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:50 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:49 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:49 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 16655d81-601e-0084-07c4-456b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024949Z-1746fd949bd54zxghC1EWRzre400000000sg00000000phxg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:50 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:49 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:50 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:50 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 431871c3-501e-0047-55cc-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024950Z-1746fd949bddtfvqhC1EWRxbpg00000000kg00000000319p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:49:50 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:49 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:50 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 9b0204ab-501e-0047-62c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024950Z-1746fd949bdmv56chC1EWRypnn00000000n000000000pgq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:50 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:51 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:51 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 1b86d58a-f01e-0071-54ce-45431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024951Z-1746fd949bdb8xvchC1EWRmbd400000000f0000000002wuv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:49:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:51 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:52 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: dbf7ebc2-101e-00a2-0ac7-459f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024952Z-1746fd949bd77mkmhC1EWR5efc00000000y00000000045pq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:52 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:51 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:52 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 76d3483c-401e-00a3-2bcc-458b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024952Z-1746fd949bd77mkmhC1EWR5efc00000000y00000000045pw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:52 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:52 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1e40fce6-401e-0078-1bd2-454d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024952Z-1746fd949bdlqd7fhC1EWR6vt000000000ug0000000058g3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:52 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:52 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:52 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 13f01659-601e-0084-129a-426b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024952Z-174f7845968px8v7hC1EWR08ng000000170g00000000hy5p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:52 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:53 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:53 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 98fcde7c-201e-0096-4eef-44ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024953Z-174f7845968xr5c2hC1EWRd0hn0000000rt0000000001510 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:54 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:54 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:54 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: e4103400-101e-008e-08d4-45cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024954Z-1746fd949bdlqd7fhC1EWR6vt000000000s000000000d89d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:54 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:54 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:54 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:54 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: e7678828-401e-0078-7a85-434d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024954Z-174f7845968px8v7hC1EWR08ng000000170000000000n0ny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:54 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:54 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:54 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:54 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 490c4061-c01e-000b-75c3-45e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024954Z-1746fd949bdb8xvchC1EWRmbd400000000g0000000002tgd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:49:54 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:54 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:54 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:54 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 8c022bf0-601e-0070-5bcb-45a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024954Z-1746fd949bddtfvqhC1EWRxbpg00000000n0000000002z20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:49:54 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:55 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:56 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: de9014ac-301e-0051-7cc5-4538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024956Z-174f7845968nxc96hC1EWRspw800000016kg00000000bbz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:56 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:56 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:56 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024956Z-174f7845968swgbqhC1EWRmnb4000000171g000000004ema x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:56 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:56 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:56 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 85a33a74-901e-005b-1ccd-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024956Z-174f7845968xr5c2hC1EWRd0hn0000000rk000000000qpt5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:56 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:56 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:56 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:56 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 8da67b63-c01e-0034-2ecb-452af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024956Z-1746fd949bdtlp5chC1EWRq1v400000000hg0000000047gw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:49:56 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:57 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:57 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ddae3c3f-c01e-008d-3acb-452eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024957Z-1746fd949bdwt8wrhC1EWRu6rg00000000t00000000094fa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:57 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:58 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:58 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9009c19b-701e-0053-74c6-453a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024958Z-174f7845968nxc96hC1EWRspw800000016mg000000007rxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:58 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:58 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:58 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: bff90166-801e-0083-05f9-44f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024958Z-174f7845968xr5c2hC1EWRd0hn0000000rrg000000005dkn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:59 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:58 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:58 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 7eb0f396-d01e-0066-0ac6-45ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024958Z-1746fd949bdlqd7fhC1EWR6vt000000000t0000000009s9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:59 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:58 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:59 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 00b51f18-a01e-000d-6fcc-45d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024959Z-1746fd949bdlqd7fhC1EWR6vt000000000tg000000007r6u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:59 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:49:59 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:49:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:49:59 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 4edae9bd-001e-0017-14b4-420c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T024959Z-174f7845968swgbqhC1EWRmnb40000001700000000009cpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:49:59 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:00 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:00 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 5f5d2afa-901e-0015-66cc-45b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025000Z-1746fd949bdjrnwqhC1EWRpg2800000000m000000000f9ke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:00 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:00 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:01 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 715419d5-801e-0078-38c7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025001Z-1746fd949bd54zxghC1EWRzre400000000v000000000dz9u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:01 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:00 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:01 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 935017b2-001e-0017-80c6-450c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025001Z-1746fd949bdlqd7fhC1EWR6vt000000000t0000000009sep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:01 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:01 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:01 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 6baa9d1a-801e-0048-02ce-45f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025001Z-1746fd949bdkw94lhC1EWRxuz400000000n000000000qmr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:01 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:01 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:01 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 6da3e3c6-601e-0084-52b4-426b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025001Z-174f7845968swgbqhC1EWRmnb400000016w000000000nrhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:02 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:02 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:02 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 0fbdb1d5-101e-0079-0270-435913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025002Z-174f7845968j6t2phC1EWRcfe80000001720000000003dmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:03 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:03 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9b021dfd-501e-0047-60c1-45ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025003Z-1746fd949bddgsvjhC1EWRum2c00000000ug00000000h4a0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:03 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: b6bf5bce-301e-0052-1df3-4465d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025003Z-174f7845968jrjrxhC1EWRmmrs00000016w000000000m8ck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:03 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:03 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 4da954f1-f01e-003f-58cd-45d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025003Z-1746fd949bdmv56chC1EWRypnn00000000t0000000007wud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:50:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:03 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:04 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bbae04f8-a01e-0032-80cc-451949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025004Z-1746fd949bddgsvjhC1EWRum2c00000000t000000000n8m4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:04 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:04 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 71541f9e-801e-0078-2fc7-45bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025005Z-1746fd949bdjzh7thC1EWR3g6400000000mg00000000azkf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:05 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 27481374-801e-0078-46b4-42bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025005Z-174f7845968swgbqhC1EWRmnb400000016yg00000000en9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:05 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:05 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f87bd39b-701e-0097-59cc-45b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025005Z-1746fd949bdlqd7fhC1EWR6vt000000000sg00000000bgry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:05 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:05 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:05 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5cfda45f-901e-00ac-3dce-45b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025005Z-1746fd949bdkw94lhC1EWRxuz400000000n000000000qmy4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:06 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:06 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 2accf417-001e-0014-64cb-455151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025006Z-1746fd949bdb8xvchC1EWRmbd400000000gg000000002hne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:50:06 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:07 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:07 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 6fdb675e-b01e-0070-05ce-451cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025007Z-1746fd949bdb8xvchC1EWRmbd400000000mg000000002mrh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:50:07 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:07 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:08 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 4d2a6959-e01e-0085-41b2-42c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025008Z-174f7845968j6t2phC1EWRcfe8000000171g000000005mnz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:08 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:07 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:08 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:08 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8c60988c-801e-00a3-08c1-457cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025008Z-1746fd949bdb8xvchC1EWRmbd400000000g0000000002u1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:50:08 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:07 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:08 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 1a0f4f93-001e-0049-61cb-455bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025008Z-1746fd949bdw2rg8hC1EWR11u400000000sg00000000nuk5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:08 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:08 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:08 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b51b559c-801e-008c-7fcc-457130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025008Z-1746fd949bdjrnwqhC1EWRpg2800000000t0000000000559 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:08 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:09 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:09 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 7057cc02-501e-008f-16cc-459054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025009Z-1746fd949bd6zq92hC1EWRry4800000000f0000000004uys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:50:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:10 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:10 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:10 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 859db5fc-901e-005b-23cb-452005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025010Z-1746fd949bdtlp5chC1EWRq1v400000000n000000000400z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-04 02:50:10 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:10 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:10 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 15a89213-901e-0083-02aa-42bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025010Z-174f7845968px8v7hC1EWR08ng00000017400000000077es x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:10 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:10 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-04 02:50:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 04 Dec 2024 02:50:10 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: bcf9f347-101e-007a-60d2-45047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241204T025010Z-1746fd949bdw2rg8hC1EWR11u400000000u000000000hdfk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-04 02:50:10 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-04 02:50:10 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 6064, Parent PID: 480

General

Target ID:	0
Start time:	21:48:37
Start date:	03/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5352, Parent PID: 6064

General

Target ID:	2
Start time:	21:48:42
Start date:	03/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=2308,i,14290075727724152583,10955571162648931548,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6540, Parent PID: 480

General

Target ID:	3
Start time:	21:48:48
Start date:	03/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 41

Chrome Cache Entry: 42

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 6064, Parent PID: 480

General

Chronological Activities

Analysis Process: chrome.exePID: 5352, Parent PID: 6064

General

Chronological Activities

Analysis Process: chrome.exePID: 6540, Parent PID: 480

General

Chronological Activities

Disassembly

Windows Analysis Report
https://s3.timeweb.cloud/8df544ea-67s89du678we90alkfdxzmndeoiewzxcfd/unlimitedscalabilitypossibilities%20/staff-payroll-review.html#sbarnes@clc.org.au